Golang-random-ip-ssh-bruteforce SSH credential-theft module
Malware Activity
Summary
Hide ▲
Show ▼
The golang-random-ip-ssh-bruteforce Go module is being identified as a malicious SSH credential-theft tool that scans random IPv4 addresses for exposed SSH services on TCP port 22 and steals successful logins. It uses a built-in username-password list, disables host key verification, and sends captured credentials to a Telegram bot. The activity matters because it turns unwitting operators’ infrastructure into a distributed brute-force platform while quietly exfiltrating access data.
Related Happenings
Telemetry.js credential stealer targeting Linux and macOS with public GitHub exfiltration
Malware Activity
H score52
First: 06.09.2025 17:11
Last: 06.09.2025 17:11
Sources 1
About this happening:
The telemetry.js credential stealer is targeting Linux and macOS systems and trying to harvest GitHub tokens, npm tokens, SSH keys, .env files, and crypt...
Telemetry.js credential stealer targeting Linux and macOS with public GitHub exfiltration
Malware ActivityAbout this happening: The telemetry.js credential stealer is targeting Linux and macOS systems and trying to harvest GitHub tokens, npm tokens, SSH keys, .env files, and crypt...
Timeline
-
24.08.2025 16:38 1 articles · 10mo ago
Malicious Go module published on pkg.go[.]dev
Untyped PhaseThe deceptive Go module golang-random-ip-ssh-bruteforce was published on pkg.go[.]dev on June 24, 2022 and linked to the GitHub account IllDieAnyway (G3TT), establishing a distribution point for the SSH brute-force credential-theft package.
Show sources
- Malicious Go Module Poses as SSH Brute-Force Tool, Steals Credentials via Telegram Bot — thehackernews.com — 24.08.2025 16:38
-
24.08.2025 03:00 1 articles · 10mo ago
Researchers disclose SSH credential theft behavior
Technical Analysis UpdateResearchers disclosed that golang-random-ip-ssh-bruteforce scans random IPv4 addresses for exposed SSH services on TCP port 22, brute-forces logins with an embedded username-password list, disables host key verification with ssh.InsecureIgnoreHostKey, and exfiltrates successful credentials to the threat actor-controlled Telegram bot @sshZXC_bot and the handle @io_ping.
Show sources
- Malicious Go Module Poses as SSH Brute-Force Tool, Steals Credentials via Telegram Bot — thehackernews.com — 24.08.2025 16:38