Back Securityaffairs.Co

SSHStalker botnet targets Linux servers with legacy exploits and SSH scanning

Securityaffairs.Co •Pierluigi Paganini • February 11, 2026

A new Linux botnet, SSHStalker, has infected 7,000 systems using old 2009-era exploits, IRC bots, and mass-scanning malware. Flare researchers uncovered a previously undocumented Linux botnet dubbed SSHStalker, observed via SSH honeypots over two months. Researchers ran an SSH honeypot with weak credentials starting in early 2026 and spotted a set of intrusions unlike […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SSHStalker Botnet Infects 7,000 Linux Systems Using IRC and SSH The SSHStalker botnet has been identified as targeting approximately 7,000 Linux systems across the United States, Europe, and Asia-Pacific. Utilizing a combination of Internet Relay Chat (IRC) and SSH for command-and-control operations, this botnet employs mass-compromise techniques to deploy various scanners and malware. The operation leverages outdated communication protocols alongside modern automation methods. 10 sources 36

Extracted Entities

SSHStalker botnet targets Linux servers with legacy exploits and SSH scanning

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)