Panchan Worm Continues to Spread by Stealing SSH Keys and Using Rootkits
The Panchan worm, a peer-to-peer crypto mining malware first identified in 2022, remains an active threat, propagating by stealing SSH keys and employing rootkits for persistent access.
The Panchan worm, a peer-to-peer crypto mining malware that first surfaced in 2022, continues to pose a significant threat to internet-facing servers. Its propagation methods are particularly concerning, as it actively steals SSH keys from infected systems and utilizes rootkits to maintain persistent access, making it difficult to remove.
Written in Golang, Panchan operates as a peer-to-peer botnet, meaning infected machines communicate directly with each other rather than relying on a central command and control (C2) server. This decentralized architecture makes it more resilient to takedown efforts. The malware's continued effectiveness stems from its rudimentary yet efficient design, which has allowed threat actors to maintain its use without significant updates.
A recent analysis of a Panchan binary obtained from a DShield honeypot revealed its operational details. Security researchers used tools like FakeNet-NG and Wireshark to simulate network traffic and capture communications. This analysis confirmed that a specific strain of the Panchan worm leverages a Discord channel as its command and control infrastructure, a tactic that can be harder to detect than traditional C2 servers.
Defending against Panchan requires a multi-layered security approach. Essential measures include robust egress and ingress filtering, strict access control lists (ACLs), continuous network monitoring, and secure authentication methods. Disabling direct root SSH logins, implementing multi-factor authentication (MFA) for SSH, and utilizing SSH key pairs instead of passwords are critical steps. Furthermore, enabling the HashKnownHosts option in SSH configurations and employing short-lived SSH certificates signed by a trusted Certificate Authority (CA), such as through HashiCorp Vault, can significantly mitigate the risk of SSH key theft and reuse.
Beyond access controls, effective threat detection and response are vital. Analysts can leverage system logs, particularly those generated by syslog, to identify suspicious activities such as repeated failed SSH login attempts, privilege escalation, unexpected software installations, or unusual network connections. While manual log analysis is possible, it does not scale well for large environments. Therefore, integrating these logs into a Security Information and Event Management (SIEM) system is crucial for efficient and scalable monitoring.
Typical indicators of compromise (IOCs) associated with the Panchan worm include a surge in failed SSH authentication attempts, unusually high resource utilization on infected systems, and processes that are resistant to termination. The malware often creates hidden directories within user home directories or temporary folders like /tmp to conceal its presence.
Organizations that have internet-facing servers, especially those with exposed SSH ports, are particularly vulnerable. The worm's ability to pivot through stolen SSH keys means that a single compromised machine can lead to the lateral movement of the malware across an organization's network. Proactive security measures and vigilant monitoring are key to preventing and detecting Panchan infections.
The continued prevalence of Panchan underscores the ongoing threat posed by commodity malware that exploits basic security weaknesses. Its reliance on stolen credentials and rootkits highlights the importance of fundamental security hygiene, including strong password policies, secure configuration management, and timely patching, to prevent such threats from gaining a foothold.