2026 Q3 Linux SSH Server Targeted Malware Statistics Report

Honeypot monitoring in Q3 2026 revealed that attackers targeted Linux SSH servers with weak management through brute force and dictionary attacks. The primary malware families identified were ShellBot (PerlBot), a Perl-based DDoS bot with known command and control IPs, and Fisieredoor, a backdoor that executes commands and deploys SSH dictionary attack tools. Attackers downloaded malware using standard tools like wget and curl, then installed user-mode rootkits and XHide process masking tools to evade detection. XMRig cryptocurrency miners were also deployed, with mining processes disguised as legitimate bash sessions via ld.so.preload injection. Fisieredoor further deployed tools such as goauto and tsm for credential harvesting and lateral movement, sending successful authentication results back to command servers. Indicators include multiple IP addresses and file hashes associated with the malware components.

The attacks enable unauthorized access to Linux SSH servers through brute force and dictionary attacks, leading to installation of backdoors and rootkits that allow persistent control. The presence of DDoS bot capabilities (ShellBot) can facilitate distributed denial-of-service attacks. Cryptocurrency mining (XMRig) consumes system resources illicitly. Credential harvesting and lateral movement tools increase the risk of broader network compromise. The malware's use of process masking and rootkit injection complicates detection and removal.

No official patch or fix is indicated for this malware campaign. Mitigation focuses on securing SSH servers by enforcing strong authentication mechanisms (e.g., disabling password authentication in favor of keys), limiting SSH access via firewall rules, and monitoring for unusual process behavior indicative of rootkits or mining activity. Regularly updating and hardening Linux systems reduces exposure to brute force attacks. Since this is a malware campaign targeting poorly managed servers, improving SSH security posture is critical. Use threat intelligence indicators such as known malicious IPs and file hashes to detect and block infections.