GSocket Backdoor Delivered Through Bash Script, (Fri, Mar 20th)
2026-03-22T01:23:43Z•fe0645f2e96ef4234d5dfd55763d07faa44be8673daaa6608b2043ea29baed26
GSocketIOCIPv4-mapped-IPv6adminerbackdoorbash scriptcowriehoneypotiranbotnetwork reconnaissancephpmyadminproxy abusescanningtelnet
What happened
SANS ISC diary entries (mid‑March 2026) report several security observations: a malicious Bash script was found that installs a GSocket backdoor on a compromised host (delivery vector unknown); honeypot/cowrie logs show activity from IP 64.89.161.198 including port scans, a successful Telnet login and a distinct payload string referencing "MAGIC_PAYLOAD_KILLER...iranbot..."; widespread opportunistic scanning for web admin panels (phpMyAdmin/adminer) and /proxy/ URL abuse to find open proxies; and use of IPv4‑mapped IPv6 addresses observed in attacker requests, possibly to obfuscate source. The
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- fe0645f2e96ef4234d5dfd55763d07faa44be8673daaa6608b2043ea29baed26
- Enrichment time
- 2026-03-22T01:23:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.