Self-Propagating SSH Worm with Cryptographically Signed C2
Self-Propagating SSH Worm with Cryptographically Signed C2 (TL-2026-0065) is a high-severity malware campaign, first published 2026-02-12. It has no confirmed attribution, maps to 30 MITRE ATT&CK techniques (T1005, T1016, T1018), and is covered by 9 detection rules and 34 indicators of compromise.
Key facts for TL-2026-0065
- Threat ID
- TL-2026-0065
- Severity
- HIGH
- Status
- MONITORING
- Category
- MALWARE
- First published
- 2026-02-12
- Last reviewed
- 2026-02-12
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- IoT Devices, Home Users, Education, Small Business, Hobbyist/Maker
- Target regions
- Global — indiscriminate scanning of random IPs
- Detection rules
- 9
- Indicators of compromise
- 34
Malware and tooling in Self-Propagating SSH Worm with Cryptographically Signed C2
Malware and tooling: apt-get install zmap sshpass — lateral movement toolkit installation post-compromise
A self-propagating SSH worm captured by a SANS DShield honeypot achieves complete botnet enrollment in under 4 seconds — from initial SSH connection to C2 check-in and lateral movement scanning. The worm propagates via SSH credential brute-forcing targeting default Raspberry Pi credentials (pi/raspberry and pi/raspberryraspberry993311), uploads a 4.7KB bash script via SCP, establishes persistence, kills competing malware, joins 6 IRC networks for command-and-control on channel #biret, and uses an embedded RSA key for cryptographically signed command verification — ensuring only the legitimate botnet operator can issue commands. After C2 enrollment, the worm installs zmap and sshpass for automated lateral movement, scanning 100,000 random IPs for SSH (port 22) and propagating the infection cycle. The attack originated from 83.135.10.12 (Versatel Deutschland, Germany) using an SSH client string 'SSH-2.0-OpenSSH_8.4p1 Raspbian-5+b1' — indicating propagation from an already-compromised Raspberry Pi. This represents the IoT botnet threat at its most efficient: 4 seconds from contact to compromise, automated worm propagation, cryptographic C2 authentication preventing hijacking, and a botnet architecture that scales exponentially with each new infection.
How Self-Propagating SSH Worm with Cryptographically Signed C2 works
Four Seconds to Botnet: Self-Propagating SSH Worm with Cryptographically Signed C2
Source: SANS Internet Storm Center (ISC) Guest Diary by Johnathan Husch, captured on DShield sensor.
Attack Timeline (4-Second Full Compromise):
08:24:13 — Attacker connects from 83.135.10.12 (compromised Raspberry Pi, Versatel Deutschland ISP, Germany) 08:24:14 — SSH brute-force success with credentials: pi / raspberryraspberry993311 08:24:15 — Malware uploaded via SCP (4.7KB bash script — complete botnet lifecycle in single script) 08:24:16 — Malware executed, persistence established 08:24:17 — Attacker disconnects; worm begins C2 check-in and network scanning
Total time from connection to autonomous operation: ~4 seconds.
SSH Client Fingerprint: - Client string: SSH-2.0-OpenSSH_8.4p1 Raspbian-5+b1 - HASSH: ae8bd7dd09970555aa4c6ed22adbbf56 - The 'Raspbian' identifier confirms propagation from a previously compromised Raspberry Pi — the worm replicates from victim to victim.
