# Self-Propagating SSH Worm with Cryptographically Signed C2

> A self-propagating SSH worm captured by a SANS DShield honeypot achieves complete botnet enrollment in under 4 seconds — from initial SSH connection to C2 check-in and lateral movement scanning. The worm propagates via SSH credential brute-forcing targeting default Raspberry Pi credentials (pi/raspberry and pi/raspberryraspberry993311), uploads a 4.7KB bash script via SCP, establishes persistence, kills competing malware, joins 6 IRC networks for command-and-control on channel #biret, and uses an embedded RSA key for cryptographically signed command verification — ensuring only the legitimate botnet operator can issue commands. After C2 enrollment, the worm installs zmap and sshpass for automated lateral movement, scanning 100,000 random IPs for SSH (port 22) and propagating the infection cycle. The attack originated from 83.135.10.12 (Versatel Deutschland, Germany) using an SSH client string 'SSH-2.0-OpenSSH_8.4p1 Raspbian-5+b1' — indicating propagation from an already-compromised Raspberry Pi. This represents the IoT botnet threat at its most efficient: 4 seconds from contact to compromise, automated worm propagation, cryptographic C2 authentication preventing hijacking, and a botnet architecture that scales exponentially with each new infection.

- **Published:** 2026-02-12T04:51:08Z
- **Last reviewed:** 2026-02-12T04:51:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0065
- **ID:** TL-2026-0065
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Four Seconds to Botnet: Self-Propagating SSH Worm with Cryptographically Signed C2

Source: SANS Internet Storm Center (ISC) Guest Diary by Johnathan Husch, captured on DShield sensor.

Attack Timeline (4-Second Full Compromise):

08:24:13 — Attacker connects from 83.135.10.12 (compromised Raspberry Pi, Versatel Deutschland ISP, Germany)
08:24:14 — SSH brute-force success with credentials: pi / raspberryraspberry993311
08:24:15 — Malware uploaded via SCP (4.7KB bash script — complete botnet lifecycle in single script)
08:24:16 — Malware executed, persistence established
08:24:17 — Attacker disconnects; worm begins C2 check-in and network scanning

Total time from connection to autonomous operation: ~4 seconds.

SSH Client Fingerprint:
- Client string: SSH-2.0-OpenSSH_8.4p1 Raspbian-5+b1
- HASSH: ae8bd7dd09970555aa4c6ed22adbbf56
- The 'Raspbian' identifier confirms propagation from a previously compromised Raspberry Pi — the worm replicates from victim to victim.

Malware Architecture (4.7KB Bash Script):

The malware is a single 4.7KB bash script that performs the complete botnet lifecycle:

1. Persistence Establishment:
- Writes itself to startup scripts for boot persistence
- Modifies system configurations to survive reboot
- Ensures automatic execution on system restart

2. Competitor Elimination:
- Kills processes of competing malware/botnets
- Modifies /etc/hosts to redirect known competitor C2 domains to 127.0.0.1 (loopback)
- Specifically targets cryptocurrency miners from competing botnets
- This 'botnet turf war' behavior ensures exclusive control of the compromised device

3. IRC-Based Command and Control:
- Joins 6 separate IRC networks for redundancy
- Connects to IRC channel: #biret
- C2 enrollment: opens TCP connection, registers device nickname, completes registration
- Heartbeat mechanism: C2 sends PING, bot responds PONG (liveness check)
- 6-network redundancy ensures C2 connectivity survives individual IRC network takedowns

4. Cryptographic Command Verification:
- Embedded RSA public key in the bash script
- All commands from C2 operator are digitally signed with the corresponding private key
- Bot verifies RSA signature before executing any command
- Prevents: botnet hijacking by competitors, law enforcement command injection, researcher command spoofing
- This is a significant operational security improvement over typical IRC botnets that rely on channel operator status alone

5. Lateral Movement and Worm Propagation:
- Installs zmap (high-speed network scanner) and sshpass (non-interactive SSH authentication)
- Scans 100,000 random IP addresses for port 22 (SSH)
- Attempts two credential pairs per target:
  a. pi / raspberry (default Raspberry Pi credentials)
  b. pi / raspberryraspberry993311 (variant of default)
- On successful authentication: uploads the same 4.7KB script → entire cycle repeats
- Exponential growth: each infected device scans 100,000 IPs and compromises new victims

6. Payload Capability:
- No cryptominer observed during initial capture, BUT:
- Script kills competing miner processes → designed to run operator's miner exclusively
- C2 can push any command via signed IRC messages: cryptominer, DDoS, proxy, data exfiltration
- The cryptographic signing means only the operator's commands execute — high-assurance botnet

Why This Matters — Strategic Analysis:

1. Speed: 4 seconds from first contact to autonomous bot. Faster than most network monitoring tools can generate alerts. By the time a human reviews the SSH login, the device is already scanning for new victims.

2. Scale: 100,000 IPs scanned per infected device. With exponential propagation, a single initial infection can generate thousands of bots within hours.

3. Targeting: Default Raspberry Pi credentials target the massive IoT install base. Millions of Raspberry Pis are internet-connected with default credentials — home automation, educational projects, development environments, NAS devices.

4. Resilience: 6 IRC networks for C2 redundancy + RSA-signed commands prevent hijacking. Even if 5 of 6 IRC networks are shut down, C2 continues. Even if researchers compromise the IRC channel, they cannot issue commands without the private key.

5. Simplicity: 4.7KB bash script. No compiled binaries, no zero-days, no sophisticated exploits. Just default credentials + automation = mass compromise. The most effective attacks are often the simplest.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1110 Brute Force
- T1059 Command and Scripting Interpreter
- T1037 Boot or Logon Initialization Scripts
- T1053 Scheduled Task/Job
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1568 Dynamic Resolution
- T1496 Resource Hijacking
- T1498 Network Denial of Service
- T1587 Develop Capabilities
- T1584 Compromise Infrastructure
- T1136 Create Account
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1016 System Network Configuration Discovery
- T1057 Process Discovery
- T1005 Data from Local System
- T1571 Non-Standard Port
- T1572 Protocol Tunneling
- T1489 Service Stop
- T1112 Modify Registry
- T1574 Hijack Execution Flow

## Sources

- [SANS ISC — Four Seconds to Botnet: Self-Spreading SSH Worm](https://isc.sans.edu/diary/Four+Seconds+to+Botnet/)
- [AlienVault OTX — 83.135.10.12 (Attack Source IP)](https://otx.alienvault.com/indicator/ip/83.135.10.12)
- [AlienVault OTX — bins.deutschland-zahlung.eu (C2 Domain)](https://otx.alienvault.com/indicator/hostname/bins.deutschland-zahlung.eu)
- [SANS DShield Honeypot Project](https://isc.sans.edu/tools/honeypot/)
- [Zmap — Fast Internet-wide Scanner](https://zmap.io/)
- [SANS ISC — SSH Brute Force Statistics](https://isc.sans.edu/ssh.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0065