Statistics Report on Malware Targeting Linux SSH Servers in Q4 2025
ID: 01764c34-7713-534d-8f29-26d8f5c5c1d0
STIX ID: report--01764c34-7713-534d-8f29-26d8f5c5c1d0
Feed Name: ASEC
Threat Score
AhnLab ASEC's Q4 2025 honeypot analysis reports widespread brute‑force/dictionary attacks against Linux SSH servers dominated by P2PInfect worms (80.4%), with Prometei and XMRig also observed; it documents ongoing ShellBot (PerlBot) distribution attributed to the RUBYCARP actor, details ShellBot command capabilities and configurations, and publishes associated IoCs (file hashes, URLs, IP addresses) to support detection and mitigation.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.