Malware Architecture (4.7KB Bash Script):
The malware is a single 4.7KB bash script that performs the complete botnet lifecycle:
1. Persistence Establishment: - Writes itself to startup scripts for boot persistence - Modifies system configurations to survive reboot - Ensures automatic execution on system restart
2. Competitor Elimination: - Kills processes of competing malware/botnets - Modifies /etc/hosts to redirect known competitor C2 domains to 127.0.0.1 (loopback) - Specifically targets cryptocurrency miners from competing botnets - This 'botnet turf war' behavior ensures exclusive control of the compromised device
3. IRC-Based Command and Control: - Joins 6 separate IRC networks for redundancy - Connects to IRC channel: #biret - C2 enrollment: opens TCP connection, registers device nickname, completes registration - Heartbeat mechanism: C2 sends PING, bot responds PONG (liveness check) - 6-network redundancy ensures C2 connectivity survives individual IRC network takedowns
4. Cryptographic Command Verification: - Embedded RSA public key in the bash script - All commands from C2 operator are digitally signed with the corresponding private key - Bot verifies RSA signature before executing any command - Prevents: botnet hijacking by competitors, law enforcement command injection, researcher command spoofing - This is a significant operational security improvement over typical IRC botnets that rely on channel operator status alone
5. Lateral Movement and Worm Propagation: - Installs zmap (high-speed network scanner) and sshpass (non-interactive SSH authentication) - Scans 100,000 random IP addresses for port 22 (SSH) - Attempts two credential pairs per target: a. pi / raspberry (default Raspberry Pi credentials) b. pi / raspberryraspberry993311 (variant of default) - On successful authentication: uploads the same 4.7KB script → entire cycle repeats - Exponential growth: each infected device scans 100,000 IPs and compromises new victims
6. Payload Capability: - No cryptominer observed during initial capture, BUT: - Script kills competing miner processes → designed to run operator's miner exclusively - C2 can push any command via signed IRC messages: cryptominer, DDoS, proxy, data exfiltration - The cryptographic signing means only the operator's commands execute — high-assurance botnet
Why This Matters — Strategic Analysis:
1. Speed: 4 seconds from first contact to autonomous bot. Faster than most network monitoring tools can generate alerts. By the time a human reviews the SSH login, the device is already scanning for new victims.
2. Scale: 100,000 IPs scanned per infected device. With exponential propagation, a single initial infection can generate thousands of bots within hours.
3. Targeting: Default Raspberry Pi credentials target the massive IoT install base. Millions of Raspberry Pis are internet-connected with default credentials — home automation, educational projects, development environments, NAS devices.
4. Resilience: 6 IRC networks for C2 redundancy + RSA-signed commands prevent hijacking. Even if 5 of 6 IRC networks are shut down, C2 continues. Even if researchers compromise the IRC channel, they cannot issue commands without the private key.
5. Simplicity: 4.7KB bash script. No compiled binaries, no zero-days, no sophisticated exploits. Just default credentials + automation = mass compromise. The most effective attacks are often the simplest.
MITRE ATT&CK techniques used in TL-2026-0065
collection
discovery
T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1046 Network Service Discovery; T1057 Process Discovery
lateral-movement
T1021 Remote Services; T1570 Lateral Tool Transfer
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1078 Valid Accounts
persistence
T1037 Boot or Logon Initialization Scripts; T1133 External Remote Services; T1136 Create Account
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter
command-and-control
T1071 Application Layer Protocol; T1568 Dynamic Resolution; T1571 Non-Standard Port; T1572 Protocol Tunneling; T1573 Encrypted Channel
credential-access
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
impact
T1489 Service Stop; T1496 Resource Hijacking; T1498 Network Denial of Service
stealth
resource-development
Remediation for Self-Propagating SSH Worm with Cryptographically Signed C2
Patches
- Raspberry Pi OS: update to latest version and run raspi-config to remove default pi user
- OpenSSH: update to latest version for security fixes, though the vulnerability is credentials not software
Immediate actions
- Disable SSH password authentication on all internet-facing Linux devices: set PasswordAuthentication no in /etc/ssh/sshd_config and restart sshd
- Change or remove the default 'pi' user on all Raspberry Pi devices — the default credentials are the primary attack vector
- Deploy fail2ban or similar SSH brute-force protection: ban IPs after 3 failed attempts for 1 hour minimum
- Check for indicators: search for IRC connections to channel #biret, check for zmap/sshpass installation, verify /etc/hosts for competitor C2 domain redirections
