Back Cybersecuritynews

Legacy IRC Botnet Campaign Uses Automated SSH Compromise Pipeline to Enroll Linux Hosts at Scale

Cybersecuritynews •Tushar Subhra Dutta • February 11, 2026

SSHStalker is a newly discovered Linux botnet that brings back Internet Relay Chat (IRC) control while using automation to compromise servers over SSH. It mainly succeeds by guessing weak or reused passwords, then turning each host into a launchpad for more scans and installs. In honeypot intrusions seen in early 2026, attackers dropped a Golang […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SSHStalker Botnet Infects 7,000 Linux Systems Using IRC and SSH The SSHStalker botnet has been identified as targeting approximately 7,000 Linux systems across the United States, Europe, and Asia-Pacific. Utilizing a combination of Internet Relay Chat (IRC) and SSH for command-and-control operations, this botnet employs mass-compromise techniques to deploy various scanners and malware. The operation leverages outdated communication protocols alongside modern automation methods. 10 sources 36

Extracted Entities

Legacy IRC Botnet Campaign Uses Automated SSH Compromise Pipeline to Enroll Linux Hosts at Scale

The full story

Extracted Entities

Attack Types (3)

Campaigns (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)