SSH botnets track geopolitical events, advisories
A DShield honeypot logged over 20 million SSH brute-force attempts across 100 days, showing coordinated botnet activity spiking in response to CISA advisories and Middle East tensions.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
A DShield honeypot operated from February through May 2026 captured over 20 million SSH brute-force login attempts, revealing patterns of coordinated botnet activity that appeared to correlate with external events. The data shows baseline activity spiking over 2100% following CISA Emergency Directive 26-03 on Cisco SD-WAN vulnerabilities, and peaking at over 300,000 attempts per day during escalating Iran-Israel-US tensions in early March. Attack volumes remained elevated through mid-April before declining as geopolitical tensions eased.
Analysis of the top ten probing IP addresses revealed strong geographic and ASN clustering, with multiple attacks exhibiting identical HASSH fingerprints and SSH client versions occurring within seconds across different countries and ASNs. Over 702,000 events shared the same HASSH fingerprint (03a80b21afa810682a776a7d42e5e6fb), indicating use of a globally-deployed attack toolkit. The data also showed evidence of botnet quota assignment through throttled, uniform scan rates characteristic of programmed botnet operations.
The research demonstrates that threat actors rapidly adapt their SSH brute-force campaigns to capitalize on vulnerability disclosures and geopolitical events. The vast majority of attempts targeted the root user, and simple mitigations such as disabling root login, enforcing MFA, using SSH key authentication, and changing default ports would have prevented most observed attacks.
Detection guidance
2 detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Microsoft Defender XDR KQL, YARA, or Suricata as well. Free account, no card.
Source reporting: https://isc.sans.edu/diary/rss/33086
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs