Hackers Attacking Linux SSH Servers to Deploy Scanner Malware

Hackers often target Linux SSH servers due to their widespread use in hosting critical services, and the following loopholes make them vulnerable, providing opportunities to hackers for unauthorized access and potential exploitation:-

  • Weak passwords
  • Unpatched vulnerabilities
  • Misconfigurations

Cybersecurity researchers at AhnLab Security Emergency Response Center (ASEC) recently identified that hackers actively attack the Linux SSH servers to deploy scanner malware.

Technical analysis

Threat actors target poorly managed servers, seeking IP and SSH credentials for DDoS and CoinMiner malware. IP scanning identifies active SSH ports, followed by brute force attacks. More CoinMiners mean increased cryptocurrency mining. 

DDoS attacks grow in power with more controlled bots, and to install more malware, actors need target information besides DDoS and CoinMiners, malware scans, and attacks vulnerable systems. 

Meanwhile, SSH scanner malware DDoS bots and CoinMiners may be installed. Besides this, some actors install scanners, selling breached info on the dark web.

Here below, we have mentioned all the common malware that is installed in attacks against poorly managed Linux SSH servers:-

  • ShellBot
  • Tsunami
  • ChinaZ DDoS Bot
  • XMRig CoinMiner
  • Mirai
  • Gafgyt
  • XorDDoS

Threat actors deploy malware on Linux servers after logging in with stolen SSH credentials.

Classification of malware targeting Linux SSH servers (Source – ASEC)

Threat actor scans for active SSH (port 22) systems using stolen credentials for malware installation. 

The CPU core check command confirms the successful login. The actor downloads a compressed file with a port scanner and SSH attack tool. Notable commands include:-

  • cd /ev/network
  • unaem 0a

Threat actor runs “go” script for port scanning, banner grabbing, and SSH dictionary attacks. “gob” and “rand” scripts allow IP class customization. 

The results are saved in “bios.txt” and banners in “banner.log.” The “prg” tool extracts IPs with “SSH-2.0-OpenSSH” from “bios.txt” to use in dictionary attacks, and the successful logins are stored in “ssh_vuln.” 

Besides this, the total CPU cores are checked using “grep -c ^processor /proc/cpuinfo.” After scanning and obtaining credentials, the actor repeats the process and installs the same tools.

Recommendations

To safeguard cybersecurity, researchers recommended the following mitigations:-

  • Always use strong
  • Regularly changed passwords
  • Update patches
  • Employ firewalls
  • Exercise caution with updated security versions like V3
Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

AWS Warns of Multiple Vulnerabilities in Amazon WorkSpaces, Amazon AppStream 2.0, & Amazon DCV

Amazon Web Services (AWS) has issued a critical security advisory highlighting vulnerabilities in specific versions…

6 hours ago

FlowerStorm PaaS Platform Attacking Microsoft Users With Fake Login Pages

Rockstar2FA is a PaaS kit that mimics the legitimate credential-request behavior of cloud/SaaS platforms. Phishing…

8 hours ago

New Tool Unveiled to Scan Hacking Content on Telegram

A Russian software developer, aided by the National Technology Initiative, has introduced a groundbreaking AI…

8 hours ago

PoC Exploit Released for Ivanti Connect Secure RCE Vulnerability

A serious security flaw has been identified in Ivanti Connect Secure, designated as CVE-2025-0282, which enables…

11 hours ago

Let’s Encrypt Unveils Six-Day Certificate and IP Address Options for 2025

Let’s Encrypt has announced plans to introduce six-day certificate options and support for IP address…

12 hours ago

Bug Bounty Bonanza: $40,000 Reward for Escalating Limited Path Traversal to RCE

As a dedicated bug bounty hunter with an enviable track record on BugCrowd, Abdullah Nawaf, Full…

12 hours ago