Panchan's Mining Island [Guest Diary], (Wed, Oct 14th)

Panchan is a Golang-written peer-to-peer botnet worm that spreads by stealing SSH private keys after gaining access to a system and maintains persistence through a rootkit. It was first identified in 2022 and continues to propagate due to many insecure and unpatched systems. The worm uses a Discord channel for command-and-control communications, as identified through dynamic network analysis with FakeNet-NG and Wireshark. It attempts lateral movement by pivoting to hosts listed in the compromised user's SSH known_hosts file. Detection can be aided by monitoring logs for privilege escalation, software installation/removal, and SSH access patterns, preferably using SIEM tools. Typical indicators include multiple failed SSH authentications, hidden directories with high-entropy names, and processes resistant to termination. The worm is a threat primarily to internet-facing servers with weak SSH security configurations.

The Panchan worm enables unauthorized crypto mining on infected systems, potentially degrading system performance and consuming resources. It compromises SSH private keys, allowing lateral movement within networks. Persistence is maintained via a rootkit, complicating removal. The worm's activity can lead to unauthorized access and control of multiple hosts in a network, increasing the attack surface and risk of further compromise. Systems lacking proper SSH security controls and network filtering are vulnerable to infection and propagation.

Systems with proper security controls such as egress and ingress filtering, access control lists, continuous monitoring, and passwordless authentication are protected against Panchan. Specific mitigations include deploying multi-factor authentication for SSH, disabling root login, restricting SSH access via IP whitelisting or jump boxes, and using SSH key management solutions like HashiCorp Vault to issue short-lived signed certificates. Implementing Fail2Ban or similar tools to block repeated failed login attempts is recommended. Network traffic should be filtered through firewalls and monitored by intrusion detection/prevention systems. Leveraging SIEM solutions to parse logs for suspicious activities improves detection at scale. These measures collectively reduce the risk of infection and lateral movement by the worm.