Threat reportMalwareTL-2026-3449
Linux SSH Server Attacks Deploying ShellBot, Fisieredoor, XHide Rootkit and XMRig (AhnLab ASEC Q3 2026 Report)
Linux SSH Server Attacks Deploying ShellBot, Fisieredoor (TL-2026-3449), also tracked as PerlBot, is a high-severity malware campaign, first published 2026-10-14. It has no confirmed attribution, affects Various Linux servers with internet-exposed SSH using weak or, maps to 8 MITRE ATT&CK techniques (T1014, T1021.004, T1036.005), and is covered by 9 detection rules and 25 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 25Indicators of compromise
Key facts for TL-2026-3449
- Threat ID
- TL-2026-3449
- Also known as
- PerlBot, ShellBot .b0t
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, hosting, general
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in Linux SSH Server Attacks Deploying ShellBot, Fisieredoor
Malware and tooling: Coinminer, Fisieredoor, PerlBot, XHide, xmrig, goauto, tsm
How Linux SSH Server Attacks Deploying ShellBot, Fisieredoor works
AhnLab ASEC's Q3 2026 honeypot report documents attackers brute-forcing and dictionary-attacking poorly secured Linux SSH servers, then deploying ShellBot (Perl IRC DDoS bot), the Fisieredoor backdoor, the XHide process-name-spoofing tool and the XMRig Monero miner. A launcher named x chains the XHide/XMRig payloads, and a user-mode rootkit (libSSL2.3.0.so) is loaded through /etc/ld.so.preload for persistence.
AhnLab Security Intelligence Center (ASEC) collects attack logs against poorly managed Linux SSH servers using honeypots and publishes quarterly statistics. The Q3 2026 report (published 2026-10-08) describes a campaign in which threat actors gain access through brute-force and dictionary attacks on SSH credentials, then use wget or curl to download malware from attacker-controlled hosts. The attack sequence is: credential compromise, malware download, persistence, then secondary payload execution.
Four malware families are named. ShellBot (PerlBot) is a Perl-based DDoS bot exposing functions such as @portscan, @udp and @conback; the report lists 103.157.217.38 and 128.199.127.217 as its C&C servers. Fisieredoor is a backdoor that supports command execution and deploys SSH brute-force tooling; its down_all command fetches ts.tgz, from which goauto and tsm-family tools are deployed. XHide (variant h64) is a process-name-changing tool that disguises processes as legitimate binaries such as -bash. XMRig is the Monero miner, run through a launcher chain; the report records the mining account ALIENS_root_X.
A launcher malware named x deploys XHide and XMRig through chained execution. The payloads are hosted under a hidden /.x/ directory on 13.71.2.244 (pax.txt, sys_users, x, xmrigroot.tgz) and under /.x/.sys/sys_users on 177.22.88.133:8080. Persistence relies on /etc/ld.so.preload, which is used to load the user-mode rootkit libSSL2.3.0.so into every process on the host; writing this file requires root.
Related ASEC reporting (Q2 2026 report and a case study) describes overlapping tooling used by what the case study says appear to be the same actors active since at least 2023: XHide (h32/h64) spoofing XMRig process names, ShellBot distributed as .b0t using IRC C2, and MIG LogCleaner for log manipulation. The XHide tool itself and its use with Haiduc SSH/Telnet brute-forcing and XMRig was documented publicly by Trend Micro in January 2020, so XHide is long-established tooling being reused.
The source report states no CVE, CVSS or actor attribution; severity HIGH is an analyst judgment. Defenders should treat this as commodity opportunistic activity (credential abuse leading to botnet and cryptomining) with root-level persistence risk. BeaconBeagle lookups for 13.71.2.244, 103.157.217.38 and 128.199.127.217 returned HTTP 404 (no records) at research time, so no C2 correlation could be recorded. Source detail on Fisieredoor is limited to the ASEC report; no independent public analysis was found.
MITRE ATT&CK techniques used in TL-2026-3449
Defense Evasion
T1014 Rootkit; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking
Lateral Movement
T1021.004 Remote Services: SSH
Discovery
T1046 Network Service Discovery
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell
Credential Access
T1110.001 Brute Force: Password Guessing
Impact
T1496.001 Resource Hijacking: Compute Hijacking
stealth
Affected products and versions in Linux SSH Server Attacks Deploying ShellBot, Fisieredoor
- Various — Linux servers with internet-exposed SSH using weak or guessable credentials
Vulnerable versions: Any configuration permitting weak password authentication
Remediation for Linux SSH Server Attacks Deploying ShellBot, Fisieredoor
Patches
- No CVE involved; keep OS and SSH server packages current per vendor guidance
Immediate actions
- Block the listed C&C, payload-host IPs and URLs at the perimeter and in proxy/DNS controls
- Inspect /etc/ld.so.preload on all Linux servers; any entry such as libSSL2.3.0.so that is not expected should be treated as compromise
- Hunt for processes with argv[0] spoofed as -bash or kernel-thread-like names and for outbound mining-pool or IRC connections
- Rotate SSH credentials on any host with exposed SSH and review auth logs for brute-force success
Workarounds
- Disable root login over SSH and disable password authentication where feasible
- Reinstall the OS on a confirmed infected host, since a user-mode rootkit can hide files and processes
Longer-term hardening
- Enforce strong unique passwords or disable password authentication in favor of SSH keys
- Restrict external SSH access with firewall allowlists or a VPN/bastion
- Deploy EDR or file-integrity monitoring covering /etc/ld.so.preload and writable hidden directories
- Rate-limit and alert on repeated SSH authentication failures (fail2ban or equivalent)
Weaknesses (CWE) in Linux SSH Server Attacks Deploying ShellBot, Fisieredoor
Timeline of Linux SSH Server Attacks Deploying ShellBot, Fisieredoor
- Trend Micro publishes analysis of a cryptominer using the Haiduc SSH/Telnet brute-forcer and the XHide tool that renames mining processes to -bash
- ASEC publishes its Q3 2025 statistics report on malware targeting Linux SSH servers
- ASEC publishes its Q4 2025 statistics report on Linux SSH server malware from honeypot attack logs
- ASEC Q1 2026 report: P2PInfect dominates attacks; DDoS bots and miners including Mirai, XMRig, Prometei also observed
- ASEC Q2 2026 report documents XMRig installation, ShellBot (.b0t), MIG LogCleaner, Go propagation malware and XHide against SSH servers
- ASEC publishes Q3 2026 report naming ShellBot, Fisieredoor, XHide and XMRig, with /etc/ld.so.preload persistence via libSSL2.3.0.so and 5 hashes, 5 IPs and 5 URLs as IOCs
Sources cited for Linux SSH Server Attacks Deploying ShellBot, Fisieredoor
- Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026
- Statistical Report on Malware Targeting Linux SSH Servers in Q2 2026
- Case Study: Distribution of a CoinMiner Targeting Linux SSH Servers via Malware Distribution via Network Transmission
- Q1 2026 Malware Statistics Report for Linux SSH Servers
- Statistics Report on Malware Targeting Linux SSH Servers in Q4 2025
- Cryptocurrency Miner Uses Hacking Tool Haiduc and App Hider Xhide to Brute Force Machines and Servers (Trend Micro)
- Linux rootkits explained - Part 1: Dynamic linker hijacking (Wiz)
Detection coverage for TL-2026-3449
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3449 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.