Loading story…
New threat research described two distinct botnet operations expanding through mass compromise. Flare reported a previously undocumented Linux botnet it dubbed SSHStalker, observed via an SSH honeypot and characterized by IRC-based command-and-control with multiple bot variants (including legacy families such as Tsunami and Keiten), automated scanning and staging (including a Golang scanner masquerading as nmap behavior and a compile-and-run workflow), and noisy but effective persistence via cron jobs that can re-establish the bot within roughly a minute if not fully removed. The tooling also included log-tampering artifacts (e.g., utmp/wtmp/lastlog manipulation) and a “back-catalog” of older Linux 2.6-era exploits, suggesting the operator is targeting long-tail, poorly maintained infrastructure; Flare noted playbook similarities to Outlaw/Maxlas-style operations but did not claim definitive attribution.
Separately, reporting on a Silent Push analysis described a large SystemBC (aka Coroxy/DroxiDat) botnet comprising 10,000+ infected IPs globally, with notable concentrations in the US and additional presence across Europe and Asia. SystemBC is described as SOCKS5 proxy malware commonly used by threat actors to mask downstream activity and historically associated with enabling ransomware deployment; the report highlighted infections linked to government-related domains based on passive DNS observations, indicating potential exposure of sensitive environments even when immediate follow-on payloads were not directly observed. A third article provided general technical background on how internet-wide scanners (e.g., Shodan/Censys-style platforms) perform active service identification and banner grabbing; it is contextual but does not report on either botnet operation specifically.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Flare noted Romanian-language and nickname signals and operational overlaps with the Outlaw/Maxlas ecosystem, but said there were no definitive identifiers tying SSHStalker to Outlaw or Dota. The researchers assessed it could be a derivative or copycat operation rather than a confirmed attribution.
The SSHStalker toolkit was found to include older Linux 2.6.x kernel exploits from 2009 to 2010, rootkit-class artifacts, cryptomining components, and a separate web-scanning kit for harvesting exposed AWS credentials from websites. The findings showed the botnet was built from multiple components aimed at scale, resilience, and long-tail legacy targets.
Researchers detailed SSHStalker's mass-compromise workflow, including a Golang SSH scanner disguised as "nmap," on-host installation of GCC, compilation of C payloads, and deployment of IRC bots. They also found persistence via a cron watchdog that relaunched the malware within about 60 seconds if terminated.
Flare's research team observed a previously undocumented Linux botnet they named SSHStalker through an SSH honeypot over roughly two months in early 2026. The operation used automated SSH compromise to enroll Linux systems into an IRC-based command-and-control network.
In the same SystemBC investigation, researchers identified a previously undocumented Perl-based variant of the malware. The new variant suggested the botnet operators were continuing to evolve the malware for resilience and evasion.
Silent Push said indicators tied some SystemBC infections to government-related infrastructure, including a Vietnamese provincial government site and domains associated with the Government of Burkina Faso. The finding raised concerns that government networks may have been compromised or used as hop points.
Silent Push reported discovering a globally distributed botnet of devices infected with SystemBC proxy malware, identifying more than 10,000 unique infected IP addresses. The infections were concentrated in countries including the United States, Germany, France, Singapore, and India.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourceflare.io
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Silent Push reported that the long-running **SystemBC** (aka **Coroxy** / **DroxiDat**) malware family has expanded into a botnet of **more than 10,000 unique infected IPs** globally. SystemBC primarily functions as a **SOCKS5 proxy** and **backdoor**, enabling threat actors to relay command-and-control and other malicious traffic through victim systems to obscure attribution and maintain persistent access; some variants have also been linked to **ransomware-adjacent activity** dating back to 2019. The research indicates infections are concentrated in the **United States** (with additional hotspots including **Germany, France, Singapore, and India**) and includes compromises in **sensitive infrastructure**, such as IPs hosting government websites in **Burkina Faso** and **Vietnam**. Silent Push observed SystemBC infrastructure using **abuse-tolerant/bulletproof hosting** (including `bthoster[.]com` and **AS213790 / BTCloud**) and identified a **previously undocumented Perl-based variant**, suggesting ongoing development. Reporting also notes the botnet’s resilience following Europol’s **Operation Endgame** disruption efforts, with indications that operators have adapted their infrastructure and targeting to sustain long-lived infections.
Jun 29, 2026
Security researchers reported several distinct but related findings showing how attackers are abusing **Linux-based infrastructure** for botnets, cryptomining, and post-compromise operations. Eclypsium identified a new **CondiBot** variant labeled `QTXBOT` and a previously undocumented **Monaco** cryptominer targeting network devices and exposed SSH services, with Monaco using brute-force access and exfiltrating stolen credentials to a command-and-control server hosted on Alibaba Cloud Singapore. Separately, Hunt.io exposed an Iranian-operated relay and botnet environment through an open directory, revealing a **15-node** tunnel network, SSH-based mass deployment tooling, on-host compilation of DDoS malware, and active command-and-control infrastructure. Flare also documented how threat actors repeatedly use the legitimate open-source script **Bench.sh** after initial access to profile compromised systems, including JupyterLab, Jupyter Notebook, SSH, Apache Tomcat, and PHP-based environments, in order to assess CPU, memory, disk, and bandwidth for follow-on abuse such as cryptomining, proxying, or DDoS. The reporting does **not** describe a single shared intrusion campaign: the CondiBot/Monaco discovery, the Iranian botnet infrastructure exposure, and Bench.sh abuse are separate research items connected by the broader theme of attackers operationalizing compromised Linux and network infrastructure. A separate report on **FancyBear/APT28** email theft and a general weekly security recap are different topics and should be excluded.
Jun 29, 2026
Researchers reported a previously undocumented Linux botnet dubbed **SSHStalker** that has compromised roughly **7,000** systems by combining **SSH credential brute-forcing/scanning** with **legacy (circa-2009) exploit chains** and highly automated staging. The activity was observed over multiple weeks via SSH honeypots, with intrusions characterized by rapid deployment, on-host compilation, and automated enrollment into command infrastructure, indicating an operation optimized for mass compromise rather than targeted intrusion. SSHStalker uses **IRC-based command-and-control** and a mixed toolkit that includes C-based bots, Perl scripts, and known botnet malware families such as **Tsunami** and **Keiten**. Reporting highlighted an unusual “**dormant persistence**” pattern: infected hosts are kept under control without immediate visible monetization or impact operations, despite having capabilities associated with **DDoS** and **cryptomining**. Persistence is described as noisy but effective, including **cron-based relaunch** behavior that can restore the malware within about a minute after disruption, suggesting the operator may be staging infrastructure or retaining access for future use.
Jun 29, 2026