Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026
Contents
The AhnLab SEcurity intelligence Center (ASEC) collected attack logs targeting poorly managed Linux SSH servers through honeypots. This report compiles statistics by categorizing the attack sources identified in the third quarter of 2026, the attacks carried out from those sources, and the malware used. The report also provides a classification of the malware used in attacks.
Purpose and Scope
This report focuses on cases where scanning was followed by the actual installation of malware. The targets were Linux SSH servers accessed through brute force attacks, dictionary attacks, and certain vulnerability exploits.
Attack Cases
In the third quarter of 2026, cases were identified in which ShellBot and the backdoor malware Fisieredoor were used. After successfully logging in, the threat actors downloaded and executed ShellBot using wget or curl, and subsequently installed a user-mode rootkit, XHide, and XMRig through a downloader.
ShellBot, also known as PerlBot, is a DDoS bot developed in Perl. The identified C&C addresses were 103.157.217[.]38 And 128.199.127[.]217. Supported functions included @portscan, @udp, and @conback.
The launcher malware x uses /etc/ld.So.Preload to execute the user-mode rootkit libSSL2.3.0.So, and then runs XMRig by disguising it as -bash using XHide h64(a process name-changing tool) to disguise itself as -bash and run XMRig. The “ALIENSrootX” user was used for mining.
Fisieredoor is a backdoor classified based on the internal string Fisiere. In addition to command execution, it can install SSH brute-force attack tools; it used the down_all command to download ts.Tgz and execute goauto and tsm-family tools. Tsm read the target list from the i file and the ID/password from the p file to attempt logins; upon success, it executed uname -a and transmitted the results and authentication credentials to the C&C server.
Conclusion
Attacks targeting Linux SSH servers primarily rely on brute force attacks against vulnerable account credentials and dictionary attacks; there were also attacks exploiting vulnerabilities in unpatched systems. Users should set strong, hard-to-guess passwords and change them periodically; apply the latest patches; and implement access control for externally exposed SSH servers using firewalls or other measures. ASEC is collecting attack source addresses in real time using Linux SSH honeypots, and confirmed addresses are being provided through AhnLab TIP.
