SANS Analyzes Panchan Crypto-Mining Worm
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
SANS ISC guest diary details Panchan, a Golang P2P worm that steals SSH keys and mines crypto via Discord C2 on exposed Linux servers.
A SANS Internet Storm Center guest diary by Zachary Norwood examines a sample of the Panchan worm captured by a DShield honeypot. Panchan, first identified in 2022, is a Golang-based peer-to-peer cryptomining botnet that self-propagates by stealing SSH private keys from compromised hosts and pivoting to additional systems listed in the user's known_hosts file. It deploys a rootkit to maintain persistence and resist process termination. Analysis using Mandiant's FakeNet-NG and Wireshark revealed that this particular sample used a Discord channel as its command-and-control mechanism, and string analysis of the binary exposed its C2 channel and functional components with minimal effort, reflecting the malware's rudimentary but still effective design.
The worm primarily targets insecure, internet-facing systems with exposed SSH services lacking strong authentication controls. Indicators of compromise include repeated failed SSH authentication attempts, abnormal resource/CPU usage, unkillable processes, hidden high-entropy-named directories in home folders or /tmp, and regular outbound traffic to Discord. The author recommends mitigations including egress/ingress filtering, access control lists, SIEM-based log aggregation (via syslog/grep as a baseline), firewalls with IDS/IPS, disabling SSH root login and password authentication, enabling MFA, using HashKnownHosts, and leveraging short-lived SSH certificates (e.g., via HashiCorp Vault) to reduce the impact of credential theft.
This is not a new threat or zero-day; it is an educational writeup of an established worm (publicly documented since 2022 by Akamai) that continues to propagate due to widespread poor SSH hygiene and unpatched systems rather than any novel capability. Severity for defenders remains tied to basic SSH exposure hardening rather than urgent patching.
Mentioned in this report
Detection guidance
Linux Utility Reading SSH Private Keys or known_hosts
Detects common Linux utilities reading SSH private keys or known_hosts on the command line, the credential and target harvesting that Panchan uses to spread over SSH. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux Utility Reading SSH Private Keys or known_hosts
description: Detects common Linux utilities (cat, grep, cp, scp, tar, base64 and similar)
referencing SSH private key files or known_hosts. Panchan steals private keys and
reads known_hosts to pivot to further hosts. Generalises on the access pattern,
not on a specific binary name.
tags:
- attack.credential-access
- attack.t1552.004
- attack.lateral-movement
- attack.t1021.004
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith:
- /cat
- /grep
- /cp
- /scp
- /tar
- /base64
- /xxd
- /curl
- /wget
selection_target:
CommandLine|contains:
- .ssh/id_rsa
- .ssh/id_dsa
- .ssh/id_ecdsa
- .ssh/id_ed25519
- .ssh/known_hosts
filter_backup:
ParentImage|endswith:
- /rsync
- /borg
- /restic
condition: selection_img and selection_target and not filter_backup
falsepositives:
- Administrators manually inspecting or copying their own SSH keys and known_hosts
- Backup or configuration management scripts that archive the .ssh directory
level: medium
id: ffc9dcd2-e720-51e6-b12c-8f3a1e52ebcd
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33426
Linux Process Connecting to Discord Domains
Detects non-browser, non-Discord-client Linux processes connecting to Discord domains, consistent with Panchan using a Discord channel for C2. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux Process Connecting to Discord Domains
description: Detects outbound connections from Linux processes to Discord domains
where the process is not a browser or the Discord client. The analysed Panchan sample
used a Discord channel for C2, producing regular outbound traffic to Discord from
a server host.
tags:
- attack.command-and-control
- attack.t1071.001
logsource:
category: network_connection
product: linux
detection:
selection:
DestinationHostname|endswith:
- discord.com
- discordapp.com
- discord.gg
- discordapp.net
filter_clients:
Image|endswith:
- /discord
- /Discord
- /firefox
- /chrome
- /chromium
- /brave
- /opera
- /msedge
condition: selection and not filter_clients
falsepositives:
- Chat or alerting bots on Linux servers that post to Discord webhooks
- Developer scripts or CI jobs that notify Discord channels
level: medium
id: 00e3d711-1efb-5810-9d27-dbaaaf804857
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33426
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33426
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs