Lesson 1.1: The Deep Dive

Lesson Focus: This lesson provides a foundational, technical dissection of the SSHStalker botnet campaign. We will analyse its attack lifecycle, understand the surprising resurgence of the IRC protocol for command and control, and evaluate the broader implications for defending modern, heterogeneous Linux environments.

Compliance Framework Mapping

The SSHStalker incident directly challenges controls mandated by major cybersecurity and operational resilience frameworks. Organisations failing to address these vectors risk non-compliance and severe operational consequences.

Content Section 1: Deconstructing the Attack Lifecycle

SSHStalker operates as a ruthlessly efficient compromise pipeline. Its tactics, mapped to the MITRE ATT&CK® framework, reveal a focus on scale and persistence over stealth.

Initial Access & Execution: The Open Door

The campaign begins with automated, internet-wide scanning for exposed SSH ports (typically TCP/22). Attackers use a custom Golang scanner designed to mimic the network pattern of the legitimate nmap tool, a technique aimed at evading simple signature-based detection. Upon discovering a live service, the botnet launches brute-force attacks (T1110.003) against weak or default credentials. This low-sophistication method remains devastatingly effective against poorly configured cloud instances, IoT devices, and legacy servers.

Once shell access is obtained, SSHStalker demonstrates a clever evasion technique: on-host compilation (T1059.004). Instead of downloading a ready-made binary that could be flagged by antivirus software, the attacker downloads C source code and uses the victim's own gcc compiler to build the malware. This ensures the payload is tailored to the host's architecture and avoids static file signatures.

Persistence & Privilege Escalation: Digging In

To maintain access, the malware employs multiple redundant methods. The most notable is the use of cron jobs (T1053.003) set to execute and restart the malicious payload approximately every minute. This ensures the bot survives reboots and rudimentary cleanup attempts. Furthermore, the malware installs rootkit-like components and log cleaners to hide its presence by tampering with system logs in /var/log/.

Gaining root privileges is achieved not through zero-days, but by exploiting ~16 legacy Linux kernel vulnerabilities from 2009-2010. These exploits target long-forgotten 2.6.x kernels still running on neglected enterprise servers, embedded appliances, or inadequately maintained systems. This tactic highlights a critical threat vector: the "security debt" of unpatched, end-of-life software in operational environments.

Propagation: Becoming the Threat

SSHStalker exhibits worm-like characteristics. A newly infected host doesn't just sit idle; it downloads the scanner and attack toolkit and begins probing the internet for new victims (T1210). This lateral movement and self-propagation mechanism allow the botnet to grow exponentially from a single initial point of failure, turning every compromised asset into a weapon against others.

Content Section 2: The Anomaly - IRC as a Modern C2 Channel

The most distinctive feature of SSHStalker is its use of Internet Relay Chat (IRC) for command and control (C2) (T1071.004). In an age of encrypted DNS tunnels and HTTPS-based C2, this choice seems anachronistic but is strategically shrewd.

Why IRC? Advantages for the Adversary

• Blending with Legitimate Traffic: Public IRC networks carry vast amounts of benign chat traffic. Botnet C2 channels can blend in, making them harder to distinguish from legitimate activity compared to a dedicated domain communicating with thousands of servers.
• Simplicity & Reliability: The IRC protocol is lightweight, well-understood, and supported on virtually any system. It provides a stable, low-overhead channel for issuing commands to large groups of bots simultaneously.
• Redundancy: Analyses indicate SSHStalker uses multiple IRC channels across different servers. If one channel is taken down, bots can reconnect to another, ensuring resilience in the C2 infrastructure.
• Low Attribution: Using public IRC networks requires no domain registration or infrastructure setup that can be easily traced back to the attackers.

The Dormant Threat

Intriguingly, researchers observed that once bots joined the designated IRC channels, they received no immediate follow-on commands for activities like DDoS or cryptomining. This suggests SSHStalker may be operating as a "botnet for hire" or a persistent access platform. The compromised hosts are maintained in a ready state, creating a digital army that can be weaponised at a moment's notice for a variety of purposes, sold to other threat actors, or used for intelligence gathering.

Source_IP: 10.0.5.12 -> Dest_IP: 94.23.29.111:6667 Protocol: TCP Bytes_Sent: 120
Source_IP: 10.0.5.12 -> Dest_IP: 94.23.29.111:6667 Protocol: TCP Bytes_Sent: 45 (Payload: "NICK Bot_ZXT12")
Source_IP: 10.0.5.12 -> Dest_IP: 94.23.29.111:6667 Protocol: TCP Bytes_Sent: 52 (Payload: "USER guest 0 * :realname")
Source_IP: 10.0.5.12 -> Dest_IP: 94.23.29.111:6667 Protocol: TCP Bytes_Sent: 38 (Payload: "JOIN #updates-ch")
Source_IP: 10.0.5.12 -> Dest_IP: 151.80.119.49:443 Protocol: TCP Bytes_Sent: 1500 (Encrypted HTTPS)
Source_IP: 10.0.5.12 -> Dest_IP: 185.163.45.21:6669 Protocol: TCP Bytes_Sent: 115