SSH Bot Performs Hardware Reconnaissance Before Deploying Crypto Miner on Compromised Servers
What Happened — A new SSH‑based bot observed in the wild first attempts credential‑stuffing against public‑facing SSH services. Once it gains a foothold, the malware runs a lightweight script that inventories CPU cores, RAM, and GPU presence; only if the hardware meets profitability thresholds does it install a cryptocurrency miner. The activity was reported by the SANS Internet Storm Center in a guest diary entry.
Why It Matters for Compliance & Audit Readiness
- The scenario exemplifies a classic credential compromise that SOC 2 § CC6.1 (Logical Access Controls) is designed to prevent and evidence.
- Continuous monitoring of privileged SSH access and automated evidence collection (e.g., login logs, MFA enforcement) provide the audit trail needed to demonstrate effective access‑control governance.
- Verisq’s SOC 2 Access Controls capability helps map this event to the relevant Trust Services Criteria and supplies real‑time proof points for auditors.
Who Is Affected — Any organization exposing SSH endpoints: cloud‑infrastructure providers, SaaS platforms, managed service providers, and internal IT environments across finance, technology, and healthcare sectors.
Recommended Actions
- Enforce multi‑factor authentication (MFA) for all SSH accounts, especially privileged ones.
- Deploy credential‑hardening (e.g., key‑based auth, deny‑password login) and rate‑limit login attempts.
- Implement continuous log aggregation and anomaly detection for failed‑login spikes and post‑login hardware‑probe commands.
- Document the controls and retain evidence in a centralized compliance repository for SOC 2 audit readiness.
Source: SANS Internet Storm Center – SSH Bot Diary
Technical Notes – The bot uses a combination of publicly available credential‑stuffing lists and a Bash reconnaissance script that queries /proc/cpuinfo, free -m, and lspci to assess mining viability. No specific CVE is involved; the attack leverages weak SSH passwords. Source: same as above