# Linux SSH Server Attacks Deploying ShellBot, Fisieredoor, XHide Rootkit and XMRig (AhnLab ASEC Q3 2026 Report)

> AhnLab ASEC's Q3 2026 honeypot report documents attackers brute-forcing and dictionary-attacking poorly secured Linux SSH servers, then deploying ShellBot (Perl IRC DDoS bot), the Fisieredoor backdoor, the XHide process-name-spoofing tool and the XMRig Monero miner. A launcher named x chains the XHide/XMRig payloads, and a user-mode rootkit (libSSL2.3.0.so) is loaded through /etc/ld.so.preload for persistence.

- **Published:** 2026-10-14T02:00:39Z
- **Last reviewed:** 2026-10-14T02:00:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3449
- **ID:** TL-2026-3449
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AhnLab Security Intelligence Center (ASEC) collects attack logs against poorly managed Linux SSH servers using honeypots and publishes quarterly statistics. The Q3 2026 report (published 2026-10-08) describes a campaign in which threat actors gain access through brute-force and dictionary attacks on SSH credentials, then use wget or curl to download malware from attacker-controlled hosts. The attack sequence is: credential compromise, malware download, persistence, then secondary payload execution.

Four malware families are named. ShellBot (PerlBot) is a Perl-based DDoS bot exposing functions such as @portscan, @udp and @conback; the report lists 103.157.217.38 and 128.199.127.217 as its C&C servers. Fisieredoor is a backdoor that supports command execution and deploys SSH brute-force tooling; its down_all command fetches ts.tgz, from which goauto and tsm-family tools are deployed. XHide (variant h64) is a process-name-changing tool that disguises processes as legitimate binaries such as -bash. XMRig is the Monero miner, run through a launcher chain; the report records the mining account ALIENS_root_X.

A launcher malware named x deploys XHide and XMRig through chained execution. The payloads are hosted under a hidden /.x/ directory on 13.71.2.244 (pax.txt, sys_users, x, xmrigroot.tgz) and under /.x/.sys/sys_users on 177.22.88.133:8080. Persistence relies on /etc/ld.so.preload, which is used to load the user-mode rootkit libSSL2.3.0.so into every process on the host; writing this file requires root.

Related ASEC reporting (Q2 2026 report and a case study) describes overlapping tooling used by what the case study says appear to be the same actors active since at least 2023: XHide (h32/h64) spoofing XMRig process names, ShellBot distributed as .b0t using IRC C2, and MIG LogCleaner for log manipulation. The XHide tool itself and its use with Haiduc SSH/Telnet brute-forcing and XMRig was documented publicly by Trend Micro in January 2020, so XHide is long-established tooling being reused.

The source report states no CVE, CVSS or actor attribution; severity HIGH is an analyst judgment. Defenders should treat this as commodity opportunistic activity (credential abuse leading to botnet and cryptomining) with root-level persistence risk. BeaconBeagle lookups for 13.71.2.244, 103.157.217.38 and 128.199.127.217 returned HTTP 404 (no records) at research time, so no C2 correlation could be recorded. Source detail on Fisieredoor is limited to the ASEC report; no independent public analysis was found.

## MITRE ATT&CK

- T1110.001 Brute Force: Password Guessing
- T1021.004 Remote Services: SSH
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking
- T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking
- T1014 Rootkit
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1496.001 Resource Hijacking: Compute Hijacking
- T1046 Network Service Discovery

## Sources

- [Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026](https://asec.ahnlab.com/en/95808/)
- [Statistical Report on Malware Targeting Linux SSH Servers in Q2 2026](https://asec.ahnlab.com/en/94396/)
- [Case Study: Distribution of a CoinMiner Targeting Linux SSH Servers via Malware Distribution via Network Transmission](https://asec.ahnlab.com/en/94484/)
- [Q1 2026 Malware Statistics Report for Linux SSH Servers](https://asec.ahnlab.com/en/93336/)
- [Statistics Report on Malware Targeting Linux SSH Servers in Q4 2025](https://asec.ahnlab.com/en/92004/)
- [Cryptocurrency Miner Uses Hacking Tool Haiduc and App Hider Xhide to Brute Force Machines and Servers (Trend Micro)](https://www.trendaisecurity.com/en-us/resources-insights/research/cryptocurrency-miner-uses-hacking-tool-haiduc-and-app-hider-xhide-to-brute-force-machines-and-servers)
- [Linux rootkits explained - Part 1: Dynamic linker hijacking (Wiz)](https://www.wiz.io/blog/linux-rootkits-explained-part-1-dynamic-linker-hijacking)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3449