A newly uncovered Linux botnet campaign dubbed SSHStalker is reviving classic IRC-based command-and-control infrastructure, combining automated SSH brute-force attacks with legacy malware toolkits to enroll thousands of Linux systems at scale.
Despite its heavy use of older techniques, researchers say the operation is highly optimized for repeatable mass compromise rather than stealth.
At its core, SSHStalker uses a Golang-based scanner disguised as “nmap” to identify internet-facing systems with port 22 open. Once deployed on a compromised host, the scanner searches for additional vulnerable SSH servers, enabling worm-like propagation.
A recovered results file showed nearly 7,000 freshly scanned SSH targets in January 2026, heavily concentrated in cloud hosting ranges, including large Oracle Cloud ASN blocks.
After gaining access, the attacker downloads GCC and compiles multiple C-based IRC bot variants directly on the victim machine.
Two primary C files (1.c and 2.c) connect to separate IRC servers gsm[.]ftp[.]sh (#auto) and plm[.]ftp[.]sh (#xx) using hard-coded channel keys.
This redundancy ensures control even if one server goes offline. Additional payloads arrive in compressed archives, including more IRC bots (C and Perl), privilege-escalation helpers, and log-cleaning utilities.
The botnet’s control structure relies on traditional IRC mechanics rather than modern encrypted C2 frameworks. Multiple bot variants join IRC channels, await commands, and support DDoS-style attack functions.
A Perl-based bot sets its process name to “-bash” to blend in with system processes. At the same time, other components manipulate utmp, wtmp, and lastlog files to erase traces of SSH access.
Persistence is intentionally noisy but effective. The malware installs a cron job that executes every minute, launching an update script.
This watchdog checks whether the bot process is still running and relaunches it if terminated. If defenders kill the process without removing the cron entry, the bot typically returns within 60 seconds.
Legacy Exploits and Ecosystem Overlap
SSHStalker also ships with an extensive archive of Linux kernel exploits targeting 2.6.x-era systems, including CVEs from 2009 and 2010, such as CVE-2009-2692 and CVE-2010-3849.
While largely ineffective against modern patched infrastructure, these exploits remain viable against legacy VPS images, embedded devices, and unmaintained long-tail servers.
Researchers estimate exposure at 1–3% of internet-facing Linux servers, rising higher in outdated hosting environments.
The toolkit includes multiple rootkit-class artifacts (brk, ptrace, and others), as well as cryptocurrency mining components such as PhoenixMiner and Camelot-based miners configured with hard-coded wallet addresses.
These suggest monetization via cryptomining, even though observed honeypot infections showed no immediate DDoS or mining activity. Instead, the campaign appears to prioritize dormant persistence infect first, monetize later.
Threat intelligence analysis shows structural similarities to historical Romanian-linked botnets, including Outlaw/Maxlas-style operations, such as SSH brute-force staging, cron persistence, multi-layer payload packaging, and IRC channel camouflage via nickname randomization.
However, no direct Outlaw identifiers were found, suggesting a derivative or copycat operator rather than confirmed attribution.
Researchers also discovered a web reconnaissance kit capable of scanning over 33,000 website paths for exposed AWS keys using regex patterns like “AKIA.”
The binary includes multi-threaded HTTP scanning, TLS support, DNS-over-HTTPS, and proxy handling, indicating an additional focus on credential harvesting beyond SSH compromise.
Defenders should monitor for GCC or execute on production servers, especially in directories such as /tmp or /dev/shm. Alerts should trigger when new binaries execute shortly after compilation.
Persistent outbound IRC connections and cron jobs running every minute are high-confidence indicators.
According to Flare, hardening steps include disabling SSH password authentication, enforcing key-only access, limiting SSH exposure to trusted IP ranges, removing compilers from production images, restricting execution to memory-backed paths, and implementing strict egress filtering.
SSHStalker demonstrates that older IRC-based botnets remain viable when paired with automated SSH compromise pipelines.
By prioritizing scale, redundancy, and reliability over stealth, operators can still build resilient Linux botnets using decades-old infrastructure techniques.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
