Panchan's Mining Island [Guest Diary], (Wed, Oct 14th)
SANS analyzes Panchan, a Golang cryptomining worm that still spreads by stealing SSH keys.
A SANS Internet Storm Center guest diary analyzes Panchan, a Golang peer-to-peer cryptomining worm first identified in 2022 and still seen on a DShield honeypot. After access, it steals SSH private keys, pivots to hosts listed in known_hosts, and uses a rootkit for persistence. Dynamic analysis with FakeNet-NG showed this sample using a Discord channel for command and control. The diary recommends locked-down public SSH, MFA, Fail2Ban, hashed known_hosts, short-lived certificates, firewalls, and SIEM monitoring.
- Panchan is a Golang peer-to-peer cryptomining worm first identified in 2022.
- A DShield honeypot captured a binary that spreads and steals SSH private keys.
- It pivots using known_hosts, installs a rootkit, and used Discord for command and control.
- Defenses cited include MFA, key-based SSH, Fail2Ban, hashed known_hosts, and short-lived certificates.
- ATT&CK
- T1110 Brute ForceT1021.004 Remote Services: SSHT1552.004 Unsecured Credentials: Private KeysT1014 RootkitT1496 Resource Hijacking
- Products
- SSH
- Malware
- Panchan
- Organizations
- SANS Internet Storm Center
From the original article
5 min read at isc.sans.edu
[This is a Guest Diary by Zachary Norwood, an ISC intern as part of the SANS. edu BACS program]
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.