It is pretending to be your SSH daemon
Three times in one week an intruder dropped a binary named sshd into a hidden directory named after a 19-digit random number, and launched it in the background with 51 target addresses as command-line arguments. The name is the disguise: every Linux box runs a real sshd, so a process by that name draws no attention in a process listing. The targets are masked to /16 here. The machine was not the goal, it was the next hop.
Three times this week something started a program called sshd. None of them were sshd.
When you scan a process list you read names. A familiar name is the fastest thing your eye skips over, and nothing is more familiar than the SSH daemon.
The real one lives in a system directory. This one sits in a folder named after a nineteen-digit random number, so it never collides with anything and never appears in a search for something readable.
Then look at how it was launched. Fifty-one addresses, passed straight in on the command line. Not a configuration file, not a download. The target list travels with the process.
That is the whole purpose. The machine was never the destination. It was the next hop.
A name is not an identity. Two processes can be called the same thing and only one of them shipped with your operating system.
Check the path of a process, not only its name.
#linux#security#selfhosted#infosec#sysadmin
❯ Check the path of a process, not only its name.