Back to today’s briefing

Story perspectives

SSHStalker Botnet Compromises 7,000 Legacy Linux Systems

2/11/2026

43 5 Full Breakdown

Summary

Story summary

SSHStalker is a Linux botnet that has compromised nearly 7,000 systems worldwide to date.
The botnet uses Internet Relay Chat for command-and-control across multiple regions.
It executes cron jobs every minute to maintain persistence on infected hosts.
Flare's analysis shows SSHStalker targets legacy Linux systems that run on aging infrastructure.
Legacy Linux systems represent a small share of internet-accessible servers, increasing exposure risk.

1 of 1

Story summary

SSHStalker is a Linux botnet that has compromised nearly 7,000 systems worldwide to date.
The botnet uses Internet Relay Chat for command-and-control across multiple regions.
It executes cron jobs every minute to maintain persistence on infected hosts.
Flare's analysis shows SSHStalker targets legacy Linux systems that run on aging infrastructure.
Legacy Linux systems represent a small share of internet-accessible servers, increasing exposure risk.