S0487 Kessel

malwareEnterprise

platformsLinux

also known asKessel

Kessel is an advanced version of OpenSSH which acts as a custom backdoor, mainly acting to steal credentials and function as a bot. Kessel has been active since its C2 domain began resolving in August 2018.

techniques used (14)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1027.013Encrypted/Encoded File
T1030Data Transfer Size Limits
T1041Exfiltration Over C2 Channel
T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
T1059Command and Scripting Interpreter
T1082System Information Discovery
T1090Proxy
T1105Ingress Tool Transfer
T1132.001Standard Encoding
T1140Deobfuscate/Decode Files or Information
T1554Compromise Host Software Binary
T1556Modify Authentication Process
T1560Archive Collected Data

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan