Recon-Only SSH Attack Leaves No Malware but Signals a Second-Stage Intrusion

Recon-only activity on SSH is not harmless background noise. A recent honeypot session shows an automated Go-based bot logging in as root, exhaustively grading host hardware for cryptomining suitability, then exiting without dropping a single binary.

Cowrie, which exposes a realistic fake Linux shell and records full command transcripts, logged a connection from 91.92.40.13 that authenticated as root with the trivial password 123123 on its first try and disconnected roughly eight seconds later.

The SSH client string, SSH-2.0-Go, immediately marked the session as automated tooling rather than a human operator. No files were fetched, no persistence was attempted, and no second-stage process was spawned only reconnaissance.

Cowrie’s transcript shows two commands executed, both focused entirely on discovery. Rather than the familiar “curl | sh” or wget-based loader chains typical of generic botnets, this actor invested the entire dwell time in profiling the host.

That behavior change is the key: this was not a misfire, but a triage pass.

The first command performed a structured hardware and environment survey. It captured the OS and kernel via uname, CPU architecture and core count, CPU model, and then invoked lspci specifically hunting for an NVIDIA GPU.

System uptime and recent logins (last) were also collected. Each value was printed as a clearly labeled field UNAME, ARCH, CPUS, CPU_MODEL, GPU, LAST in a format designed for machine parsing and later decision-making.

The second command read /proc/meminfo to calculate whether physical memory exceeded 1,048,576 KB (1 GB), and ran the check through sudo -S, reusing the same password to test whether privilege escalation to full root would succeed without interaction.

SANS technology Researchers said that, an internet-facing DShield sensor built on a Raspberry Pi 4 and running the Cowrie SSH honeypot captured a short but unusually disciplined attack.

Taken together, this sequence aligns closely with cryptomining or resource-hijacking tradecraft: a miner is only worth deploying on hardware that clears minimum thresholds for CPU, GPU, and RAM, and an operator wants assurance of root control before committing.

Recon-Only SSH Attack

Denial-of-service botnets, by contrast, do not care about discrete GPU presence or exact CPU models they only need connectivity.

Earlier in June, the same sensor recorded a very different SSH campaign: a loader that authenticates, chains curl/wget//dev/tcp to retrieve an ELF binary, and immediately enrolls the host into a DDoS botnet.

This loader rotated IP addresses and C2 endpoints, but its HASSH fingerprint remained stable across sessions, allowing correlation into a single campaign.

The recon-first miner bot presented a different SSH client and a distinct HASSH (2ec37a7cc8daf20b10e1ad6221061ca5), indicating a separate actor, not a tactic shift by the DDoS operator.

Crucially, the absence of a dropped payload does not equate to “no impact.” Recon-only logins are often the first stage of a two-step intrusion: hardware grading now, deployment of a miner or other resource-intensive payload later, potentially from a different address or toolset.

Treating “look-only” sessions as ignorable noise risks missing exactly the casing activity that precedes compromise, a pattern repeatedly highlighted in SSH honeypot research using Cowrie and related frameworks.

The observable indicators from this incident are straightforward: source IP 91.92.40.13 (VirusTotal reports multiple malicious and suspicious flags, ASN 197170 TechTies Inc., Netherlands), SSH client string SSH-2.0-Go, HASSH.

Behavior characterized by bulk hardware survey plus a RAM threshold and sudo -S privilege test. For SOC teams and honeypot operators, this pattern should be treated as a high-value signal for impending cryptomining or resource theft.

Defenders can strengthen detection by alerting on sessions that combine CPU model enumeration, targeted NVIDIA GPU discovery, /proc/meminfo checks against explicit thresholds, and non-interactive sudo password reuse features that stand out in large-scale SSH honeypot datasets and machine-learning analyses of Cowrie logs.

Even in the absence of dropped malware, these traces offer an early warning of mining-focused operators quietly grading exposed Linux and cloud hosts for future exploitation.

$1M Data Breach Warranty is Genuine Protection?: Download 10 Point Free AI SOC Breach Warranty Guide