An SSH bot was detected performing reconnaissance on a target machine by logging in with a guessable root password and collecting detailed hardware information such as OS version, CPU architecture, number of cores, CPU model, presence of NVIDIA GPU, system uptime, recent logins, and available RAM. It also tested for sudo privileges. The bot did not deploy any malware during the session but likely uses this data to decide if the host is worth infecting with a cryptomining payload later. This behavior was captured on a Cowrie SSH honeypot and is distinct from other bots that immediately deploy denial-of-service malware. The reconnaissance-only session is an early stage of a multi-step attack.

The immediate session did not cause direct harm as no payload was delivered. However, the reconnaissance enables attackers to identify valuable targets for cryptomining malware deployment. Machines with weak or default SSH passwords are vulnerable to unauthorized access and subsequent infection. If the attacker returns with a miner payload, it could lead to resource hijacking, degraded system performance, and potential further compromise.

A fix is not applicable as this is an attack technique rather than a software vulnerability. Recommended mitigations include: using strong, unique passwords to prevent unauthorized SSH access; disabling root login over SSH and using key-based authentication; implementing rate limiting on SSH login attempts (e.g., fail2ban); restricting SSH access to trusted IPs or VPNs; monitoring for unusual hardware discovery commands in SSH sessions; and watching for follow-up activity such as sustained high CPU/GPU usage or connections to mining pools. These steps prevent initial compromise and help detect reconnaissance activity early.