The Behavior of Coordinated SSH Brute Force Attacks over the last three months [Guest Diary]
by Adam Nason, SANS.edu BACS Student (Version: 1)
[This is a Guest Diary by Adam Nason, an ISC intern as part of the SANS.edu BACS program]
Brute force SSH attacks are an ever-present threat on the internet today. We examine probing behavior over the last three months to identify coordinated and opportunistic attacks by threat actors. A DShield Honeypot has quietly collected and logged the behavior of these threat actors to develop a clearer picture of their malicious intentions. During the log collection period, several significant cyber and geopolitical events occurred. We will take a closer look at these behaviors by analyzing their timing and cross-referencing them with external factors that align with their attack patterns. Can an increase or change in SSH brute force botnet activity be observed during these volatile times?
Infrastructure Setup and Data Collection Framework – Home Lab
Infrastructure
• Raspberry Pi 4 Model B
• Network Equipment – Isolated from personal home network
o UniFi Security Gateway Pro
o UniFi 24 Port Switch
Data Ingestion
• RaspberryOS running on Raspberry Pi
• DShield Honeypot Software
o Logs Collected: 17 Feb 2026 through 26 May 2026
Software Tools
• Elasticsearch, Logstash, Kabana (ELK)
• Microsoft VS Code (JSON and Python)
• Microsoft Excel
Data Analysis of Honeypot Logs
Scanning Volume and Timeline Overview
The cowrie honeypot logs recorded over 20 million SSH brute-force attempts over the past 100 days. Investigation into the scanning trends appears to be closely correlated with Chinese botnets, major law enforcement actions, geopolitical events, and critical cybersecurity advisories released in the first half of 2026. As shown in Figure 1: Daily Brute Force Probing Totals, the timeline shows extended periods of high-volume traffic, with abrupt spikes and drops that seem to align with external events.
Table 1: Overview of SSH data collected
Figure 1: Daily Brute Force Probing Totals
Notable events within the brute force scan timeline
February 17 – 24 (Initial Baseline)
The first week of running the honeypot produced what can be considered a quiet baseline of standard background scanning activity. During this period, between 200 and 400 attempts were captured each day.
February 25 – 28 (Sudden Surge)
Following a quiet start, a spike of over 2100% attempts was observed by the honeypot. It was during this period that CISA published Emergency Directive 26-03 (CISA, 2026), related to Cisco’s software-defined wide-area network, which led to opportunistic attacks against unpatched systems. Additional probing was observed during this period, which can also be attributed to the rising conflict between Iran, Israel, and the United States (Al Jazeera, 2026).
March 1 – 8 (Activity Peaks)
Scanning observations peaked this week, with over 300,000 events collected on March 8th (Radauskas, 2026). This is as tensions continue to rise between Iran, Israel, and the United States, and both advanced persistent threats and opportunistic botnets are becoming more active (Reuters, 2026).
March 9 – April 14 (Sustained Attacks)
The honeypot continues to collect and log a high volume of activity during this period, with daily probes remaining above 50,000, often exceeding 100,000 (Le Poidevin, 2026). The periodic spikes and dips tend to lean towards automated attack campaigns.
April 15 (Rapid Decline)
Attack observations plummet to just over 23,000 attempts logged by the honeypot.
April 16 – May 14 (Attack Rebounds)
With news of new vulnerabilities (CISA, 2026), and tensions growing with the Iran-United States ceasefire, logged scans start to rise again. A second spike is observed on May 2nd with 244,344 probes in a single day. This comes just after 24 hours following a major Linux vulnerability that was published by CISA (CISA, 2026)
May 15 – 23 (Extended Decline)
Daily log observations drop nearly 95%, as the ceasefire extends (Madhani et al., 2026), and opportunistic threat actors lose interest as the Iran, Israel, and United States war continues to drag on with minimal active military engagements.
