A newly discovered SSH bot silently gains unauthorized access to Linux systems by profiling CPU, GPU, and memory usage before exiting without leaving any visible evidence This article explores recon model attackers. . Initially appearing benign, this behavior suggests a meticulously planned cryptomining operation targeting powerful hardware.
The script collects details such as the operating system and kernel version, CPU architecture, number of cores, and specific CPU model information, then tags each value with labels like UNAME, ARCH, CPUS, CPU_MODEL, GPU, and LAST. Counting CPU cores, examining the CPU model, searching for NVIDIA GPUs, and enforcing a minimum RAM threshold are standard procedures in cryptominer triage rather than denial-of-service preparation or casual snooping.
The recon session, condensed (Source – Internet Storm Center) The recon-first model, where attackers evaluate potential targets, decide whether a miner is worth deploying, and then proceed with the second-stage payload only if hardware meets specified criteria. In one instance, an operator encountered another SSH campaign targeting their sensor around the same time as a different session that used a loader chain to download an ELF binary and join a denial of service botnet. Implementing rate limiting on SSH connections, restricting exposure through Virtual Private Networks (VPNs) or known IP ranges, and alerting on bulk hardware discovery increases the likelihood that such reconnaissance sessions will be detected and investigated rather than being ignored.
