Panchan Cryptominer Worm: How This Persistent SSH Botnet Continues to Exploit Basic Security Gaps
Executive Summary
The Panchan cryptomining worm, first identified in 2022, continues to propagate across internet-facing systems through SSH brute force attacks and stolen SSH keys. Written in Golang as a peer-to-peer botnet, Panchan employs a rootkit for persistence and leverages Discord channels for command-and-control communications. The worm creates hidden directories with high-entropy names, demonstrates unusual resource consumption, and spreads by stealing SSH credentials from infected systems to pivot to additional hosts listed in known_hosts files. Despite its rudimentary design and detection by multiple security vendors, Panchan remains effective against unpatched and poorly secured systems.
This incident highlights the persistent threat of legacy malware families that continue to exploit fundamental security weaknesses in SSH configurations and access controls, demonstrating how basic security gaps enable widespread compromise campaigns.
Why This Matters Now
Legacy cryptomining worms like Panchan exploit persistent SSH security gaps across internet-facing infrastructure, highlighting urgent needs for passwordless authentication, proper key management, and egress filtering to prevent lateral movement and resource theft.
Attack Path Analysis
The Panchan worm initially compromises systems through SSH brute force attacks against internet-facing servers. After gaining access, it steals SSH private keys and escalates privileges through rootkit installation. The malware performs lateral movement by pivoting to hosts in the victim's SSH known_hosts file using stolen credentials. It establishes command and control through Discord channels for peer-to-peer botnet communication. The worm exfiltrates SSH keys and credentials while deploying cryptocurrency mining payloads that consume system resources for financial gain.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Panchan worm exploits weak SSH credentials through brute force attacks against internet-facing SSH servers
MITRE ATT&CK® Techniques
Password Spraying
Remote Services: SSH
Unsecured Credentials: Private Keys
Dynamic Resolution: Domain Generation Algorithms
Protocol Tunneling
Resource Hijacking
Hide Artifacts: Hidden Files and Directories
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Multi-factor Authentication for Non-Console Access
Control ID: 8.2.1
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: 500.12
DORA – ICT Risk Management Framework
Control ID: Article 8
CISA ZTMM 2.0 – Asset Management - Privileged Access
Control ID: Identity.AM.L2
NIS2 Directive – Cybersecurity Risk Management
Control ID: Article 21.2(a)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
SSH-based cryptomining worm exploits weak authentication, steals keys, enabling lateral movement through IT infrastructure requiring enhanced egress filtering and zero trust segmentation.
Internet
Peer-to-peer botnet leverages Discord C2 channels, targets internet-facing SSH servers with brute force attacks, demanding intrusion prevention systems and secure hybrid connectivity.
Financial Services
Cryptocurrency mining malware threatens regulated environments through encrypted traffic exfiltration and lateral movement, violating compliance frameworks requiring anomaly detection and policy enforcement.
Computer Software/Engineering
Golang-based worm exploits software development environments via SSH key theft and privilege escalation, necessitating Kubernetes security and cloud firewall protection measures.
Sources
- Panchan's Mining Island [Guest Diary], (Wed, Oct 14th)https://isc.sans.edu/diary/rss/33426Verified
- New P2P Botnet Panchan - Akamai Security Researchhttps://www.akamai.com/blog/security-research/new-p2p-botnet-panchanVerified
- Cryptominer Anatomy Internals - Akamai Security Researchhttps://www.akamai.com/blog/security-research/cryptominer-anatomy-internalsVerified
- MITRE ATT&CK Frameworkhttps://attack.mitre.org/Verified
- Managing SSH Access at Scale with HashiCorp Vaulthttps://www.hashicorp.com/en/blog/managing-ssh-access-at-scale-with-hashicorp-vaultVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely constrain the Panchan worm's lateral movement and reduce its blast radius through network segmentation and controlled egress policies. The segmented architecture could limit SSH-based propagation between workloads and restrict unauthorized cryptocurrency mining communications.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Network segmentation and identity-aware access controls would likely limit the worm's ability to reach internal SSH servers from compromised perimeter systems
Control: Zero Trust Segmentation
Mitigation: Workload isolation policies would likely constrain the rootkit's ability to access privileged system resources and communicate across network segments during privilege escalation attempts
Control: East-West Traffic Security
Mitigation: Identity-scoped network policies would likely prevent unauthorized SSH connections between workloads, even when attackers possess valid stolen private keys for lateral propagation
Control: Multicloud Visibility & Control
Mitigation: Centralized visibility into cross-cloud communications would likely detect and constrain unauthorized Discord-based C2 traffic patterns across the distributed infrastructure environment
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policies would likely limit the worm's ability to transmit stolen SSH credentials and private keys to external command infrastructure or peer systems
Cryptocurrency mining operations would likely remain constrained to isolated network segments, reducing the overall scope of resource consumption and performance impact across the infrastructure
Impact at a Glance
Affected Business Functions
- Server Infrastructure Operations
- Compute Resource Management
- Network Security Monitoring
- SSH Remote Access Services
Estimated downtime: 3 days
Estimated loss: $15,000
SSH private keys, known_hosts files, system credentials, and potential lateral movement access to connected systems within the compromised network infrastructure
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to prevent SSH lateral movement by enforcing least privilege access policies and microsegmentation between systems
- • Deploy Egress Security & Policy Enforcement to block unauthorized outbound connections to Discord and other non-business platforms used for C2 communication
- • Enable East-West Traffic Security monitoring to detect suspicious SSH key usage and lateral movement patterns across internal networks
- • Establish Multicloud Visibility & Control to identify anomalous SSH connection patterns and repeated authentication failures across cloud environments
- • Implement Threat Detection & Anomaly Response capabilities to baseline normal SSH behavior and alert on credential theft activities and resource consumption spikes
