Hackers Targeting Linux Secure Shell Servers: Analysis Reveals Advanced Attack Strategies

In recent times, hackers have been relentlessly targeting Linux Secure Shell (SSH) servers, aiming to compromise vulnerable systems by installing tools for port scanning and dictionary attacks. This article delves into the research conducted by AhnLab Security Emergency Response Center, providing an in-depth analysis of attack campaigns and the various malware encountered. Additionally, we explore the tactics employed by threat actors during the attack process.

Analysis of Attack Campaigns

The AhnLab researchers meticulously analyzed attack campaigns, specifically focusing on hackers’ usage of IP scanning techniques to locate servers with activated SSH services or port 22. This method allows the attackers to identify potential targets and exploit their vulnerabilities.

Malware and Attack Options

In their quest for malicious activities, hackers have an array of tools at their disposal. Commonly found malware includes DDoS bots, CoinMiners, and other malicious software capable of performing scanning and brute force or dictionary attacks on infected systems. By installing this malware on compromised servers, threat actors gain control and further their objectives.

Common Malware Installed in Attacks

AhnLab researchers have identified several prevalent types of malware used in attacks on poorly managed Linux SSH servers. Some notable examples include ShellBot, Tsunami, ChinaZ DDoS Bot, and XMRig CoinMiner. By exploiting vulnerabilities in server management, hackers use these tools to gain unauthorized access and carry out their malicious activities.

Initial Login Attempts

Prior to the installation of malware, threat actors diligently attempt to log into Linux servers with activated SSH services using various combinations of identification (ID) and password credentials. This serves as their first and crucial step towards gaining control over the compromised system.

Variations in Attack Strategies

Interestingly, the researchers noticed a shift in strategy, where threat actors opted to install additional scanners instead of traditional malware. This technique increases their chances of identifying more vulnerable systems for potential exploitation.

Steps After Successful Login

Once a threat actor gains access to a compromised server, they proceed methodically. Their first objective is to determine the number of CPU cores on the compromised machine. This information allows them to make informed decisions regarding resource allocation and future actions.

Downloading Compressed File

To proceed with the attack, the hacker obtains account credentials from the compromised server. These valuable credentials grant the attacker the ability to log in again, using the compromised account, and initiate subsequent actions. The next step involves downloading a compressed file containing essential tools for the attack.

Contents of the Compressed File

The compressed file obtained by the threat actor contains two critical components: a powerful port scanner and an SSH dictionary attack tool. These tools provide the hacker with the means to identify vulnerable ports on target systems and launch a brute force or dictionary attack to gain unauthorized access.

Execution of the Attack

To execute the attack, threat actors employ a Bash script named “go” with the argument “212.” This script acts as a command center, orchestrating the execution of the port scanner, banner grabber, and the SSH dictionary attack tool. These tools combined enable the hacker to systematically exploit vulnerabilities in the target system.

The persistent targeting of Linux Secure Shell servers by hackers demands heightened vigilance from system administrators and advanced cybersecurity measures. Understanding the attack strategies employed by threat actors, such as the installation of port scanners and dictionary attack tools, allows organizations to adopt effective defensive measures and protect their infrastructure from unauthorized access and potential compromise. By remaining proactive, organizations can minimize the risks posed by these evolving attack techniques and ensure the security of their SSH servers.

Explore more

How Is AI Revolutionizing Payroll in HR Management?

Imagine a scenario where payroll errors cost a multinational corporation millions annually due to manual miscalculations and delayed corrections, shaking employee trust and straining HR resources. This is not a far-fetched situation but a reality many organizations faced before the advent of cutting-edge technology. Payroll, once considered a mundane back-office task, has emerged as a critical pillar of employee satisfaction

AI-Driven B2B Marketing – Review

Setting the Stage for AI in B2B Marketing Imagine a marketing landscape where 80% of repetitive tasks are handled not by teams of professionals, but by intelligent systems that draft content, analyze data, and target buyers with precision, transforming the reality of B2B marketing in 2025. Artificial intelligence (AI) has emerged as a powerful force in this space, offering solutions

5 Ways Behavioral Science Boosts B2B Marketing Success

In today’s cutthroat B2B marketing arena, a staggering statistic reveals a harsh truth: over 70% of marketing emails go unopened, buried under an avalanche of digital clutter. Picture a meticulously crafted campaign—polished visuals, compelling data, and airtight logic—vanishing into the void of ignored inboxes and skipped LinkedIn posts. What if the key to breaking through isn’t just sharper tactics, but

Trend Analysis: Private Cloud Resurgence in APAC

In an era where public cloud solutions have long been heralded as the ultimate destination for enterprise IT, a surprising shift is unfolding across the Asia-Pacific (APAC) region, with private cloud infrastructure staging a remarkable comeback. This resurgence challenges the notion that public cloud is the only path forward, as businesses grapple with stringent data sovereignty laws, complex compliance requirements,

iPhone 17 Series Faces Price Hikes Due to US Tariffs

What happens when the sleek, cutting-edge device in your pocket becomes a casualty of global trade wars? As Apple unveils the iPhone 17 series this year, consumers are bracing for a jolt—not just from groundbreaking technology, but from price tags that sting more than ever. Reports suggest that tariffs imposed by the US on Chinese goods are driving costs upward,