SSHStalker Botnet Targets Legacy Linux Systems

The SSHStalker botnet, a newly identified Linux botnet, has reportedly compromised approximately 7,000 systems by utilizing outdated techniques and exploits from 2009. According to cybersecurity firm Flare, the botnet employs a combination of Internet Relay Chat (IRC) control and various Linux kernel exploits, indicating a blend of old and modern attack methodologies. The botnet's infection strategy involves deploying multiple C-based IRC bot variants, a Perl IRC bot, and malware such as Tsunami and Keiten, suggesting an opportunistic campaign rather than a targeted attack.

New ‘SSHStalker’ Linux Botnet Uses Old TechniquesSSHStalker botnet hijacks 7,000 Linux systems using IRC and SSH

Flare's analysis reveals that SSHStalker executes a cron job every minute for persistence and employs a watchdog relaunch model. The botnet's toolset specifically targets legacy Linux systems, which constitute about 1-3% of internet-accessible Linux servers, with this percentage rising to 5-10% in environments with outdated infrastructure. The botnet's operation is characterized by its noisy behavior, deploying nearly two dozen binaries and files during its attack flow. The initial stage involves the deployment of an SSH scanner, followed by the introduction of IRC-controlled bot variants and scripts for command-and-control communication.

New ‘SSHStalker’ Linux Botnet Uses Old TechniquesSSHStalker botnet hijacks 7,000 Linux systems using IRC and SSH

The compromised systems are geographically dispersed across the United States, Europe, and the Asia-Pacific region, with a significant concentration among major cloud providers, including Oracle Cloud infrastructure. The systems targeted are often abandoned cloud instances or legacy servers running outdated kernels, which are not actively monitored. This highlights a vulnerability in environments where legacy systems remain connected to the broader network despite lacking ownership or oversight.

SSHStalker botnet hijacks 7,000 Linux systems using IRC and SSH

Experts have noted that the SSHStalker botnet serves as a reminder that older techniques can still be effective against poorly maintained systems. Jason Soroko, a senior fellow at Sectigo, emphasized that the botnet's reliance on IRC command-and-control and known Linux kernel exploits demonstrates a gap in basic cybersecurity hygiene. Michael Bell, CEO of Suzu Labs, pointed out that the botnet's simplicity—brute-forcing SSH and compiling exploit code directly on compromised hosts—should not succeed against well-maintained systems.

SSHStalker botnet hijacks 7,000 Linux systems using IRC and SSHNew ‘SSHStalker’ Linux Botnet Uses Old Techniques

To mitigate risks associated with such botnets, Bell recommends several strategies: disabling SSH password authentication on internet-facing systems, monitoring for unauthorized compiler executions, and enforcing egress filtering to restrict access to IRC infrastructure. Organizations are urged to conduct thorough inventories of their internet-exposed Linux systems and enhance monitoring practices.

SSHStalker botnet hijacks 7,000 Linux systems using IRC and SSH

While Flare's investigation provides a comprehensive overview of SSHStalker's operations, there is limited visibility into the botnet's IRC server activity, which appears dormant or in a staging phase. The lack of observed communication raises questions about the botnet's operational status and future activity.

New ‘SSHStalker’ Linux Botnet Uses Old Techniques

• “SSHStalker is a sharp reminder that old does not mean ineffective,” — Jason Soroko, Senior Fellow at Sectigo

SSHStalker botnet hijacks 7,000 Linux systems using IRC and SSH

• “None of that should work against anything maintained in the last decade, but 7,000 compromised systems say otherwise,” — Michael Bell, CEO at Suzu Labs

SSHStalker botnet hijacks 7,000 Linux systems using IRC and SSH

• “The systems getting hit are the ones nobody owns: Abandoned cloud instances.” — Michael Bell, CEO at Suzu Labs

SSHStalker botnet hijacks 7,000 Linux systems using IRC and SSH