- A SANS honeypot diary describes Panchan, a Go-based peer-to-peer crypto-mining worm first identified in 2022 that spreads by several means, including stealing SSH private keys.
- Stolen keys let the worm pivot to hosts in the victim's known_hosts file, so long-lived keys can widen the damage from one breach.
- Audit SSH keys, move to short-lived certificates, restrict public SSH access and watch for regular outbound Discord traffic from servers.
The most useful credential on a server is often one nobody remembers creating. An SSH key made years ago for a contractor, a backup job or a quick fix can sit unused and still work. The SANS diary behind this story says such keys are often created and forgotten, and that a worm called Panchan is designed to steal SSH private keys. The lesson here is that long-lived credentials can turn one compromised machine into a route to many.
An old worm that still works
The finding comes from a guest diary by Zachary Norwood, an intern in the SANS.edu BACS program, published by the SANS Internet Storm Center. A DShield honeypot, a decoy system built to attract attacks, received a malicious binary that was uploaded and executed. That binary was a copy of Panchan.
Panchan is written in Go and runs as a peer-to-peer botnet, so infected machines coordinate without one central server. It mines cryptocurrency. It spreads itself by a number of means, and stealing SSH keys is only one of them. It also uses a rootkit, which is software that hides an intruder, to keep its hold on infected systems.
The diary says the worm was first identified in 2022. Its author argues that attackers have had no reason to move on because the design is rudimentary and still effective. The diary does not say how many systems are infected today. It describes one sample from one honeypot.
How the SSH key theft works
SSH is the standard remote-login tool for servers. Many teams use key pairs instead of passwords. A private key stays with the user, and the matching public key sits on the server.
The diary says SSH private keys are something this worm is designed to steal. Once it has one, it tries to move to the hosts listed in the infected user's known_hosts file. That file records the servers the user has connected to. In effect, the victim's own history becomes a list of places to try next.
The diary also notes that key pairs are often created and forgotten about, and calls this a security concern. The diary does not say Panchan seeks out forgotten keys in particular. The point is that any stolen private key that still works can help the worm reach more hosts.
Making stolen keys worth less
The diary recommends several controls. Setting HashKnownHosts in the SSH configuration protects the data in known_hosts, so the file is harder to use as a map. Disabling password logins prevents brute-force guessing. Disabling root login over SSH, adding multi-factor authentication, and limiting access to specific IP addresses or a jump box shrink the exposed surface. Fail2Ban blocks addresses after repeated failed logins.
The deeper fix is to stop issuing keys that last. The diary points to HashiCorp Vault's signed SSH certificates. A user logs in to Vault and sends over a public key. Vault signs it and returns a certificate with a short expiry. Any host that trusts the Vault certificate authority accepts it. A stolen credential then expires quickly instead of lasting for years.
What gives it away
The author lists several signs of infection: repeated failed SSH logins, unusual resource use, and processes that cannot be killed. The worm also creates hidden directories in a user's home folder or in places like /tmp, often with random-looking names.
The strain in this sample used a Discord channel as its command-and-control server. To find that, the author ran the binary against FakeNet-NG, a Mandiant FLARE tool that simulates network services, and captured the traffic with Wireshark. For defenders, a server that contacts Discord on a regular schedule is a signal worth checking.
The author adds that searching logs with syslog and grep can reveal privilege escalation, software changes and SSH access. That approach does not scale, so the diary recommends a SIEM, a system that collects and searches logs in one place.
Questions for your team
First, how many SSH keys exist across our servers, who owns each one, and when was each last used? Second, can we move to short-lived certificates, and by when? Third, do our servers have any reason to contact Discord, and would we notice if they did? Fourth, is SSH open to the public internet, and if so, does it have multi-factor authentication and an access list?
Panchan is not new, and it does not need to be. The diary says many systems remain insecure and unpatched, which is why the worm still spreads. A key that expires before anyone can reuse it is a strong answer to that problem.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: SANS Internet Storm Center.
