Skip to content
SSHStalker Botnet Infects 7,000 Linux Systems Using IRC and SSH

SSHStalker Botnet Infects 7,000 Linux Systems Using IRC and SSH

First seen 11 Feb 2026, 07:38 UTC

Article Content

Browse articles
ThreatCluster AI
ThreatCluster March 12, 2026 at 16:10 UTC

The SSHStalker botnet has been identified as targeting approximately 7,000 Linux systems across the United States, Europe, and Asia-Pacific. Utilizing a combination of Internet Relay Chat (IRC) and SSH for command-and-control operations, this botnet employs mass-compromise techniques to deploy various scanners and malware. The operation leverages outdated communication protocols alongside modern automation methods.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 183d ago How this analysis works

Timeline

2026-02-09
Flare's research team publishes findings on SSHStalker
2026-02-10
Bleepingcomputer and Scmagazine report on SSHStalker

More articles in this cluster (10)

Following this threat?

Track PhoenixMiner in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed