Executive Summary
Bonadan is an SSH impersonation backdoor targeting Linux servers that covertly mines cryptocurrency and steals credentials by exploiting legitimate OpenSSH flows. Its dual functionality enables attackers to profit from mining while compromising authentication data for lateral movement or phishing. Detection and mitigation require scrutinizing unusual OpenSSH processes, monitoring excessive CPU usage, and blocking unauthorized credential exfiltration.
Enhanced Description
Bonadan is a Linux‑based backdoor that masquerades as a legitimate OpenSSH server to evade detection by appearing as trusted infrastructure. First observed in 2018, the malware replaces or injects itself into the OpenSSH service, maintaining low visibility while listening for remote commands over standard SSH ports. Once connected, it can execute arbitrary shell commands, exfiltrate data, and persist through system reboots. In addition to acting as a stealthy command‑and‑control agent, Bonadan includes two key malicious modules. The first is a cryptocurrency–mining component that exploits CPU resources to mine coins such as Monero; this module drains system performance and can elevate the attacker’s revenue. The second module is a credential‑stealing payload closely related to those found in the Onderon family of backdoors, harvesting user credentials from SSH login attempts or local authentication files before forwarding them to remote egress points. Together, these capabilities allow attackers to conduct illicit background operations while quietly siphoning system resources and compromising identities. The combination of legitimate service impersonation, stealthy persistence, ransomware‑like exfiltration of credential data, and covert cryptocurrency mining makes Bonadan a multi‑faceted threat that can be leveraged for espionage, financial gain, or as part of a larger botnet. The use of OpenSSH as a delivery vector also enhances the attack’s stealth by utilizing encrypted traffic over expected ports, complicating detection efforts.
Key Capabilities
ATT&CK Techniques
Recommended Actions
Suggested Tags
Confidence Assessment
The data originates from a single vendor report with limited sample detail, providing basic functional description but lacking in‑depth technical analysis or evidence of widespread deployment. Confidence is moderate regarding core behaviors (OpenSSH masquerading, mining, credential theft) but uncertain about persistence mechanisms, scope, and full threat impact.
Bonadan is a malicious version of OpenSSH which acts as a custom backdoor. Bonadan has been active since at least 2018 and combines a new cryptocurrency-mining module with the same credential-stealing module used by the Onderon family of backdoors.(Citation: ESET ForSSHe December 2018)