- Network scan for exposed SSH (port 22) on all network segments — identify and remediate all internet-exposed SSH services with weak credentials
Workarounds
- Firewall SSH access: restrict port 22 to known management IPs only — block all other inbound SSH
- Rate-limit SSH connections: iptables rule limiting new SSH connections to 3/minute per source IP
- Monitor /etc/hosts for unauthorized modifications (competitor C2 domain redirection is a worm indicator)
- Deploy SSH connection monitoring: alert on SSH sessions from unexpected source IPs or with the HASSH ae8bd7dd09970555aa4c6ed22adbbf56
Longer-term hardening
- Enforce SSH key-based authentication as organizational policy — no exceptions for IoT devices
- Implement network segmentation: IoT devices on isolated VLAN with no internet-facing SSH
- Deploy SSH honeypots (DShield sensors) to detect scanning and brute-force activity targeting your network
- Monitor for zmap and sshpass installation on any system — these tools indicate worm propagation capability
- Implement automated credential rotation and compliance checking for all SSH-accessible devices
- Deploy outbound firewall rules blocking IRC traffic (ports 6667, 6697, 7000) from IoT/server VLANs
Weaknesses (CWE) in Self-Propagating SSH Worm with Cryptographically Signed C2
CWE-521, CWE-798, CWE-307, CWE-287
Timeline of Self-Propagating SSH Worm with Cryptographically Signed C2
- Raspberry Pi devices ship with default credentials (pi/raspberry) and SSH enabled. Millions of devices deployed globally for education, home automation, development, and IoT projects. Default credentials become one of the most consistently exploited attack surfaces on the internet. The default 'pi' user with known password creates a predictable, scalable attack vector.
- Raspberry Pi OS (Bullseye) removes default pi user — new installations require user account creation during setup. However, millions of existing devices retain the default pi user. Legacy devices and users upgrading from older OS versions are not automatically remediated. The installed base of vulnerable devices remains massive.
- IoT botnets remain one of the most persistent cyber threats. Mirai variants, Mozi, and custom SSH worms continue to recruit IoT devices via default/weak credentials. Estimated 10+ billion IoT devices online globally, many with weak or default credentials. SSH brute-forcing remains a top-3 attack vector across all SANS ISC sensor networks.
- Lateral movement capabilities: zmap installed for high-speed scanning (100,000 random IPs per infected host), sshpass for non-interactive SSH authentication. Two credential pairs: pi/raspberry and pi/raspberryraspberry993311. Each infected device becomes a scanning node — exponential growth model. Competitor malware killed and C2 domains redirected to loopback.
- C2 architecture analyzed: 6 IRC networks for redundancy, channel #biret, RSA-signed command verification. Embedded RSA public key ensures only operator can issue commands — prevents botnet hijacking by competitors or researchers. PING/PONG heartbeat for liveness. C2 domain bins.deutschland-zahlung.eu identified and reported to AlienVault OTX.
- SANS DShield sensor captures complete attack sequence of self-propagating SSH worm. 4-second compromise timeline: connect → brute-force → upload → execute → autonomous. Source IP: 83.135.10.12 (Versatel Deutschland, Germany). SSH client: OpenSSH_8.4p1 Raspbian-5+b1 (compromised Pi propagating). Published by Johnathan Husch, SANS.edu BACS intern. Source: SANS ISC Diary.
- Threadlinqs analysis: This worm represents the IoT botnet threat at peak efficiency — 4 seconds from contact to autonomous bot, no exploits needed (just default credentials), cryptographic C2 prevents hijacking, and exponential propagation via zmap scanning. The simplest attacks are the most effective: a 4.7KB bash script + default credentials = mass compromise. Defense is equally simple: SSH key-based auth + fail2ban + remove default users. The problem is not technical — it's operational: millions of devices exist with default credentials because their owners never hardened them. Detection must focus on the indicators: IRC traffic from IoT devices, zmap/sshpass installation, /etc/hosts modifications, and SSH connections with the specific HASSH fingerprint.
- As of 2026-05-29, no public reporting confirms a takedown of this self-propagating SSH worm or its #biret IRC C2, and SSH brute-force cryptomining/IoT worms remain a persistently active class with no CVE to patch. Absent evidence of disruption or a successor, it is retained as a live concern under MONITORING (low external corroboration).
Sources cited for Self-Propagating SSH Worm with Cryptographically Signed C2
Threats related to Self-Propagating SSH Worm with Cryptographically Signed C2
Detection coverage for TL-2026-0065
As of 2026-02-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0065 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.