SSHStalker: Old‑School IRC Meets Modern Botnet Operations

A newly documented Linux botnet named SSHStalker is making waves in the cybersecurity community—not because of cutting‑edge innovation, but because it’s reviving IRC (Internet Relay Chat), a protocol from the late 1980s, as its command‑and‑control (C2) backbone.

How SSHStalker Works

Researchers at Flare describe SSHStalker as a scale‑first botnet kit that prioritizes reliability and reach over stealth. Its tactics include:

Automated SSH scanning & brute forcing → Initial access via a Go binary disguised as nmap.
Worm‑like propagation → Compromised hosts scan for new SSH targets.
Payload compilation on victims → Downloads GCC to compile binaries locally for portability.
IRC enrollment → C‑based bots with hard‑coded servers/channels join the botnet’s IRC infrastructure.
Persistence → Cron jobs run every 60 seconds to relaunch the bot if terminated.

Exploits & Capabilities

Exploits for 16 CVEs dating back to 2009–2010 Linux kernel versions.
Privilege escalation after brute‑force access.
AWS key harvesting and website scanning.
Cryptomining kits like PhoenixMiner.
DDoS potential (though not yet observed).

Scale & Targets

Nearly 7,000 bot scans recorded in January alone.
Focused on cloud hosting providers, particularly Oracle Cloud infrastructure.
Indicators suggest ties to the Outlaw/Maxlas botnet ecosystem and Romanian threat actors.

Defensive Recommendations

Security teams should watch for:

Compiler installation/execution on production servers.
IRC‑style outbound connections.
Cron jobs with short cycles from unusual paths.

Mitigation steps include:

Disable SSH password authentication.
Remove compilers from production images.
Enforce egress filtering.
Restrict execution from /dev/shm.

Final Thought

SSHStalker shows that cybercriminals don’t always need bleeding‑edge tools—sometimes old‑school methods scaled aggressively are enough to build resilient botnets. For defenders, the lesson is clear: vigilance isn’t just about the latest exploits, but also about legacy tactics repurposed for modern attacks.