Malicious Go Module Exploits SSH Brute-Force to Exfiltrate Credentials via Telegram
HighWhat happened
A malicious Go module, "golang-random-ip-ssh-bruteforce," masquerades as an SSH brute-force tool but covertly exfiltrates successful login credentials to an attacker-controlled Telegram bot.
Who is affected
Organizations and individuals using the "golang-random-ip-ssh-bruteforce" module are at risk of unauthorized credential exposure.
Why it matters
The module's deceptive nature and credential exfiltration pose significant security risks, potentially leading to unauthorized access and data breaches.
How it could have been prevented
- Avoid using unverified or untrusted software modules. - Regularly audit and monitor software dependencies for malicious code.
Relevant professional terms
- SSH (Secure Shell)
- A protocol used to securely access and manage network devices and servers over an unsecured network.
- Brute-Force Attack
- A trial-and-error method used to obtain information such as passwords by systematically trying all possible combinations.
Recommended reading: Rogue npm Packages Mimic Telegram Bot API to Plant SSH Backdoors on Linux Systems
Source: thehackernews.com