Dropbear
Dropbear is a lightweight SSH server and remote access utility that appears in the provided content as a backdoor component deployed on compromised devices and endpoints. In the AryStinger botnet campaign, the malware downloads dropbear and dropbearkey into /tmp/bin, starts the Dropbear SSH service, and modifies iptables to permit access, establishing persistent remote login access for the attacker. QiAnXin reported AryStinger can use Dropbear or gs-netcat to maintain long-term remote management channels on infected RTL819X-based routers and NAS devices; one observed RTL819X watchdog component started Dropbear on port 2332. The content also states that CERT-UA and ESET observed BlackEnergy using its modular plugin architecture to download and keep running a variant of the Dropbear SSH backdoor during the Ukraine attacks, alongside the KillDisk destructive plugin. Separately, U.S. government advisories cited Iran-affiliated actors deploying Dropbear SSH on victim operational technology endpoints after initial access to internet-exposed PLC environments, using port 22 for remote access to extract project files and manipulate HMI and SCADA display data. High-confidence behaviors directly mentioned in the content include persistent SSH-based backdoor access, remote login enablement, and use on infected routers, NAS devices, Windows victim environments associated with BlackEnergy, and OT endpoints in government, water, wastewater, and energy sectors.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Additionally, the actors deployed Dropbear Secure Shell (SSH) software on victim endpoints to enable them to gain remote access through port 22 [T1219].
Techniques & procedures
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
1 technique
Execution
An os command injection vulnerability exists in the Openvpn configuration restore route_up functionality... A specially crafted configuration value can lead to arbitrary command execution... if we include in our restored configuration the following xml line: <route_up>"/usr/sbin/dropbear -g -w -C -B -L -p 22"</route_up> This command will be put into the configuration of the openvpn server and run immediately after a vpn connection is established.
Persistence
3 techniques
Persistence
...start up a dropbear server that allows for remote logins using the same credentials that are used for the web GUI, resulting in a remote shell...
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
Defense Impairment
1 technique
Defense Impairment
Credential Access
1 technique
Credential Access
Lateral Movement
1 technique
Lateral Movement
Command and Control
2 techniques
Command and Control
Upon obtaining initial access, the threat actors established command-and-control by deploying Dropbear... Public-facing domains and Telegram channels serve as the primary dissemination and amplification hub, with the messaging platform also playing a huge role in command-and-control (C2) operations by allowing the malware to communicate with threat actor-controlled bots...
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Dropbear is referenced as a lightweight SSH server used by AryStinger to establish persistent backdoor access on infected devices.
Dropbear is used by AryStinger on compromised routers to establish persistent SSH-based remote access for attackers.
SSH software deployed on victim endpoints to establish command-and-control and remote access over port 22 in OT intrusions.
SSH backdoor variant deployed as a plugin alongside BlackEnergy in the Ukraine attacks.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.