Coordinated SSH Brute Force Attacks: Recent Trends and Patterns

Campaign or TTP Overview

In recent months, the cybersecurity landscape has witnessed a surge in sophisticated coordinated SSH brute force attacks. According to a SANS ISC analysis, these attacks have increased in frequency and intensity, particularly targeting exposed SSH services. Large-scale botnets are used to carry out these assaults, coordinating multiple IP addresses to bombard a single SSH endpoint with a deluge of login attempts.

During this period, targets have predominantly been organizations with publicly accessible SSH services. The attacks were relentless, often circumventing rate limit defenses by cycling through IP addresses and leveraging compromised machines worldwide. The geographic spread of attacking IPs suggests a highly mature infrastructure leveraging hijacked or wrongful access to resources. This escalation reflects an adaptability in attacker TTPs, designed to bypass increasingly sophisticated defensive measures.

How It Was Built

Central to the recent attack campaign’s infrastructure were large-scale botnets comprised of thousands of compromised hosts. Each node in the botnet executes a fraction of the total attack workload. This disperses the attack vector, effectively masking any single IP with suspicious activity. These nodes were strategically orchestrated through decentralized command and control servers which manipulated the targets and methods dynamized overtime to evade detection.

The delivery mechanism deployed by the attackers relied on dynamic IP cycling, whereby multiple IP addresses rotate through attack rotations, making rate-limiting and blocking less effective. Custom scripts automated the brute force sequences, trying common password variants across multiple user accounts. The following payload configuration is typically used:


#!/bin/bash

for user in admin root user; do

  for password in password123 admin@123 root123; do

    echo "Attempting login: $user / $password"

    sshpass -p "$password" ssh -o StrictHostKeyChecking=no $user@target_ip

  done

done

Key to this setup was the precise timing of the attacks, which were often synchronized with known user activity downtime, such as weekends or late nights, increasing the chances of successful unauthorized access without immediate detection.

Why It Worked

The effectiveness of this campaign can be attributed to several strategic decisions made by the threat actors. Persistent IP cycling allowed attackers to avoid triggering standard defense mechanisms that relied on recognizing repetitive access attempts from single IP sources. Each IP only engaged for a calculated number of tries before cycling out, thus flying beneath typical detection thresholds.

Moreover, the attackers exploited vulnerabilities in SSH configurations, particularly where default credentials or weak passwords were in place. By using a vast list of common password combinations and scripts to automate these, the attackers increased their success rate exponentially against improperly secured systems.

Finally, the use of a decentralized command structure made their activities resilient to shutdown efforts. This resilience enabled them to maintain a high level of attack persistence, ensuring a continuous flow of brute force attempts over a prolonged period.

Operator Takeaways

For red teamers, this campaign offers valuable insights into optimizing brute force methodologies. Emulating the IP cycling strategy can help bypass defense measures in penetration tests. Consider utilizing automation to script rotations among multiple IP addresses and attack vectors. Additionally, leveraging common credential lists enhances the ability to probe and stretch the limits of target security configurations.

Utilizing compromised infrastructures or simulated botnets can effectively mimic the attacker’s broad distributed attack model, providing a comprehensive test environment to identify possible entry points in client defenses.

Good / Better / Best

Good: Employ basic IP cycling techniques to moderate detection by security systems, aiming for minimal traceability.
Better: Automate the entire process with sophisticated scripts that handle user rotation, timing, and error-handling during login attempts.
Best: Integrate dynamic, decentralized operational command systems, mimicking real attacker’s resilience and endurance to evaluate long-term effectiveness of security controls.