SSH Worm Exploit Detected by DShield Sensor Using Credential Stuffing and Multi-Stage Malware
A recent incident involving a DShield honeypot sensor recorded a full compromise sequence through a self-replicating SSH worm targeting weak passwords on Linux systems. This event underscores the ongoing threat posed by poor SSH hygiene and default…
A recent incident involving a DShield honeypot sensor recorded a full compromise sequence through a self-replicating SSH worm targeting weak passwords on Linux systems. This event underscores the ongoing threat posed by poor SSH hygiene and default credentials on internet-connected devices.
08:24:13: Connection from IP 83.135.10.12. 08:24:14: Successful brute-force using credentials pi / raspberryraspberry993311. 08:24:15: 4.7 KB bash script uploaded via SCP. 08:24:16: Script execution; persistence established. 08:24:17: Attacker disconnects; worm initiates C2 check-in and active scanning.
The system was converted into a botnet node within four seconds.
Originating from IP 83.135.10.12, the connection was traced to Versatel Deutschland, a German ISP. The attacker’s SSH fingerprint indicates the source was a previously compromised Raspberry Pi. Such devices, often left online with default settings, are prime targets for botnets.
Immediately post-authentication, a small bash script was deployed to ensure persistence, disable competing malware, and modify the host file to redirect a known C2 domain. The malware then communicated with the operator via six IRC networks, joining a channel named #biret.
The DShield sensor captured the uploaded bash script, which included a mechanism to use an embedded RSA key for command verification, a rare yet notable feature.
This event underscores the ongoing threat posed by poor SSH hygiene and default credentials on internet-connected devices.
Upon joining the botnet, the malware installed zmap (a high-speed network scanner) and sshpass (for automated SSH logins). It scanned 100,000 random IP addresses for open SSH ports, attempting two credential pairs:
pi/raspberry pi / raspberryraspberry993311
Vulnerable hosts were rapidly infected, allowing the worm to autonomously spread. Although no cryptominer was installed, the script included functions to disable rival cryptomining processes, suggesting potential future payload deployment.
This incident highlights three critical lessons:
Weak or default passwords drive large-scale compromises. IoT and hobbyist devices, particularly Raspberry Pis, are high-value botnet resources. Self-propagating worms can spread rapidly once a single host is breached.
Security improvements can be achieved by:
Disabling password authentication in favor of SSH key-based logins . Removing the default pi user from Raspberry Pi devices. Using tools like fail2ban to block repeated SSH attempts. Segregating IoT systems from main production networks.
This attack illustrates the rapid weaponization potential of unprotected Linux devices into global botnets. A single Raspberry Pi using default credentials can serve as a launchpad for large-scale threats. It is crucial to secure SSH access with strong authentication and hardening.
Based on reporting by GBHackers.