New SSH Bot Profiles Linux Systems Before Deploying Crypto Miner

Key Takeaways

• A new SSH bot is actively profiling Linux systems, assessing their CPU, GPU, and RAM before deploying cryptocurrency miners.
• Unlike typical brute-force attacks, this bot performs a detailed hardware survey to identify lucrative mining targets.
• The attack chain is sophisticated, utilizing a Go-based SSH client and testing for privilege escalation.
• The bot leaves no immediate payload, making initial detection challenging as it focuses solely on reconnaissance.
• Defenders should prioritize strong SSH credentials, disable direct root access, and monitor for unusual hardware enumeration activities.

Sophisticated SSH Bot Profiles Linux Systems for Crypto Mining

A recently discovered SSH bot has been observed discreetly compromising Linux systems, meticulously inventorying their hardware specifications, including CPU, GPU, and memory, without immediately deploying any malicious payload. This behavior, while seemingly innocuous, indicates a calculated approach to cryptomining, where attackers meticulously select high-value targets.

Rather than hastily infecting systems with malware, this bot prioritizes efficiency by evaluating a compromised host’s computational power to determine its profitability for cryptocurrency mining operations. This strategic reconnaissance phase distinguishes it from more indiscriminate attacks.

Discovery and Initial Analysis

The bot’s activity first came to light through a DShield honeypot, which recorded an automated login exhibiting unusual characteristics compared to standard password-guessing attempts or simple one-line loader scripts. During a brief session, the bot logged in as the root user, executed only two commands, comprehensively profiled the host, checked for potential privilege escalation avenues, and then disconnected within seconds.

Analysts at the Internet Storm Center said in a report that this “recon-only” session was particularly noteworthy because it did not deliver any mining software. This made the reconnaissance phase the most critical aspect of the observed attack.

The report detailed that the SSH bot originated from a single IP address (91.92.40.13), authenticated successfully using a weak root password (“123123”), and identified itself with a Go-based SSH client (SSH-2.0-Go) rather than a conventional terminal. The entire interaction lasted approximately eight seconds, leaving no persistent binaries or obvious second-stage components for defenders to analyze.

This pattern aligns with an evolving trend in cyberattacks where threat actors move beyond opportunistic infections. Instead, they optimize their campaigns to maximize the return on compromised computational resources. Similar tactics have been observed in other campaigns targeting Linux servers and cloud environments for Monero mining, often exploiting weak SSH credentials or misconfigured services. For further context on related threats, readers can examine how attackers reuse weak SSH credentials to mine Monero.

SSH Bot Profiles Linux CPU, GPU, and RAM

Upon successful compromise, the bot initiates a detailed hardware survey instead of immediately deploying a miner. This script gathers critical system information, including the operating system and kernel version, CPU architecture, core count, and specific CPU model details. Each piece of data is systematically tagged (e.g., UNAME, ARCH, CPUS, CPU_MODEL, GPU, LAST).

This structured output is designed to be consumed by an automated controller, enabling the filtering of underpowered devices and the prioritization of the most profitable targets for mining. The bot also executes `lspci` to detect discrete graphics cards, specifically looking for NVIDIA GPUs that could significantly accelerate mining operations. Furthermore, it retrieves system uptime and recent login history, providing insight into the host’s stability and activity levels before committing to a resource-intensive payload.

This reconnaissance method contrasts sharply with campaigns that weaponize PAM to hide miners, which typically proceed directly to stealthy mining after initial access.

The second command executed by the bot focuses on memory and privilege. It reads `/proc/meminfo` to verify if the total RAM exceeds approximately 1 GB. Crucially, it then attempts to pipe this memory check through `sudo` using the same weak password previously used for root access. This action effectively probes whether it can elevate privileges without requiring further authentication. The combination of CPU core counting, CPU model inspection, NVIDIA GPU detection, and a minimum RAM threshold strongly suggests a cryptomining triage strategy rather than preparation for denial-of-service attacks or casual snooping.

Internet Storm Center analysts underscore that the absence of a payload in the initial session does not signify a harmless interaction. Instead, this reconnaissance-first model allows attackers to assess a host’s value and either deploy a customized miner at a later stage or delegate the target to another malicious tool if the hardware meets their criteria. This strategy mirrors other campaigns where attackers hijack Linux environments worldwide for crypto mining, typically after brute-forcing SSH credentials or exploiting exposed services

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.