Loading story…
Researchers reported that RapperBot, a Linux IoT botnet malware family active since at least June 2022, has been brute-forcing SSH servers at scale and was observed using more than 3,500 unique IP addresses in scanning and login attempts. The malware appears to target internet-exposed systems with default or weak SSH passwords, retrieves credential lists from remote infrastructure, and sends newly stolen valid credentials back to its command-and-control servers.
Unlike earlier Mirai-style botnets focused on rapid self-propagation, RapperBot was found establishing persistent remote access on compromised hosts by modifying the ~/.ssh/authorized_keys file to install an attacker-controlled SSH public key. The malware can also remove existing authorized keys, potentially locking out legitimate administrators, and preserve access even after password changes or the disabling of SSH password authentication. Researchers said the operators' ultimate post-compromise objective remained unclear because no follow-on activity had yet been observed.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers identified the Linux IoT botnet malware family RapperBot as active since at least June 2022, spreading by brute-forcing SSH servers that use default or weak passwords.
After initial propagation activity, RapperBot shifted from simple self-propagation to maintaining persistent remote access on compromised SSH servers by modifying /.ssh/authorized_keys and installing the operators' SSH public key, while also stealing newly acquired credentials.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 50 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a previously undocumented Linux botnet dubbed **SSHStalker** that has compromised roughly **7,000** systems by combining **SSH credential brute-forcing/scanning** with **legacy (circa-2009) exploit chains** and highly automated staging. The activity was observed over multiple weeks via SSH honeypots, with intrusions characterized by rapid deployment, on-host compilation, and automated enrollment into command infrastructure, indicating an operation optimized for mass compromise rather than targeted intrusion. SSHStalker uses **IRC-based command-and-control** and a mixed toolkit that includes C-based bots, Perl scripts, and known botnet malware families such as **Tsunami** and **Keiten**. Reporting highlighted an unusual “**dormant persistence**” pattern: infected hosts are kept under control without immediate visible monetization or impact operations, despite having capabilities associated with **DDoS** and **cryptomining**. Persistence is described as noisy but effective, including **cron-based relaunch** behavior that can restore the malware within about a minute after disruption, suggesting the operator may be staging infrastructure or retaining access for future use.
Jun 29, 2026
ESET reported that **Linux/Rakos** is compromising internet-exposed embedded devices and Linux servers by brute-forcing weak or default **SSH** credentials, then enrolling the systems into a botnet. The malware, written in **Go** and often packed with **UPX**, hides under names such as `.javaxxx`, `.swap`, and `kworker`, starts local and external HTTP services, sends host details and stolen credentials to command-and-control servers, retrieves target IP lists, and propagates by uploading itself to newly accessed hosts. Researchers said the operators can remotely update configuration files and upgrade the malware, while analyzed samples showed no built-in DDoS or spam module. The activity mirrors earlier Linux botnet campaigns such as **Linux/Moose**, which also spread by abusing weak default credentials on embedded Linux devices rather than exploiting software flaws. Moose primarily brute-forced **Telnet** on consumer routers and other MIPS and ARM systems, then used infected devices as whitelisted SOCKS/HTTP proxies, sniffed unencrypted traffic for social-network cookies, and supported large-scale social-media fraud from residential IP space. Both malware families lack reliable persistence after reboot, but exposed devices can be quickly reinfected if default passwords remain unchanged, including after factory resets.
Aug 14, 2026
Internet Storm Center (ISC) researchers reported a **self-propagating SSH worm** observed by a DShield honeypot sensor that can compromise exposed Linux systems in roughly **four seconds** by using **credential stuffing/brute force** against weak SSH passwords, with a notable focus on *Raspberry Pi* devices left on default or common credentials (e.g., user `pi` with passwords such as `raspberry` and `raspberryraspberry993311`). The observed attack chain rapidly authenticates, uploads a compact **4.7 KB bash script** (via SCP), executes it, and establishes persistence while removing competing malware, enabling worm-like exponential spread across vulnerable internet-connected hosts. Technical analysis indicates the activity likely originated from an already-compromised *Raspberry Pi* in Germany (IP `83.135.10.12`, Versatel Deutschland), using an SSH client string consistent with Raspbian (`SSH-2.0-OpenSSH_8.4p1 Raspbian-5+b1`) and a recorded HASSH fingerprint `ae8bd7dd09970555aa4c6ed22adbbf56`. Post-compromise, the malware connects to **IRC-based command-and-control** and includes **cryptographically signed command verification**; it also automates scanning and lateral movement using tools such as **Zmap** and **sshpass**, reinforcing how default/weak SSH authentication on IoT and small-form-factor Linux systems remains a high-impact botnet entry point.
Jun 29, 2026