Dropbear SSH

Dropbear SSH is SSH software observed being deployed by threat actors as a remote access backdoor and persistence mechanism. The provided content states that actors deployed Dropbear Secure Shell on victim endpoints to gain remote access over port 22, mapped to MITRE ATT&CK T1219 (Remote Access Tools). In the 2015 Ukraine Electric Power Attack, Sandworm Team installed a modified Dropbear SSH client on target systems and used it as a backdoor; the content further states Sandworm used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network. More recently, a joint U.S. government advisory published on 2026-04-07 reported Iranian-affiliated APT actors exploiting internet-facing operational technology devices in U.S. critical infrastructure sectors, including Government Services and Facilities, Water and Wastewater Systems, and Energy, and noted deployment of Dropbear SSH on victim endpoints for remote access. That activity involved targeting Rockwell Automation/Allen-Bradley PLC environments, including CompactLogix and Micro850 devices, with associated malicious traffic observed on port 22 alongside OT-related ports 44818, 2222, 102, and 502. High-confidence indicators in the advisory associated with the broader activity include IP addresses 135.136.1[.]133 and 185.82.73[.]162, 185.82.73[.]164, 185.82.73[.]165, 185.82.73[.]167, 185.82.73[.]168, 185.82.73[.]170, and 185.82.73[.]171.