Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026

This report details multiple coordinated malware campaigns targeting Linux SSH servers during Q3 2026. Attackers employed brute force and dictionary attacks alongside exploitation of vulnerabilities to compromise poorly managed SSH servers. The ShellBot Perl-based DDoS botnet was used, leveraging command and control servers to conduct port scanning and UDP flooding. A sophisticated attack chain included a launcher malware that installed a user-mode rootkit (libSSL2.3.0.So) via the /etc/ld.so.preload mechanism, which then deployed the XMRig cryptocurrency miner disguised as a '-bash' process using the XHide tool for process concealment. The Fisieredoor backdoor was also deployed, enabling command execution and installation of SSH brute-force tools (goauto and tsm-family) that used credential lists to systematically target additional systems. The campaigns demonstrate multi-stage infection with capabilities for DDoS, cryptomining, and persistent backdoor access.

The attacks enable threat actors to gain unauthorized access to Linux SSH servers, deploy DDoS botnets, mine cryptocurrency using victim resources, and maintain persistent backdoor access. This can lead to resource exhaustion, degraded service availability, unauthorized command execution, and further compromise of networked systems. The use of rootkits and process concealment tools complicates detection and remediation efforts.

No official patch or fix is specified for these malware campaigns. Organizations should focus on implementing strong password policies to prevent brute force attacks, regularly apply security patches to Linux systems and SSH services, and restrict access to SSH servers through network-level controls such as firewalls and VPNs. Monitoring for unusual process behavior and unauthorized modifications to /etc/ld.so.preload can help detect infection. Immediate remediation involves removing the malware components and changing compromised credentials.