SSHStalker Botnet Uses IRC C2 to Control Linux Systems via Legacy Kernel Exploits

Cybersecurity researchers have disclosed details of a new botnet operation called SSHStalker that relies on the Internet Relay Chat (IRC) communication protocol for command-and-control (C2) purposes. According to cybersecurity company Flare, "The toolset blends stealth helpers with legacy-era Linux exploitation: Alongside log cleaners (utmp/wtmp/lastlog tampering) and rootkit-class artifacts, the actor keeps a large back-catalog of Linux 2.6.x-era exploits (2009–2010 CVEs)."

These are low value against modern stacks, but remain effective against 'forgotten' infrastructure and long-tail legacy environments.

A Different Kind of Botnet

Unlike typical botnet campaigns that leverage compromised systems for immediate financial gain through distributed denial-of-service (DDoS) attacks, proxyjacking, or cryptocurrency mining, SSHStalker has been found to maintain persistent access without any follow-on post-exploitation behavior. This dormant behavior sets it apart, raising the possibility that the compromised infrastructure is being used for staging, testing, or strategic access retention for future use.

Technical Architecture

The core of SSHStalker consists of several interconnected components:

• Golang Scanner: Scans for port 22 to identify servers with open SSH, extending its reach in a worm-like fashion
• IRC-Controlled Bot Variants: Multiple payloads that connect to an UnrealIRCd IRC Server
• Perl File Bot: Joins control channels and waits for commands to carry out flood-style traffic attacks
• Log Cleaners: C program files that erase traces of malicious activity from logs
• Keep-alive Component: Ensures the main malware process is relaunched within 60 seconds if terminated

Exploitation of Legacy Vulnerabilities

SSHStalker is notable for blending mass compromise automation with a catalog of 16 distinct vulnerabilities impacting the Linux kernel, some going all the way back to 2009. The exploit module leverages vulnerabilities including:

• CVE-2009-2692
• CVE-2009-2698
• CVE-2010-3849
• CVE-2010-1173
• CVE-2009-2267
• CVE-2009-2908
• CVE-2009-3547
• CVE-2010-2959
• CVE-2010-3437

These vulnerabilities, while considered low-value against modern Linux distributions, remain effective against "forgotten" infrastructure and long-tail legacy environments that have not been updated or patched.

Infrastructure and Attribution

Flare's investigation of the staging infrastructure associated with the threat actor has uncovered an extensive repository of open-source offensive tooling and previously published malware samples. These include:

• Rootkits to facilitate stealth and persistence
• Cryptocurrency miners
• A Python script that executes a binary called "website grabber" to steal exposed Amazon Web Services (AWS) secrets from targeted websites
• EnergyMech, an IRC bot that provides C2 and remote command execution capabilities

Based on linguistic analysis of IRC channels and configuration files, researchers suspect the threat actor could be of Romanian origin, given the presence of "Romanian-style nicknames, slang patterns, and naming conventions." The operational fingerprint also exhibits strong overlaps with a hacking group known as Outlaw (aka Dota).

Operational Characteristics

"SSHStalker does not appear to focus on novel exploit development but instead demonstrates operational control through mature implementation and orchestration," Flare noted. The threat actor primarily uses C for core bot and low-level components, shell for orchestration and persistence, and limited Python and Perl usage mainly for utility or supporting automation tasks inside the attack chain.

The campaign demonstrates strong operational discipline in mass compromise workflows, infrastructure recycling, and long-tail persistence across heterogeneous Linux environments. Rather than developing zero-days or novel rootkits, the actor shows sophisticated understanding of how to maintain access to legacy systems that are often overlooked in modern security operations.

Implications for Security Teams

The SSHStalker campaign highlights the ongoing risk posed by legacy infrastructure in enterprise environments. Organizations with long-tail Linux deployments, particularly those running older kernel versions, should:

1. Inventory and assess all Linux systems, especially those running kernel versions from 2009-2010
2. Implement network segmentation to isolate legacy systems from critical infrastructure
3. Consider migrating or decommissioning systems that cannot be updated to current kernel versions
4. Monitor for unusual SSH login patterns and IRC traffic on networks
5. Review and enhance log retention policies to ensure forensic visibility

As the threat landscape continues to evolve, campaigns like SSHStalker demonstrate that even decade-old vulnerabilities can pose significant risks when organizations fail to maintain their infrastructure. The combination of automated scanning, IRC-based C2, and stealth techniques makes this botnet particularly challenging to detect and mitigate without comprehensive security monitoring and patch management programs.

For more information on protecting against botnets and legacy system vulnerabilities, visit the SANS Institute's Linux security resources.