SSHStalker

SSHStalker is a previously undocumented Linux botnet focused on mass compromise of internet-exposed Linux servers through SSH scanning and brute-force authentication attempts. The operation uses an automated intrusion pipeline that rapidly stages tooling on newly compromised hosts, installs build dependencies when needed, and compiles multiple payloads directly on victim systems. Its command-and-control architecture relies on IRC, with multiple bot variants and redundant channels or servers to improve resilience. The botnet’s tradecraft emphasizes scale, persistence, and operational durability rather than immediate disruptive effects. It establishes recurring persistence through scheduled relaunch mechanisms and includes watchdog logic to restore bot processes if they are terminated. Observed tooling also includes log-cleaning components, rootkit-like artifacts, and execution from volatile or memory-backed locations to reduce forensic visibility. Researchers characterized this pattern as dormant persistence: maintaining long-term access and bot enrollment without immediately deploying overt impact operations during the observation period. SSHStalker’s toolkit includes legacy Linux privilege-escalation exploits primarily targeting outdated 2.6.x kernel generations, especially vulnerabilities from the 2009–2010 period. This suggests an opportunistic focus on neglected or long-tail systems rather than fully maintained infrastructure. The broader toolset includes IRC bot components associated with Tsunami and Keiten, Perl and C-based payloads, and additional reconnaissance capability aimed at harvesting exposed cloud credentials from web content. Cryptomining and DDoS-capable components were present in the ecosystem, indicating the operator retains monetization and attack options even when those functions were not actively observed. The operation appears to have heavily affected cloud-hosted Linux servers, with notable concentration in Oracle Cloud infrastructure across multiple regions. Its tactics and tooling resemble Outlaw or Maxlas-style Linux botnet activity, but no definitive attribution to those groups is established. Romanian-language artifacts and slang provide the strongest available clue regarding likely operator origin, but attribution remains unconfirmed. Overall, SSHStalker fits a mid-tier Linux botnet actor profile using old but reliable techniques—SSH brute force, multi-stage payload deployment, cron-based persistence, privilege escalation against legacy kernels, and IRC coordination—to build and retain a large pool of compromised systems.