The Go module 'golang-random-ip-ssh-bruteforce' scans random IPv4 addresses for exposed SSH services and attempts brute-force logins using an embedded username-password list. The wordlist contains only 'root' and 'admin' paired with common weak passwords such as root, test, password, admin, 12345678, 1234, qwerty, webadmin, webmaster, techsupport, letmein, and Passw@rd. The code disables host key verification by setting ssh.InsecureIgnoreHostKey, allowing connections regardless of server identity. The module runs an infinite loop generating IPs and attempting concurrent SSH logins. On the first successful login, the package sends the target IP, username, and password to Telegram bot @sshZXC_bot, which forwards credentials to @io_ping. The package was published on June 24, 2022 and remains available on pkg.go.dev.
Cybersecurity researchers have discovered a malicious Go module that presents itself as a brute-force tool for SSH but actually contains functionality to discreetly exfiltrate credentials to its creator. "On the first successful login, the package sends the target IP address, username, and password to a hard-coded Telegram bot controlled by the threat actor," Socket researcher Kirill Boychenko said. The deceptive package, named "golang-random-ip-ssh-bruteforce," has been linked to a GitHub account called IllDieAnyway (G3TT), which is currently no longer accessible.
The software supply chain security company said the Go module works by scanning random IPv4 addresses for exposed SSH services on TCP port 22, then attempting to brute-force the service using an embedded username-password list and exfiltrating the successful credentials to the attacker. A notable aspect of the malware is that it deliberately disables host key verification by setting " ssh.InsecureIgnoreHostKey" as a HostKeyCallback, thereby allowing the SSH client to accept connections from any server regardless of their identity.
The wordlist is fairly straightforward, including only two usernames root and admin, and pairing them against weak passwords like root, test, password, admin, 12345678, 1234, qwerty, webadmin, webmaster, techsupport, letmein, and Passw@rd. The malicious code runs in an infinite loop to generate the IPv4 addresses, with the package attempting concurrent SSH logins from the wordlist. The details are transmitted to a threat actor-controlled Telegram bot named "@sshZXC_bot" (ssh_bot) via the API, which then acknowledges the receipt of the credentials. The messages are sent through the bot to an account with the handle "@io_ping" (Gett).
Collection
[
|
...
]