New PumaBot Targets IoT Devices with SSH Brute-Force to Gain Persistent Access

A new wave of cyberattacks attributed to a custom botnet dubbed “PumaBot” has been discovered by Darktrace researchers, targeting embedded Linux-based IoT devices with a highly technical and persistent approach.

The botnet, written in Go, strategically brute-forces SSH credentials on a curated set of target systems, rather than relying on broad, indiscriminate internet scans.

This enables attackers to gain initial access, establish long-term persistence, and exfiltrate sensitive credentials with an array of modular malware components.

Precision Targeting

Unlike traditional botnets that indiscriminately scan internet ranges, PumaBot retrieves a tailored list of potential victim IPs with open SSH ports from its command-and-control (C2) infrastructure (notably, ssh.ddos-cc[.]org).

The malware leverages a set of credential pairs, also obtained from the C2, attempting brute-force logins over port 22.

If access is successfully gained, PumaBot executes a series of environment fingerprinting checks such as searching for the string “Pumatronix,” a manufacturer of surveillance and traffic camera systems likely to evade analysis environments and avoid specific targets.

Upon validation of the execution environment, the botnet collects basic system telemetry (OS version, architecture, etc.) and transmits this data in a JSON payload back to the C2 server over HTTP, embedding a custom header (X-API-KEY: jieruidashabi) for authentication.

This technical sophistication allows attackers to maintain awareness of new infections, update command parameters, and instruct the botnet on further actions.

PumaBot masquerades as a legitimate system file by placing itself at /lib/redis and sets up a persistent systemd service (redis.service or the typo-variant mysqI.service) in /etc/systemd/system/.

The crafted service configuration ensures the malicious payload is initiated at every system boot and operates under root privileges, blending with commonly seen Linux service names to avoid administrator suspicion.

In addition to deploying as a persistent service, PumaBot implants its own SSH keys into user authorized_keys files, guaranteeing backdoor access even if the primary infection vector is remediated.

The embedded binaries include functionality to repeatedly launch suspicious processes (“xmrig”, a known crypto miner, and “networkxm”) using infinite loops and system timers to maintain operational resiliency.

Malicious PAM Modules

The campaign’s sophistication is further evidenced by the deployment of support binaries such as ddaemon and networkxm, which further brute-force SSH credentials and ensure persistence.

Most notably, the threat actors leverage custom shell scripts to download, replace, and back up the native pam_unix.so file.

The replacement module operates as a credential-stealing rootkit, intercepting user and password data for all PAM-authenticated logins (including SSH) and exfiltrating them to remote C2 endpoints.

To obfuscate traces, collected credential logs are periodically deleted, and self-removal of installation scripts is performed upon successful infection.

Complementing this, an additional watcher binary titled “1” monitors for stolen credential logs and automatically exfiltrates them, further automating the attackers’ credential harvesting pipeline.

Analysis of the broader campaign reveals interconnected binaries and shell scripts hosted on infrastructure such as 17kp[.]xyz and lusyn[.]xyz.

The use of daemonized processes, root-level systemd services, and strategic obfuscation through service naming conventions highlight a methodical attempt to ensure long-term access and minimize detection.

Security professionals are advised to closely monitor for abnormal SSH login failures, unauthorized systemd service deployments, unexpected SSH keys, and outbound HTTP connections with non-standard headers.

Proactive measures such as limiting SSH exposure to the public internet and auditing system service files are essential to mitigating the threat from PumaBot and its associated toolkit.

Indicators of Compromise (IoCs)

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!