SSHStalker botnet preys on legacy Linux & cloud hosts
What happened
Flare researchers have identified a previously undocumented Linux botnet, dubbed SSHStalker, that uses Internet Relay Chat (IRC) for command-and-control and targets older Linux systems still deployed in corporate and cloud environments. Flare described it as a Golang-based scanner that probes port 22 on other systems, indicating a worm-like approach to finding new targets from already compromised hosts. This matters for IT, Telecom & Cyber because contracting activity changes leverage, market appetite, and which clauses buyers can credibly trade with 22, 16, 2.6. as the clearest commercial anchors; Breach response SLAs is now more valuable
Buyer takeaway
For IT, Telecom & Cyber, the buyer read-through is commercial leverage: scope, validity windows, reopeners, and term structure may now matter as much as headline pricing
Cost / money
The money issue may come through term structure rather than base price alone, especially if suppliers push for escalation language, shorter validity, or broader pass-through
Supplier / commercial
This is primarily a contracting story: revisit scope boundaries, extension mechanics, and which party carries volatility before those assumptions harden in a live tender
Safety / operations
The main operations question is whether the contract still matches field reality. If scope, response times, or liabilities are vague, the risk usually shows up during execution
What to watch
Watch scope creep, liability pushback, and term changes that move volatility back onto the buyer even if the base rate looks manageable
Key facts
- Flare researchers have identified a previously undocumented Linux botnet, dubbed SSHStalker
- Flare described it as a Golang-based scanner that probes port 22 on other systems, indicating
- Cloud and secrets Flare recovered a file showing nearly 7,000 fresh results from an SSH scann
- It described an obfuscated Python script that generates IP addresses and runs a binary "http
Source excerpts
Legacy kernels A distinguishing feature of SSHStalker is its inventory of older Linux kernel exploits
Flare researchers have identified a previously undocumented Linux botnet, dubbed SSHStalker, that uses Internet Relay Chat (IRC) for command-and-control and targets older Linux systems still deployed in corporate and cloud environments. The group behind SSHStalker combines legacy botnet mechanics with automated scanning and deployment workflows
A scheduled task runs every minute and invokes an update script in the malware directory, redirecting output from the terminal. The update script checks for a PID file and relaunches the main process if it has stopped