As cited
Copy frozen at (site build).
threat intel
Panchan's Mining Island [Guest Diary]
Panchan is a Golang-based peer-to-peer botnet and crypto mining worm first identified in 2022 that continues to propagate through internet-facing systems by stealing SSH keys, leveraging rootkits for persistence, and using Discord as a command-and-control channel. The threat primarily affects unpatched and insecure systems with exposed SSH ports, and can be detected through indicators such as multiple failed SSH authentication attempts, unusual resource consumption, and outbound connections to Discord. Mitigation strategies include egress and ingress filtering, passwordless authentication, security information and event management (SIEM) monitoring, SSH key hardening with short-lived certificates, and access control lists restricting SSH to specific IP addresses or jump boxes.
Why it matters: Organizations operating internet-facing SSH services on unpatched systems face immediate risk of compromise, lateral movement, and resource hijacking by Panchan; practitioners should prioritize SSH hardening, access restrictions, and detection rules for unusual authentication patterns and resource usage.
- Source published
- First seen by Cybersecurity Tracker