Loading story…
Researchers documented Linux/SSHDoor.A, a trojanized OpenSSH daemon that steals usernames and passwords from compromised Linux servers while giving attackers covert persistent access. The malware exfiltrates server and credential data over HTTP after encrypting it with an embedded 1024-bit RSA key and Base64-encoding the result, and it can preserve access through a hardcoded password or bundled SSH key, with override options read from /var/run/.options. ESET linked the activity to infrastructure including openssh.info and linuxrepository.org, which at the time resolved to 82.221.99.69, and a later sample shared publicly was detected by multiple antivirus engines as an SSH backdoor.
The SSH backdoor was also observed alongside Linux/Chapro.A, a malicious Apache module used to inject iframes into web traffic, delivering a Java exploit for CVE-2012-1723 and ultimately a Zeus/Zbot payload to Windows victims. In later research, ESET expanded the picture beyond SSHDoor, identifying 21 undocumented or underdocumented Linux malware families built from trojanized OpenSSH binaries; 18 stole credentials and 17 provided stealth backdoor access. The findings showed that OpenSSH backdoors remained an active and diverse threat on Linux servers, ranging from simple credential theft to more advanced families using encrypted HTTP, raw TCP, or DNS for command and control.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
ESET released "The Dark Side of the ForSSHe," a white paper covering 21 previously undocumented or underdocumented Linux malware families built from trojanized OpenSSH binaries. The research drew on more than three years of sample hunting and honeypot collection and found that most families stole credentials and many also provided stealthy persistent access.
ESET reported that the command-and-control domain for the Kessel OpenSSH backdoor family was registered in August 2018. The registration suggested Kessel was a relatively new family at the time of ESET's publication.
ESET published technical analysis of Linux/SSHDoor.A, describing it as a trojanized SSH daemon that steals usernames and passwords and provides covert remote access. The report also linked it with Linux/Chapro.A and identified exfiltration hostnames openssh.info and linuxrepository.org.
ESET stated that the Kamino OpenSSH backdoor was first used in a crimeware campaign involving DarkLeech traffic redirection. This established an early known use of Kamino before later reporting tied it to other operations.
The Windows Zeus/Zbot payload delivered through the Linux/Chapro.A infection chain was listed on VirusTotal with a detection ratio of 32/44. This reflected the final stage of the cross-platform campaign from compromised Linux servers to Windows victims.
A malicious Apache module identified as Linux/Chapro.A was listed on VirusTotal with a detection ratio of 19/46. The malware was used to inject malicious iframe content into Apache-served web traffic.
A ZIP archive used in the Linux/Chapro.A delivery chain, exploiting CVE-2012-1723 in Java, was listed on VirusTotal with a detection ratio of 2/43. The sample was identified as part of a multi-stage campaign that ultimately delivered Zeus/Zbot malware.
A Linux SSHDoor ELF sample with MD5 90dc9de5f93b8cc2d70a1be37acea23a was scanned on VirusTotal, where 22 of 46 engines detected it as SSHDoor or a Linux SSH backdoor. The sample matched the malware family previously described by ESET as Linux/SSHDoor.A.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourcecontagiodump.blogspot.com
Open sourcewelivesecurity.com
Open sourcecontagiodump.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **Symbiote**, a Linux malware family built as a 64-bit ELF shared object that loads into running processes and uses extensive function hooking to evade detection. The malware intercepts multiple `libc`, PAM, and `libpcap` functions to hide files, processes, and TCP connections, while also filtering `/proc` network data to conceal selected ports and checking process names to suppress visibility of malware-related activity. BlackBerry described the threat as a nearly impossible-to-detect Linux implant because it operates parasitically inside other processes rather than as a standalone executable. Analysis of an early Symbiote sample found that it specifically targets **SSH** and **SCP** credentials by intercepting authentication and read operations. The stolen data is encrypted with **RC4**, staged locally in a disguised file, and then exfiltrated through crafted **DNS** requests to an attacker-controlled domain, giving the malware both credential-theft and covert command-and-control capabilities. The reporting highlights Symbiote as a stealth-focused Linux threat that combines rootkit-style hiding techniques with credential harvesting and DNS-based data theft.
Aug 15, 2026
ESET reported that the **Ebury** Linux malware operation has remained active for more than a decade, compromising roughly **400,000 servers** since 2009 and leaving more than **100,000** still infected as of late 2023. Identified as an **OpenSSH backdoor** and credential stealer, Ebury has continued to evolve from its earlier role in the **Operation Windigo** crimeware ecosystem, where it supported spam, web traffic redirection, exploit-kit delivery, and broader server-side abuse while allowing legitimate services to keep running and delaying detection. Recent Ebury versions added stronger obfuscation, a new **domain generation algorithm (DGA)**, and improved rootkit features, while operators expanded propagation through compromised hosting providers and **adversary-in-the-middle SSH interception** via ARP spoofing inside data centers. The group also broadened monetization beyond spam and redirects to include theft of **credit card and financial data** from HTTP POST traffic and cryptocurrency wallet theft targeting **Bitcoin** and **Ethereum** nodes, showing that a long-running Linux server botnet first exposed during Windigo has adapted into a durable platform for credential theft and financial crime.
Aug 14, 2026
**XOR.DDoS** has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch **SYN flood, ACK flood, and DNS amplification** attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, **Groundhog**, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign. The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a **loadable kernel module rootkit** to hide processes and TCP ports, and survive reboots through files and scripts placed in `/boot`, `/etc/init.d`, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the **Tsunami** backdoor and **XMRig** miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Aug 15, 2026