Malware

Panchan

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Credential Access

3 techniques

T1110Brute ForceEvidence2

Instead of just using brute force or dictionary attacks on randomized IP addresses like most botnets do

T1110.001Password GuessingEvidence1

Instead of just using brute force or dictionary attacks on randomized IP addresses like most botnets do

T1649Steal or Forge Authentication CertificatesEvidence1

the malware also reads the id_rsa and known_hosts files to harvest existing credentials and use them to move laterally across the network.

Lateral Movement

1 technique

T1021.004SSHEvidence1

FritzFrog is a mining P2P family which relies on SSH services to build P2P networks.

Command and Control

1 technique

T1095Non-Application Layer ProtocolEvidence1

Origins P2P networks are more scalable and robust than traditional C/S structures, and these advantages were recognized by the botnet authors early on and used in their botnets.

Impact

1 technique

T1496Resource HijackingEvidence1

Mozi started out as a P2P family performing DDoS attacks for profits, and later added a mining component.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

netlab 360News

Nov 3, 2022

P2P Botnets: Review - Status - Continuous Monitoring

A Go-based mining P2P botnet that spreads via weak SSH passwords and includes an interactive console for node query and management.

akamai sitr blogNews

Jun 15, 2022

Akamai Blog | Panchan’s Mining Rig: New Golang Peer-to-Peer Botnet Says “Hi!”

A Golang-based peer-to-peer cryptomining botnet with worm-like lateral movement. It includes a signed 'godmode' admin panel for managing mining configuration and spreads by harvesting SSH keys from id_rsa and known_hosts files to move laterally across networks.

picus security blogNews

Jan 23, 2026

Linux P2P botnet/SSH worm referenced for lateral movement by harvesting SSH credentials from id_rsa and known_hosts rather than relying only on brute force.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Panchan

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Credential Access

3 techniques

T1110Brute ForceEvidence2

Instead of just using brute force or dictionary attacks on randomized IP addresses like most botnets do

T1110.001Password GuessingEvidence1

Instead of just using brute force or dictionary attacks on randomized IP addresses like most botnets do

T1649Steal or Forge Authentication CertificatesEvidence1

the malware also reads the id_rsa and known_hosts files to harvest existing credentials and use them to move laterally across the network.

Lateral Movement

1 technique

T1021.004SSHEvidence1

FritzFrog is a mining P2P family which relies on SSH services to build P2P networks.

Command and Control

1 technique

T1095Non-Application Layer ProtocolEvidence1

Origins P2P networks are more scalable and robust than traditional C/S structures, and these advantages were recognized by the botnet authors early on and used in their botnets.

Impact

1 technique

T1496Resource HijackingEvidence1

Mozi started out as a P2P family performing DDoS attacks for profits, and later added a mining component.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

netlab 360News

Nov 3, 2022

P2P Botnets: Review - Status - Continuous Monitoring

A Go-based mining P2P botnet that spreads via weak SSH passwords and includes an interactive console for node query and management.

akamai sitr blogNews

Jun 15, 2022

Akamai Blog | Panchan’s Mining Rig: New Golang Peer-to-Peer Botnet Says “Hi!”

picus security blogNews

Jan 23, 2026

Linux P2P botnet/SSH worm referenced for lateral movement by harvesting SSH credentials from id_rsa and known_hosts rather than relying only on brute force.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.