Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Panchan Botnet Lateral Movement in Linux Education Servers

Jun 15, 2022 •

Anthony Pell

1 min read

Topics Covered

malware threat detection botnet education sector cryptomining lateral movement SSH exploits

A new peer-to-peer botnet named Panchan appeared in the wild around March 2022, targeting Linux servers in the education sector to mine cryptocurrency.

Panchan is empowered with SSH worm functions like dictionary attacks and SSH key abuse to perform rapid lateral movement to available machines in the compromised network.

At the same time, it has powerful detection avoidance capabilities, such as using memory-mapped miners and dynamically detecting process monitoring to stop the mining module immediately.