Threat Spotlight: SSHPsychos
Summary: Cisco Talos tracked a group it calls SSHPsychos, or Group 93, which since June 2014 ran SSH brute-force attacks from two class C networks, 103.41.124.0/23, trying over 300,000 unique passwords against the root user only. After a successful login, the group downloaded a DDoS rootkit from U.S. shared-hosting addresses and pulled XOR-encoded instructions from command-and-control servers; on March 30 the original network went quiet and a new /23, 43.255.190.0/23, took over the same behavior, prompting Talos and Level 3 to remove routes for both blocks.
Why it matters: Two netblocks generated more SSH login traffic than the rest of the Internet combined, and when Level 3 moved to take one down the group shifted to a fresh /23 within the same day - so blocking a single range buys time, not closure.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026