Loading malware…
SSH-Snake is an open-source SSH network traversal and penetration-testing tool abused as a self-modifying, self-propagating worm on Linux systems. Released on 4 January 2024, it is implemented as a Bash script that searches compromised hosts for SSH private keys and other credentials, identifies reachable targets, and uses discovered credentials to authenticate to additional systems and replicate itself. It examines known credential locations, shell command histories, login records, and network-neighbor information to discover authentication material and lateral-movement opportunities. On its first execution, it removes comments, whitespace, and unnecessary functions to reduce its size, and its execution mechanism supports fileless propagation.
Malicious deployments collect SSH credentials, target information, and shell histories, with captured data exfiltrated to attacker-controlled infrastructure. CRYSTALRAY uses SSH-Snake for lateral movement after exploiting vulnerable internet-facing services, including Atlassian Confluence. SSH-Snake supports that actor's broader credential-theft and cryptomining operations but is not itself a cryptominer. Shedding Zmiy, a threat cluster associated with Cobalt/ExCobalt, has also used it for lateral movement in compromised Linux infrastructure.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
System logs contained commands characteristic of SSH-Snake, and investigators identified its use for lateral movement.
Released on 4 January 2024, SSH-Snake is a self-modifying worm that leverages SSH credentials discovered on a compromised system to start spreading itself throughout the network.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
"...modifies itself when it is first run... All comments, whitespace, and unnecessary functions are removed... allows it to remain fileless."
"SSH-Snake ... autonomously searches the system it is run on for SSH credentials. Once credentials are found, the script attempts to log into the target system..."
"...automatically searches through known credential locations and shell history files..." and "find_from_bash_history , where commands of ssh , scp , and rsync are searched for and parsed."
"...perform automatic network traversal... creating a comprehensive map of a network and its dependencies..." and "...it looks at sources of information, including last and arp to gather target data."
"SSH-Snake is a self-modifying worm that leverages SSH credentials discovered on a compromised system to start spreading itself throughout the network."
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.