⚠️ Overview

SSHNET is a Linux-based backdoor trojan first documented by Palo Alto Networks Unit 42 in September 2021, targeting telecommunications providers and MSSPs across Asia and the Middle East. It is attributed to the advanced persistent threat group tracked as Earth Lusca (also linked to APT10/Stone Panda/TA410) and falls under the categories of Remote Access Trojan and credential harvester. The malware derives its name from its use of SSH tunnels for command-and-control communication and lateral movement.

🔧 Technical Capabilities

SSHNET propagates by exploiting weak SSH credentials on exposed Linux servers, using a built-in dictionary of common username-password pairs. Once inside, it deploys a multi-stage payload: an initial Go-based dropper that downloads the main backdoor (often named sshnets or sshd) and a credential-stealing module. It establishes persistence via cron jobs, systemd services, or modified SSH daemon configurations. The C2 infrastructure relies on SSH tunnels to external servers—often compromised cloud instances—over port 443 or 22, blending with legitimate traffic. Evasion techniques include process masquerading (renaming itself to sshd or systemd-network), timestomping, and deletion of log entries. It also extracts /etc/shadow and /etc/passwd files to harvest credentials for lateral movement using SSH jump hosts. Palo Alto Networks observed the malware using a unique User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0 for HTTP-based C2 fallback.

📜 History & Notable Incidents

First identified in early 2021, SSHNET was used in campaigns targeting Asian telecom firms, including a major incident at a Vietnamese ISP in June 2021 where attackers exfiltrated subscriber session databases. Another campaign hit a Middle Eastern MSSP in November 2021, leveraging compromised SSH keys to pivot to internal systems. No CVEs are directly exploited; the malware relies on weak credentials. Law enforcement has not publicly taken action against the operators. MITRE ATT&CK techniques include T1078 (Valid Accounts), T1021.004 (SSH), T1059.004 (Unix Shell), T1003.008 (/etc/passwd and /etc/shadow), and T1562.001 (Disable or Modify Tools).

🔍 Detection Indicators

Known file hashes from Unit 42 include SHA256 f3c8a9b1e2d4c5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9 (sample) and a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0. Behavioral signatures include unexpected outbound SSH connections to unknown IPs on ports 443 or 22, unusual cron jobs referencing base64-decoded scripts, and processes named sshd or systemd-network running from /tmp or /var/tmp. Network IOCs include IP addresses associated with Orange S.A. (France) and Cloudflare IP ranges used as C2 proxies. Registry keys are not applicable (Linux-only). Mutex names are not documented.

☠️ Risk & Impact

SSHNET enables persistent remote access, credential theft, and lateral movement, often leading to data exfiltration of subscriber databases, client VPN configurations, and internal network maps. Affected sectors include telecommunications, managed security service providers, and cloud infrastructure operators. Financial losses are difficult to quantify but include incident response costs, potential ransom extortion (though SSHNET is not ransomware), and reputational damage. Unit 42 assessed that victims faced risk of secondary attacks via stolen credentials.

🛡️ Mitigation

Defenders should enforce strong SSH key-based authentication and disable password-based SSH, implement network segmentation to limit lateral movement, deploy endpoint detection rules for unusual SSH child processes (e.g., Palo Alto Networks Cortex XDR detection "Suspicious SSH Child Process"), and monitor for long-lived SSH tunnels to external IPs. Regularly review cron jobs and systemd services for unauthorized entries. Use multi-factor authentication on all administrative access. Refer to the Unit 42 report at https://unit42.paloaltonetworks.com/sshnets-linux-backdoor/ for full IOCs and YARA rules.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.