The payload arrived over SSH
A seven-second session pushed 3,716,336 bytes into a file over an already-authenticated SSH channel, without a single outbound connection. Egress filtering that blocks outbound HTTP does nothing when the payload arrives over the channel the attacker already holds.
Egress filtering blocked. The dropper still arrived over port twenty-two.
Blocking a server from reaching the internet stops the most common delivery pattern: the compromised box fetches a dropper from somewhere else.
Three commands in seven point four seconds. Client: russh, a purpose-built Rust SSH library.
First: read the echo binary. Its ELF header reveals the CPU architecture. No uname.
Then curl, then wget, then a raw socket. Layered fallbacks for a filtered network.
None of it fired. Instead the attacker pushed three point five megabytes straight down the open SSH channel.
A second server: same byte count, same order.
The bytes arrived over the connection the attacker already had. Egress filtering was not in the path.
Require key-only authentication. The session that authenticates is the session that delivers.
#linux#security#ssh#infosec#sysadmin
❯ Require key-only authentication. The session that authenticates is the session that delivers.