SSHStalker botnet targets Linux servers with legacy exploits and SSH scanning

Flare researchers have documented SSHStalker, a Linux botnet that used mass SSH scanning, brute-force credentials and a toolkit of 2009–2010-era Linux 2.6.x kernel exploits to compromise ~7,000 mostly cloud servers; the operation installs IRC-based bots, uses cron jobs for noisy but effective persistence, and appears to favor quiet long-term access rather than immediate DDoS or cryptomining, with investigators providing IoCs and mitigation guidance.