SSH Bot Profiles Linux Systems Before Potential Cryptocurrency Mining Deployment

A new SSH bot has been detected quietly logging into Linux systems to profile their CPU, GPU, and memory before potentially deploying cryptocurrency miners.

The bot's behavior may seem harmless at first glance, but it is a carefully staged operation designed to identify the most profitable targets for mining activities.

According to a report by the Internet Storm Center, the SSH bot connects from a single IP address, authenticates using a weak root password, and identifies itself as a Go-based SSH client.

The bot runs two commands: one to profile the host's hardware and another to test for privilege escalation. It then disconnects without dropping any visible payload, leaving behind no binary or persistence hook.