SSHStalker Botnet Uses IRC C2 to Control Linux Systems via Legacy Kernel Exploits
SSHStalker Botnet Uses IRC C2 to Control Linux Systems via Legacy Kernel Exploits
11 February 2026
Cybersecurity researchers have disclosed details of a new botnet operation called SSHStalker that relies on the Internet Relay Chat (IRC) communication protocol for command-and-control (C2) purposes.
"The toolset blends stealth helpers with legacy-era Linux exploitation: Alongside log cleaners (utmp/wtmp/lastlog tampering) and rootkit-class artifacts, the actor keeps a large back-catalog of