Top 10 Identified Probing IPs (Patterns, Clusters, and Campaign Data)
From February 2026 through May 2026, the top ten observed IP addresses (Table 2) appeared to have strong geographic and Autonomous System Number (ASN) clustering. Both DigitalOcean (ASN – AS14061) and M247 (ASN – AS9009) show activity from multiple countries (Table 3). Furthermore, synchronized scanning bursts can be observed using identical SSH client fingerprints and version strings, occurring within minutes of each other across different countries.
Table 2: Top Ten Probing IPs, with Country and ASN
Table 3: Country Clustering of IPs and ASN
A closer review of the data shows an example of what appears to be synchronized scanning. Over the course of 53 seconds, two attacks are observed from both the United States and Ukraine. Of note, both attacks exhibit the same HASSH fingerprint. HASSH is a fingerprinting standard developed by the Detection Cloud team at Salesforce and is used to detect attacks with higher granularity than a simple IP address can (Reardon, 2022). Seeing the same HASSH, SSH Version, from two different ASNs and countries does point to a high likelihood of a coordinated attack.
Table 4: Clustered attack within 53-seconds
Further review of the collected honeypot logs shows that 702,706 events use the exact same HASSH fingerprint (03a80b21afa810682a776a7d42e5e6fb) and SSH version, indicating the use of a single managed attack toolkit that has been deployed globally (SSHwatch, 2025).
Finally, a detailed review of the logs shows evidence of a botnet quota assignment (Table 5). These are throttled scan rates, which are tell-tale indicators of a botnet-driven SSH campaign. Reviewing the logs over such extended periods shows a low variation and high uniform attack rates, which point to a controller assigning quotas or workloads to the botnet zombies under its control. Automating a scan in this type of organization has been shown to be a characteristic of these types of programmed botnet operations (Sing et al., 2024 p. 1731-1750).
Table 5: Attack Rate Analysis of IPs showing Automated Campaigns
Reduce your Attack Surface
As we have seen above, networks are under constant attack, which seems to follow the ebb and flow of external events on digital cyberspace. However, there are several steps you can take to reduce your attack surface, most of which require little effort. Strategies like IP blocks, geo-blocking, and changing default values can go a long way in preventing a potential compromise.
Prevention
• While not specifically noted in this paper, a majority of SSH brute force login attempts observed targeted the user ‘root’. Disabling ‘root’ user login would effectively make all those attack attempts obsolete.
• Enforce Multi-Factor Authentication (MFA).
• Use private keys for SSH, provided they are properly protected, rotated, and audited.
• Properly hardened jump boxes to reduce exposure and enable session monitoring with Security Information and Event Management (SIEM) systems.
(Hartman, 2026)
Detection
• Centralized SIEM Log Collection
• Deploy rules to alert to brute force patterns in platforms like Snort or Suricata. This can include ‘SYN Flood Attacks’ against port 22 (or your SSH port if you change the default value).
(Hartman, 2026)
Conclusion
Over 20 million SSH brute force attempts were collected by my DShield honeypot over nearly 100 days. This data was compared with several major cybersecurity advisories, changing geopolitical tensions, and law enforcement activities, which uncovered a close alignment. The top probing IPs showed clear signs of SSH botnet attack campaigns when evaluating the log data for attack timing, rates, HASSH fingerprints, and SSH client identification. These findings help to illustrate the adaptability and persistence of threat actors as they respond to capitalize on external events, highlighting the underlying need of all connected devices to be aware not only of cybersecurity-related advisories but also of the activities taking place across the globe. Some of the simplest security measures would have stopped many of these attacks in their tracks, raising the persistent need to continue to remind users to change default settings (usernames and ports) and increase the use of MFA.
Have you observed similar activities in your honeypot or within your organization? Feel free to share your findings and experiences in the comments below or consider joining the SANS Internet Storm Center and contributing data to their global network of sensors and honeypots.
