RUBYCARP

RUBYCARP is a financially motivated threat actor assessed to originate from Romania and active for more than a decade. The group is known for building botnets by exploiting public vulnerabilities and conducting brute-force attacks, particularly against exposed Linux SSH services. RUBYCARP has been associated with operations involving coin-mining malware, DDoS tooling, and phishing activity. A notable malware family linked to the group is ShellBot, also known as PerlBot or PerBot, a Perl-based bot that uses IRC for command and control. ShellBot is used not only for distributed denial-of-service activity but also for broader post-compromise operations, including scanning and other attacker-controlled functions. Observed variants include a more feature-rich build known as "LiGhT’s Modded perlbot v2" and a simpler variant; both have been tied to ongoing deployment activity attributed to RUBYCARP. Operationally, RUBYCARP has been observed scanning for systems with SSH exposed and attempting dictionary or brute-force authentication attacks using common credentials. After successful access, the actor installs ShellBot to maintain control and enable follow-on actions. Reported ShellBot capabilities associated with this activity include DDoS functions, scanning, reverse shell functionality, proxy-related features, log cleaning, and other post-exploitation utilities. Overall, RUBYCARP is best characterized as a long-running botnet-building and monetization-focused threat actor targeting internet-exposed Linux systems.