Loading story…
Researchers reported a previously undocumented Linux botnet dubbed SSHStalker that has compromised roughly 7,000 systems by combining SSH credential brute-forcing/scanning with legacy (circa-2009) exploit chains and highly automated staging. The activity was observed over multiple weeks via SSH honeypots, with intrusions characterized by rapid deployment, on-host compilation, and automated enrollment into command infrastructure, indicating an operation optimized for mass compromise rather than targeted intrusion.
SSHStalker uses IRC-based command-and-control and a mixed toolkit that includes C-based bots, Perl scripts, and known botnet malware families such as Tsunami and Keiten. Reporting highlighted an unusual “dormant persistence” pattern: infected hosts are kept under control without immediate visible monetization or impact operations, despite having capabilities associated with DDoS and cryptomining. Persistence is described as noisy but effective, including cron-based relaunch behavior that can restore the malware within about a minute after disruption, suggesting the operator may be staging infrastructure or retaining access for future use.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Flare reported the previously undocumented SSHStalker botnet, describing its IRC-based components, dormant persistence, use of 2009–2010-era exploits, and possible Romanian-language clues. The researchers also published indicators of compromise and defensive guidance for detection and mitigation.
During the observed campaign, the botnet infected roughly 7,000 Linux machines, with heavy impact on cloud-hosted servers and links to Oracle Cloud infrastructure. The operators used weak SSH credentials and legacy Linux privilege-escalation exploits to expand access.
Flare researchers observed repeated attacks from a previously undocumented Linux botnet in their SSH honeypots over a two-month period in early 2026. The activity showed mass SSH scanning and brute-force attempts against Linux servers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityaffairs.com
Open sourcecsoonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New threat research described two distinct botnet operations expanding through mass compromise. Flare reported a previously undocumented Linux botnet it dubbed **SSHStalker**, observed via an SSH honeypot and characterized by *IRC-based* command-and-control with multiple bot variants (including legacy families such as **Tsunami** and **Keiten**), automated scanning and staging (including a Golang scanner masquerading as `nmap` behavior and a compile-and-run workflow), and noisy but effective persistence via `cron` jobs that can re-establish the bot within roughly a minute if not fully removed. The tooling also included log-tampering artifacts (e.g., `utmp/wtmp/lastlog` manipulation) and a “back-catalog” of older Linux 2.6-era exploits, suggesting the operator is targeting long-tail, poorly maintained infrastructure; Flare noted playbook similarities to **Outlaw/Maxlas**-style operations but did not claim definitive attribution. Separately, reporting on a Silent Push analysis described a large **SystemBC** (aka **Coroxy/DroxiDat**) botnet comprising **10,000+** infected IPs globally, with notable concentrations in the US and additional presence across Europe and Asia. SystemBC is described as **SOCKS5 proxy malware** commonly used by threat actors to mask downstream activity and historically associated with enabling ransomware deployment; the report highlighted infections linked to **government-related domains** based on passive DNS observations, indicating potential exposure of sensitive environments even when immediate follow-on payloads were not directly observed. A third article provided general technical background on how internet-wide scanners (e.g., Shodan/Censys-style platforms) perform active service identification and banner grabbing; it is contextual but does not report on either botnet operation specifically.
Jun 29, 2026
Internet Storm Center (ISC) researchers reported a **self-propagating SSH worm** observed by a DShield honeypot sensor that can compromise exposed Linux systems in roughly **four seconds** by using **credential stuffing/brute force** against weak SSH passwords, with a notable focus on *Raspberry Pi* devices left on default or common credentials (e.g., user `pi` with passwords such as `raspberry` and `raspberryraspberry993311`). The observed attack chain rapidly authenticates, uploads a compact **4.7 KB bash script** (via SCP), executes it, and establishes persistence while removing competing malware, enabling worm-like exponential spread across vulnerable internet-connected hosts. Technical analysis indicates the activity likely originated from an already-compromised *Raspberry Pi* in Germany (IP `83.135.10.12`, Versatel Deutschland), using an SSH client string consistent with Raspbian (`SSH-2.0-OpenSSH_8.4p1 Raspbian-5+b1`) and a recorded HASSH fingerprint `ae8bd7dd09970555aa4c6ed22adbbf56`. Post-compromise, the malware connects to **IRC-based command-and-control** and includes **cryptographically signed command verification**; it also automates scanning and lateral movement using tools such as **Zmap** and **sshpass**, reinforcing how default/weak SSH authentication on IoT and small-form-factor Linux systems remains a high-impact botnet entry point.
Jun 29, 2026
SophosLabs reported a Linux botnet dubbed **Chalubo** that compromises Internet-facing SSH servers through brute-force credential attacks and can also run on IoT hardware across multiple CPU architectures. The malware uses a layered infection chain in which a downloader establishes persistence, disguises its process name, retrieves an encrypted and LZMA-compressed payload, and launches the main bot; later campaigns also used the **Elknot** dropper. Researchers said Chalubo encrypts both its core bot and Lua-based command scripts with the **ChaCha** stream cipher and includes anti-analysis features more commonly associated with Windows malware. The botnet was built to conduct distributed denial-of-service activity, with Lua scripts enabling **DNS**, **UDP**, and **SYN flood** attacks. Sophos observed one command directing infected systems to launch a SYN flood against IP address `59.56.76.41` on port `10100`, while excluding several hardcoded addresses from targeting. Although the malware shares some code with **Xor.DDoS** and **Mirai**, researchers assessed it as a distinct family and urged defenders to harden SSH access, replace default credentials, and monitor suspicious outbound traffic to TCP port `8852`.
Jun 29, 2026