Loading story…
Internet Storm Center (ISC) researchers reported a self-propagating SSH worm observed by a DShield honeypot sensor that can compromise exposed Linux systems in roughly four seconds by using credential stuffing/brute force against weak SSH passwords, with a notable focus on Raspberry Pi devices left on default or common credentials (e.g., user pi with passwords such as raspberry and raspberryraspberry993311). The observed attack chain rapidly authenticates, uploads a compact 4.7 KB bash script (via SCP), executes it, and establishes persistence while removing competing malware, enabling worm-like exponential spread across vulnerable internet-connected hosts.
Technical analysis indicates the activity likely originated from an already-compromised Raspberry Pi in Germany (IP 83.135.10.12, Versatel Deutschland), using an SSH client string consistent with Raspbian (SSH-2.0-OpenSSH_8.4p1 Raspbian-5+b1) and a recorded HASSH fingerprint ae8bd7dd09970555aa4c6ed22adbbf56. Post-compromise, the malware connects to IRC-based command-and-control and includes cryptographically signed command verification; it also automates scanning and lateral movement using tools such as Zmap and sshpass, reinforcing how default/weak SSH authentication on IoT and small-form-factor Linux systems remains a high-impact botnet entry point.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A SafeDep report identified sjs-biginteger as a malicious npm package impersonating the legitimate big.js library. The package was found to add attacker SSH keys to authorized_keys, open SSH access on port 22, and exfiltrate credentials to command-and-control infrastructure for persistent access and data theft.
Internet Storm Center researchers published analysis of a self-propagating Linux SSH worm that uses IRC-based command and control with RSA-signed command verification. They also reported the malware installs tools such as zmap and sshpass to scan roughly 100,000 random IPs and spread using common Raspberry Pi default credentials.
A DShield SSH sensor recorded an attacker logging in with weak or default SSH credentials, uploading a 4.7KB bash script via SCP, establishing persistence, and enrolling the host into a botnet within seconds. The attack traffic was traced to a compromised Raspberry Pi associated with a German ISP.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
safedep.io
Open sourceintel.breakglass.tech
Open sourcecybersecuritynews.com
Open sourceisc.sans.edu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a previously undocumented Linux botnet dubbed **SSHStalker** that has compromised roughly **7,000** systems by combining **SSH credential brute-forcing/scanning** with **legacy (circa-2009) exploit chains** and highly automated staging. The activity was observed over multiple weeks via SSH honeypots, with intrusions characterized by rapid deployment, on-host compilation, and automated enrollment into command infrastructure, indicating an operation optimized for mass compromise rather than targeted intrusion. SSHStalker uses **IRC-based command-and-control** and a mixed toolkit that includes C-based bots, Perl scripts, and known botnet malware families such as **Tsunami** and **Keiten**. Reporting highlighted an unusual “**dormant persistence**” pattern: infected hosts are kept under control without immediate visible monetization or impact operations, despite having capabilities associated with **DDoS** and **cryptomining**. Persistence is described as noisy but effective, including **cron-based relaunch** behavior that can restore the malware within about a minute after disruption, suggesting the operator may be staging infrastructure or retaining access for future use.
Jun 29, 2026
SophosLabs reported a Linux botnet dubbed **Chalubo** that compromises Internet-facing SSH servers through brute-force credential attacks and can also run on IoT hardware across multiple CPU architectures. The malware uses a layered infection chain in which a downloader establishes persistence, disguises its process name, retrieves an encrypted and LZMA-compressed payload, and launches the main bot; later campaigns also used the **Elknot** dropper. Researchers said Chalubo encrypts both its core bot and Lua-based command scripts with the **ChaCha** stream cipher and includes anti-analysis features more commonly associated with Windows malware. The botnet was built to conduct distributed denial-of-service activity, with Lua scripts enabling **DNS**, **UDP**, and **SYN flood** attacks. Sophos observed one command directing infected systems to launch a SYN flood against IP address `59.56.76.41` on port `10100`, while excluding several hardcoded addresses from targeting. Although the malware shares some code with **Xor.DDoS** and **Mirai**, researchers assessed it as a distinct family and urged defenders to harden SSH access, replace default credentials, and monitor suspicious outbound traffic to TCP port `8852`.
Jun 29, 2026
The Hajime malware infected nearly **300,000** internet-connected devices by combining multiple compromise methods against routers, cameras, DVRs, and cable modems. Researchers reported that the worm spread through **Telnet default-password attacks**, added a **TR-069** exploitation module for remote code execution, and abused an **Arris cable modem password-of-the-day** mechanism, allowing it to compromise vulnerable IoT systems at scale. The botnet used a peer-to-peer architecture and tailored downloader binaries to victim device architectures and WAN interfaces, while also refining banner-based brute-forcing and architecture detection to improve infection success. Victimology data showed broad global exposure, with the highest concentrations of infected hosts observed in **Iran, Brazil, Vietnam, Russia, and Turkey**. DHT leecher analysis identified **297,499 unique infected hosts**, and honeypot telemetry indicated many victims were consumer and small-office embedded devices. Despite the botnet’s size and continued evolution, researchers said they had not observed Hajime being used for overt attacks at the time of reporting, leaving its ultimate purpose unclear even as it was tracked as **`Backdoor.Linux.Hajime`**.
Jun 29, 2026