[1] Al Jazeera. (2026, February 28). US, Israel bomb Iran: A timeline of talks and threats leading up to attacks. https://www.aljazeera.com/news/2026/2/28/us-israel-bomb-iran-a-timeline-of-talks-and-threats-leading-up-to-attacks#:~:text=US%2C%20Israel%20bomb%20Iran%3A,since%20the%20June%202025
[2] CISA. (2026, February 25). ED 26-03: Mitigate vulnerabilities in Cisco SD-WAN systems. Cybersecurity and Infrastructure Security Agency CISA. https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems
[3] CISA. (2026, May 1). CISA adds one known exploited vulnerability to catalog. Cybersecurity and Infrastructure Security Agency CISA. https://www.cisa.gov/news-events/alerts/2026/05/01/cisa-adds-one-known-exploited-vulnerability-catalog
[4] CISA. (2026, April 20). CISA adds eight known exploited vulnerabilities to catalog. Cybersecurity and Infrastructure Security Agency CISA. https://cisa.gov/news-events/alerts/2026/04/20/cisa-adds-eight-known-exploited-vulnerabilities-catalog
[5] Hartman, K. G. (2026, February 13). Securing SSH keys in cloud environments: Practical guidance for security, forensics, and legal accountability. SANS Institute. https://www.sans.org/blog/securing-ssh-keys-cloud-environments-practical-guidance-security-forensics-legal-accountability
[6] Le Poidevin, O. (2026, March 9). UAE envoy to UN urges de-escalation of US-Israeli war with Iran. reuters.com. https://www.reuters.com/world/middle-east/uae-envoy-un-urges-de-escalation-us-israeli-war-with-iran-2026-03-09/#:~:text=UAE%20envoy%20to%20UN,and%20a%20return%20to
[7] Madhani, A., Gambrell, J., Price, M., & Metz, S. (2026, May 29). US and Iranian negotiators reach tentative deal to extend ceasefire and start new nuclear talks. AP News. https://apnews.com/article/iran-us-war-oil-may-28-2026-8f5ed2813ba63df7ae9ccbe991688d29
[8] Radauskas, G. (2026, March 3). Wild pack without a leader: pro-Iranian hackers already active in wake of US-Israeli strikes. Cybernews. https://cybernews.com/security/iran-war-cyberattacks-hacking/
[9] Reardon, B. (2022, April 14). Open sourcing HASSH. Salesforce Engineering Blog. https://engineering.salesforce.com/open-sourcing-hassh-abed3ae5044c/
[10] Reuters. (2026, February 28). Global reaction to US, Israeli attacks on Iran. reuters.com. https://www.reuters.com/business/aerospace-defense/global-reaction-israeli-us-attacks-iran-2026-02-28/#:~:text=Global%20reaction%20to%20US%2C,into%20a%20renewed%20military
[11] Singh, S. K., Gautam, S., Cartier, C., Patil, S., & Ricci, R. (2024). Where The Wild Things Are: Brute-Force SSH Attacks In The Wild And How To Stop Them. USENIX Association, 1731-1750. https://www.usenix.org/conference/nsdi24/presentation/singh-sachin
[12] SSHwatch. (2025, April 28). SSH honeypots: Detecting and understanding attack patterns. https://www.sshwatch.com/ssh-honeypots-detecting-and-understanding-attack-patterns/#:~:text=Distributed%20credential%20partitioning%2C%20wordlist,logs%20with%20tools%20like
[13] https://www.sans.edu/cyber-security-programs/bachelors-degree/
Note: To ensure full transparency and academic integrity, generative A.I. software (Grammarly) was used for grammar and spelling checks. No further use of generative A.I. was used in the creation of this writing.
Guy Bruneau IPSS Inc.
My GitHub Page
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu
Comments
Facts Only
A DShield honeypot logged over 20 million SSH brute-force attempts between February 17 and May 26, 2026.
The honeypot was deployed on a Raspberry Pi 4 Model B, isolated from the personal home network.
