cShell DDoS Bot Attack Case Targeting Linux SSH Server (screen and hping3)

AhnLab ASEC describes cShell, a Go-based DDoS bot deployed to poorly managed Linux servers via SSH brute-force; it installs under /etc/de/cARM, ensures persistence with a systemd service file, and leverages Linux utilities (screen and hping3) to conduct SYN/ACK/PSH/UDP/Xmas/FIN floods. The report documents the C2/update workflow (including Pastebin-based update URLs), command formats, supported attack options, and provides IOCs (MD5s, download URLs and multiple IP addresses).