SSHcmd
SSHcmd is a custom post-exploitation tool used in campaigns attributed to the China-linked threat cluster “Silver Dragon,” assessed by Check Point as operating under the broader APT41 umbrella. It is described as a .NET-based command-line utility that acts as a wrapper for SSH (noted to use the Renci.SshNet library) to facilitate remote access and operator control.
Capabilities explicitly described include remote command execution over SSH, file transfer (upload/download) over SSH, and support for interactive TTY sessions; it can also handle Base64-encoded commands. Reporting characterizes SSHcmd as supporting remote access and lateral movement in compromised environments.
In the referenced Silver Dragon intrusions (targeting government and public-sector/high-profile organizations in Southeast Asia and Europe since at least mid-2024), SSHcmd appears as part of a broader toolset alongside the GearDoor backdoor (Google Drive–based C2) and SilverScreen (screenshot capture), and is deployed after initial access obtained via exploitation of public-facing servers and/or phishing with malicious attachments.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Recent operations used the GearDoor backdoor with SSHcmd and SilverScreen, enabling remote access, covert screen capture, and stealthy control...
Recent operations used the GearDoor backdoor with SSHcmd and SilverScreen, enabling remote access, covert screen capture, and stealthy control...
"...deployed two additional custom tools: SSHcmd, a command-line utility that functions as a wrapper for SSH to facilitate remote access..."
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques"the group breaks into networks by exploiting public-facing internet servers"
"using phishing emails... to infiltrate government networks" and "gains initial access... sending phishing emails with malicious attachments."
"using phishing emails, malicious Windows shortcut files... In one phishing campaign, attackers sent LNK files that triggered PowerShell commands".
Execution
2 techniquesLateral Movement
1 technique“...deployed… SSHcmd… a wrapper for SSH to facilitate remote access…”
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Tool used in conjunction with a backdoor to facilitate remote access/control over compromised systems.
A custom SSH wrapper utility used to facilitate remote access in the Silver Dragon intrusion set.
Remote command execution utility used to run commands on victim systems, enabling operator control and post-compromise activity.
A custom post-exploitation tool used to execute commands remotely (as described, via SSH-style remote command execution).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.