Reconnaissance First: An SSH Bot That Sizes Up Your Hardware Before Deploying a Miner [Guest Diary], (Thu, Jul 30th)
ID: 6cb7ce0c-b3a1-5186-b418-fa368e0bc978
STIX ID: report--6cb7ce0c-b3a1-5186-b418-fa368e0bc978
Feed Name: SANS ISC Diary
Threat Score
A honeypot recorded a brief, automated SSH login from 91.92.40.13 (SSH-2.0-Go, HASSH 2ec37a7c...) that performed a labeled hardware inventory (CPU cores/model, NVIDIA GPU search, uptime, last) and a /proc/meminfo check gated at >1 GB, then tested sudo -S with the same weak root password and disconnected without dropping a payload; the behavior is consistent with reconnaissance for cryptomining/resource-hijacking and should be treated as an early warning with the provided IoCs.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
