As cited
Copy frozen at (site build).
threat intel
Reconnaissance First: An SSH Bot That Sizes Up Your Hardware Before Deploying a Miner [Guest Diary]
A honeypot logged an SSH session where a bot from IP 91.92.40.13 performed hardware reconnaissance by querying CPU cores, CPU model, GPU presence (specifically NVIDIA), RAM amount, and system uptime before disconnecting without deploying any payload. The bot's queries and structured output format indicate it was grading the target machine to determine whether a cryptomining payload would be profitable before sending one. The reconnaissance-first pattern demonstrates a more deliberate attack strategy than typical mass exploitation bots, requiring defenders to recognize that information-gathering sessions without visible payloads still represent active targeting and malicious intent.
Why it matters: Network defenders and honeypot operators should recognize reconnaissance-only SSH sessions as indicators of cryptomining or resource-hijacking campaigns rather than failed attacks, since adversaries now filter targets based on hardware specifications before deploying resource-intensive payloads, making early detection of these survey activities important for understanding attacker methodology and network compromise risk.
- Source published
- First seen by Cybersecurity Tracker