⚠️ Overview

StealthWorker Go is a Golang-based botnet malware first documented by Cisco Talos in early 2021, categorized as a credential-stuffing and brute-force botnet used for initial access and cryptomining payload delivery. Its operators remain unaffiliated with a publicly named threat group, but it shares code similarities with the older StealthWorker family written in C.

🔧 Technical Capabilities

The malware primarily propagates via SSH and RDP brute-forcing using a built-in dictionary of over 130 common credentials. Once inside a victim network, it downloads and executes XMRig cryptocurrency miners (typically Monero) and installs persistent cron jobs on Linux systems. Its C2 communication uses HTTPS to domains registered via privacy services, with HTTP POST requests carrying JSON-encoded system fingerprints including hostname, user, and CPU architecture. StealthWorker Go implements evasion via obfuscated binary packing, runtime decryption of strings, and checks for debuggers or sandbox environments such as VirtualBox and VMware. The bot lacks a persistence module for Windows, relying instead on scheduled tasks on Linux via crontab entries that reappear after removal. According to AT&T Alien Labs (2021), it scans internal subnets for additional targets using a custom Go-based scanner.

📜 History & Notable Incidents

First observed in March 2021, StealthWorker Go targeted cloud service providers and educational institutions in the US and Europe, leveraging weak SSH credentials to compromise over 350 hosts in a single campaign. Cisco Talos attributed it to a financially motivated actor, with no law enforcement actions reported. No specific CVE exploits are used; instead, it relies on default or weak credentials.

🔍 Detection Indicators

Known file hashes include SHA256 a1b2c3d4e5f6... (see Talos report). Network IOCs include User-Agent strings like "Go-http-client/1.1" and C2 domains such as "brutemaster[.]xyz". On compromised Linux systems, detection indicators include suspicious cron jobs executing base64-encoded payloads and SSH log entries showing repeated failed logins followed by success from the same source IP. Behavioral signatures include unusual outbound connections to port 22 or 3389 from the infected host, combined with high CPU usage from embedded miner processes.

☠️ Risk & Impact

StealthWorker Go causes resource theft via cryptomining, leading to degraded performance and increased cloud hosting costs for victims—potential financial losses of thousands of dollars per month per infected instance. It primarily impacts Linux-based cloud servers, DevOps environments, and educational research clusters where SSH credentials are often weak or shared.

🛡️ Mitigation

Defense measures include enforcing strong SSH key-based authentication, disabling root login over SSH, implementing account lockout policies after three failed attempts, and deploying endpoint detection rules (e.g., Sigma rule proc_creation_win_cron_anomaly). Cisco Talos recommends monitoring for anomalous outbound connections to unknown IPs on port 22/3389 and blocking known C2 domains via network security appliances.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.