Initial baseline activity (February 17–24) recorded 200–400 daily attempts.
A 2100% surge in attempts occurred between February 25–28, coinciding with CISA's Emergency Directive 26-03 and escalating Iran-Israel-U.S. tensions.
Peak activity reached over 300,000 attempts on March 8, 2026.
Sustained high-volume attacks (50,000–100,000 daily) persisted from March 9 to April 14.
A rapid decline to 23,000 attempts occurred on April 15.
Attacks rebounded between April 16 and May 14, peaking at 244,344 attempts on May 2.
Daily attempts dropped by nearly 95% from May 15–23, aligning with a U.S.-Iran ceasefire.
Top probing IPs showed clustering by ASN (e.g., DigitalOcean AS14061, M247 AS9009) and country.
Synchronized attacks using identical HASSH fingerprints were observed across different countries within minutes.
A single HASSH fingerprint (03a80b21afa810682a776a7d42e5e6fb) appeared in 702,706 events, indicating a globally deployed attack toolkit.
Evidence of botnet quota assignments was identified through uniform attack rates and throttled scan patterns.
Executive Summary
Over a 100-day period from February to May 2026, a DShield honeypot recorded over 20 million SSH brute-force attempts, revealing patterns correlated with geopolitical events, cybersecurity advisories, and botnet activity. The initial baseline showed 200-400 daily attempts, but a sudden surge of over 2100% occurred in late February, coinciding with CISA's Emergency Directive 26-03 and escalating tensions between Iran, Israel, and the U.S. Activity peaked in early March, with over 300,000 attempts on March 8th, before stabilizing at high volumes until mid-April. A rapid decline followed on April 15, but attacks rebounded in May after new vulnerabilities were disclosed. The top probing IPs exhibited clustering by ASN and country, with synchronized attacks using identical HASSH fingerprints, suggesting coordinated botnet campaigns. The analysis highlights the adaptability of threat actors to external events and underscores the need for basic security measures like disabling root login, enforcing MFA, and using private keys.
The findings align with prior research on brute-force SSH attacks, confirming the persistence of botnets and their responsiveness to geopolitical and cybersecurity developments. While the data provides valuable insights, the study's reliance on a single honeypot and the absence of broader network comparisons may limit generalizability. The authors advocate for proactive defense strategies, emphasizing that simple security practices could mitigate many observed threats.
Full Take
This analysis of SSH brute-force attacks over three months offers a compelling case study in how cyber threats adapt to geopolitical and technical triggers. The strongest version of this narrative is its demonstration of clear correlations between attack volumes and external events—CISA advisories, geopolitical conflicts, and vulnerability disclosures. The methodology is robust for a single-honeypot study, with detailed logging and fingerprinting (HASSH) providing granular insights into botnet coordination. However, the lack of multi-honeypot validation or control groups limits the ability to rule out local network effects or sampling bias.
Patterns detected: none. The analysis avoids emotional exploitation or distortion, presenting data-driven observations without overclaiming causality. The root cause appears to be the opportunistic nature of botnets, which scale attacks in response to perceived vulnerabilities or geopolitical instability. The implications for human agency are significant: while threat actors demonstrate adaptability, the findings also show that basic security hygiene (disabling root login, MFA) could neutralize the majority of observed attacks. This underscores a persistent gap between known defenses and their implementation.
Bridge questions: How would attack patterns differ if analyzed across a distributed honeypot network? Could the observed declines in activity reflect botnet reallocation rather than genuine de-escalation? What role do economic incentives (e.g., cloud provider costs) play in botnet throttling behavior?
Counterstrike scan: A coordinated influence campaign might exaggerate the geopolitical ties to attacks or downplay defensive measures to stoke fear. This content does not match that pattern; it presents data transparently and emphasizes actionable defenses.
Sentinel — Human
Sentinel analysis incomplete — partial response from fallback model.