# SANS Analyzes Panchan Crypto-Mining Worm

Published: 2026-10-15 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/35ef14c6-c806-5d5f-a256-511288317a53/sans-analyzes-panchan-crypto-mining-worm

> SANS ISC guest diary details Panchan, a Golang P2P worm that steals SSH keys and mines crypto via Discord C2 on exposed Linux servers.

A SANS Internet Storm Center guest diary by Zachary Norwood examines a sample of the Panchan worm captured by a DShield honeypot. Panchan, first identified in 2022, is a Golang-based peer-to-peer cryptomining botnet that self-propagates by stealing SSH private keys from compromised hosts and pivoting to additional systems listed in the user's known_hosts file. It deploys a rootkit to maintain persistence and resist process termination. Analysis using Mandiant's FakeNet-NG and Wireshark revealed that this particular sample used a Discord channel as its command-and-control mechanism, and string analysis of the binary exposed its C2 channel and functional components with minimal effort, reflecting the malware's rudimentary but still effective design.

The worm primarily targets insecure, internet-facing systems with exposed SSH services lacking strong authentication controls. Indicators of compromise include repeated failed SSH authentication attempts, abnormal resource/CPU usage, unkillable processes, hidden high-entropy-named directories in home folders or /tmp, and regular outbound traffic to Discord. The author recommends mitigations including egress/ingress filtering, access control lists, SIEM-based log aggregation (via syslog/grep as a baseline), firewalls with IDS/IPS, disabling SSH root login and password authentication, enabling MFA, using HashKnownHosts, and leveraging short-lived SSH certificates (e.g., via HashiCorp Vault) to reduce the impact of credential theft.

This is not a new threat or zero-day; it is an educational writeup of an established worm (publicly documented since 2022 by Akamai) that continues to propagate due to widespread poor SSH hygiene and unpatched systems rather than any novel capability. Severity for defenders remains tied to basic SSH exposure hardening rather than urgent patching.

## Mentioned in this report

- Malware: Panchan

## Detection guidance (public sample)

### Linux Utility Reading SSH Private Keys or known_hosts

ATT&CK: T1552.004

Detects common Linux utilities reading SSH private keys or known_hosts on the command line, the credential and target harvesting that Panchan uses to spread over SSH. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Linux Utility Reading SSH Private Keys or known_hosts
description: Detects common Linux utilities (cat, grep, cp, scp, tar, base64 and similar)
  referencing SSH private key files or known_hosts. Panchan steals private keys and
  reads known_hosts to pivot to further hosts. Generalises on the access pattern,
  not on a specific binary name.
tags:
- attack.credential-access
- attack.t1552.004
- attack.lateral-movement
- attack.t1021.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
    - /cat
    - /grep
    - /cp
    - /scp
    - /tar
    - /base64
    - /xxd
    - /curl
    - /wget
  selection_target:
    CommandLine|contains:
    - .ssh/id_rsa
    - .ssh/id_dsa
    - .ssh/id_ecdsa
    - .ssh/id_ed25519
    - .ssh/known_hosts
  filter_backup:
    ParentImage|endswith:
    - /rsync
    - /borg
    - /restic
  condition: selection_img and selection_target and not filter_backup
falsepositives:
- Administrators manually inspecting or copying their own SSH keys and known_hosts
- Backup or configuration management scripts that archive the .ssh directory
level: medium
id: ffc9dcd2-e720-51e6-b12c-8f3a1e52ebcd
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33426
```

### Linux Process Connecting to Discord Domains

ATT&CK: T1071.001

Detects non-browser, non-Discord-client Linux processes connecting to Discord domains, consistent with Panchan using a Discord channel for C2. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Linux Process Connecting to Discord Domains
description: Detects outbound connections from Linux processes to Discord domains
  where the process is not a browser or the Discord client. The analysed Panchan sample
  used a Discord channel for C2, producing regular outbound traffic to Discord from
  a server host.
tags:
- attack.command-and-control
- attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationHostname|endswith:
    - discord.com
    - discordapp.com
    - discord.gg
    - discordapp.net
  filter_clients:
    Image|endswith:
    - /discord
    - /Discord
    - /firefox
    - /chrome
    - /chromium
    - /brave
    - /opera
    - /msedge
  condition: selection and not filter_clients
falsepositives:
- Chat or alerting bots on Linux servers that post to Discord webhooks
- Developer scripts or CI jobs that notify Discord channels
level: medium
id: 00e3d711-1efb-5810-9d27-dbaaaf804857
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33426
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://isc.sans.edu/diary/rss/33426

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/35ef14c6-c806-5d5f-a256-511288317a53/sans-analyzes-panchan-crypto-mining-worm.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup