Quick Summary
The newly identified SSHStalker botnet targets Linux systems using the IRC protocol for command-and-control communications. It employs automated SSH scanning and brute forcing to gain access, with a focus on cloud hosting providers like Oracle Cloud. This botnet utilizes outdated vulnerabilities and includes capabilities for AWS key harvesting and cryptomining, raising significant concerns for organizations relying on cloud infrastructure.
The Securityish Brief
SSHStalker is a recently documented Linux botnet that employs the IRC (Internet Relay Chat) protocol for its command-and-control (C2) operations. This botnet uses traditional IRC mechanics, such as multiple C-based bots and multi-server redundancy, to prioritize resilience and scale over stealth. Researchers from Flare discovered that SSHStalker achieves initial access through automated SSH scanning and brute forcing, using a Go binary that disguises itself as the popular network discovery tool nmap.
Once a host is compromised, SSHStalker downloads the GCC tool to compile payloads on the victim device, enhancing portability and evasion. The botnet has been observed to scan nearly 7,000 targets, primarily focusing on cloud hosting providers within Oracle Cloud infrastructure. The malware fetches archives containing bot variants for orchestration and execution sequencing, and it maintains persistence through cron jobs that run every 60 seconds.
SSHStalker also exploits 16 CVEs targeting Linux kernel versions from 2009-2010 to escalate privileges after gaining initial access. Although the botnet has capabilities for distributed denial-of-service (DDoS) attacks, researchers have not yet observed any active attacks, indicating that the bots may currently be in an idle state or testing phase.
Flare has not linked SSHStalker to any specific threat group, but it noted similarities to the Outlaw/Maxlas botnet ecosystem. The botnet’s monetization strategies include AWS key harvesting and the use of cryptomining kits like the Ethereum miner PhoenixMiner.
Practical Implications for Security
Organizations should be aware of the risks posed by SSHStalker, particularly those using cloud infrastructure. The reliance on outdated vulnerabilities and the botnet’s noisy scanning methods highlight the need for robust security measures. Monitoring for compiler installations and unusual outbound connections to IRC channels can help detect potential compromises.
Mitigation strategies include disabling SSH password authentication, removing compilers from production images, and enforcing egress filtering. Organizations should also restrict execution from temporary directories like ‘/dev/shm’ and remain vigilant for cron jobs with short execution cycles from unusual paths.
Key Takeaways
- Disable SSH password authentication to reduce the risk of brute-force attacks.
- Remove compilers from production images to prevent unauthorized code execution.
- Implement egress filtering to monitor outbound connections and block suspicious traffic.
- Regularly check for cron jobs with short execution cycles that may indicate malicious activity.
- Monitor for unusual outbound connections to IRC channels to detect potential botnet activity.
Key Terms & Concepts
- SSH: SSH stands for Secure Shell, a protocol used to securely access and manage network devices and servers.
- IRC: IRC, or Internet Relay Chat, is a protocol for real-time text communication over the internet.
- CVE: CVE stands for Common Vulnerabilities and Exposures, a list of publicly known cybersecurity vulnerabilities.
- DDoS: DDoS, or Distributed Denial-of-Service, is an attack that aims to make a service unavailable by overwhelming it with traffic.
- Botnet: A botnet is a network of compromised computers that are controlled by a single entity to perform automated tasks, often malicious.
Read the original article here: https://www.bleepingcomputer.com/news/security/new-linux-botnet-sshstalker-uses-old-school-irc-for-c2-comms/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
