Loading story…
Researchers reported an ongoing Linux server compromise campaign in which attackers exploit Control Web Panel (CWP) to install a malware package known as Facefish, an LD_PRELOAD-based userland rootkit that backdoors OpenSSH. The intrusion chain retrieves an installer often named sshins, downloads a first-stage payload from 176.111.174.26, drops a malicious shared library as /lib64/libs.so, adds it to /etc/ld.so.preload, restarts sshd, and then removes evidence from CWP logs and shell history. The malware primarily targets x64 Linux systems and has also shown the ability to adapt to FreeBSD environments.
Once active, the backdoor hooks OpenSSH-related functions to steal SSH credentials, collect host information, and provide remote access through arbitrary command execution and reverse shell capabilities. Researchers said the malware beacons to 176.111.174.26:443 over raw TCP and protects communications with negotiated keys and Blowfish-encrypted traffic, using techniques that hinder straightforward network detection. The samples also employ anti-analysis measures including UPX packing, erased ELF sections, and randomized rootkit encryption keys, while analysts assessed the operators were likely harvesting access and system intelligence for later monetization rather than immediately deploying follow-on payloads such as cryptominers.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
On February 1, attackers used a command injection exploit against Control Web Panel to retrieve and run an installer named sshins on Linux servers. The installer dropped /lib64/libs.so, added it to /etc/ld.so.preload, restarted sshd, and erased traces from CWP logs and shell history.
Juniper noted that the Zero Day Initiative disclosed 37 zero-day vulnerabilities affecting Control Web Panel in 2020, providing context for the product's long-running security issues.
Juniper Threat Labs published findings on a campaign hijacking Linux SSH servers through CWP exploitation and an LD_PRELOAD-based OpenSSH backdoor. Juniper also said the malware and C2 infrastructure were detected and blocked by Juniper ATP products and associated IDP signatures.
Netlab 360 published an analysis of the Facefish malware family, describing its dropper, LD_PRELOAD rootkit, OpenSSH credential theft, host reconnaissance, and Blowfish-encrypted C2 communications with 176.111.174.26:443.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented **Linux/SSHDoor.A**, a trojanized OpenSSH daemon that steals usernames and passwords from compromised Linux servers while giving attackers covert persistent access. The malware exfiltrates server and credential data over HTTP after encrypting it with an embedded **1024-bit RSA** key and Base64-encoding the result, and it can preserve access through a hardcoded password or bundled SSH key, with override options read from `/var/run/.options`. ESET linked the activity to infrastructure including **`openssh.info`** and **`linuxrepository.org`**, which at the time resolved to **`82.221.99.69`**, and a later sample shared publicly was detected by multiple antivirus engines as an SSH backdoor. The SSH backdoor was also observed alongside **Linux/Chapro.A**, a malicious Apache module used to inject iframes into web traffic, delivering a Java exploit for **`CVE-2012-1723`** and ultimately a **Zeus/Zbot** payload to Windows victims. In later research, ESET expanded the picture beyond SSHDoor, identifying **21** undocumented or underdocumented Linux malware families built from trojanized OpenSSH binaries; **18** stole credentials and **17** provided stealth backdoor access. The findings showed that OpenSSH backdoors remained an active and diverse threat on Linux servers, ranging from simple credential theft to more advanced families using encrypted HTTP, raw TCP, or DNS for command and control.
Aug 15, 2026
**XOR.DDoS** has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch **SYN flood, ACK flood, and DNS amplification** attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, **Groundhog**, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign. The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a **loadable kernel module rootkit** to hide processes and TCP ports, and survive reboots through files and scripts placed in `/boot`, `/etc/init.d`, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the **Tsunami** backdoor and **XMRig** miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Aug 15, 2026
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026