Threats Tagged 'xhide'

During Q3 2026, attacks targeting poorly managed Linux SSH servers were observed, primarily using brute force and dictionary attacks. The main malware families involved were ShellBot, a Perl-based DDoS bot, and Fisieredoor, a backdoor capable of command execution and deploying SSH dictionary attack tools. Attackers used wget or curl to download malware, then installed user-mode rootkits, process masking tools (XHide), and XMRig cryptocurrency miners. The malware launcher used ld.so.preload to inject rootkits and disguised mining processes as legitimate bash sessions. Fisieredoor also deployed tools for credential harvesting and lateral movement, transmitting successful authentication data to command servers.

In the third quarter of 2026, multiple attack campaigns targeted poorly managed Linux SSH servers using brute force, dictionary attacks, and vulnerability exploits. Attackers deployed ShellBot, a Perl-based DDoS bot with port scanning and UDP flooding capabilities. A complex attack chain involved a user-mode rootkit loaded via /etc/ld.so.preload, which then deployed the XMRig cryptocurrency miner disguised as a bash process using the XHide concealment tool. Additionally, the Fisieredoor backdoor was used to execute commands and install SSH brute-force tools such as goauto and tsm-family that systematically targeted systems with credential lists. Organizations are advised to implement strong password policies, maintain regular patching schedules, and enforce access controls on externally exposed SSH infrastructure.