Weak SSH passwords continue to rank among the internet’s most reliable weak spots. Botnet operators exploit them relentlessly, turning Linux systems into full compromises in mere seconds.
A recent internship project with a DShield sensor captured this danger in action: a self-spreading SSH worm that blends credential brute-forcing, multi-stage malware execution, persistent backdoors, IRC-based command-and-control, digitally signed command checks, and automated lateral movement via Zmap and sshpass.
The attack unfolded in a tight timeline. At 08:24:13, the attacker connected from IP 83.135.10.12, tied to Versatel Deutschland in Germany. Just one second later, brute-force succeeded with credentials “pi / raspberryraspberry993311.”
By 08:24:15, a 4.7 KB malicious bash script was uploaded via SCP. Execution hit at 08:24:16, locking in persistence, and the attacker disconnected at 08:24:17 as the worm initiated C2 check-ins and scanning.
The SSH client banner SSH-2.0-OpenSSH_8.4p1 Raspbian-5+b1 with HASSH ae8bd7dd09970555aa4c6ed22adbbf56 points to a compromised Raspberry Pi as the launchpad.
Post-Compromise Execution and Persistence Tactics
After authentication, the script kicked off a complete botnet lifecycle. It first secured persistence by appending itself to system startup files and creating cron jobs for reboot survival.
The malware then terminated rival processes, including competing botnets and miners, to clear the field. It edited the hosts file, redirecting traffic to a known C2 server as the loopback address for stealthy control.
An embedded RSA key is activated next, verifying all incoming C2 commands digitally to block tampering. The script joined six IRC networks and locked into channel Biret.
Enrollment wrapped with a TCP handshake: the C2 registered the device’s nickname and ran “PING-PONG” life checks. If the C2 sent a “PING,” the bot replied with a “PONG,” confirming uptime.
Lateral Propagation and Defensive Lessons
With C2 live, the worm installed Zmap and sshpass for expansion. It scanned 100,000 random IPs, hunting for an open SSH port 22.
.webp)
Hits triggered credential tests: first “pi/raspberry,” then “pi / raspberryraspberry993311.” Success looped the full infection chain, enabling rapid, quiet spread. No cryptominer dropped in this capture, but the script’s rival-killing logic suggests one would follow.
This chain matters because it exposes core flaws. Default credentials on internet-facing devices invite instant pwnage, especially without key-based auth or brute-force blocks.
IoT gear like Raspberry Pis makes prime botnet fodder often exposed online with factory settings intact. The whole sequence clocked under four seconds before scanning began, showing worm speed in action.
.webp)
According to Sans, defenders can fight back effectively. Switch SSH to keys-only, ditching passwords entirely. Delete the default “pi” user on Raspberry Pis.
Deploy fail2ban to lock out repeat brute-forcers. Segment IoT networks to limit blast radius. Tools like these turn soft targets into fortresses.
This DShield catch proves that even hobbyist Linux boxes can morph into botnet zombies without the basics in place. Security hardening starts now no exceptions for small setups.
Key IOCs
| Indicator Type | Value |
|---|---|
| Attacker IP | 83.135.10.12 |
| Credentials | pi / raspberryraspberry993311 |
| SSH HASSH | ae8bd7dd09970555aa4c6ed22adbbf56 |
| IRC Channel | #biret |
| Malware Size | 4.7 KB bash script |
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
