Over half of all internet traffic is now automated. Bad bots alone account for 37% of it, up from 32% the year before. In 2025, the global internet absorbed 47.1 million DDoS attacks — roughly 1.5 every second — and the largest single strike peaked at 31.4 Tbps, lasting just 35 seconds.
Those numbers come from application-layer reporting. What they do not capture is everything happening below HTTP: the half-open TCP floods, spoofed UDP reflection, low-and-slow port scans, and compromised VPS instances quietly relaying attack traffic with no WAF alert in sight. At the infrastructure layer, operators see the damage in netflow anomalies, SYN rate spikes, and egress patterns that fire long before any dashboard turns red.
This article breaks down the botnet landscape from a server operator’s perspective. You will learn how bots actually get into servers, which botnets are active right now, why VPS infrastructure has become a preferred target, and what concrete hardening steps you should take today.
How Bots Get In: 8 Intrusion Vectors Targeting Servers in 2026
Botnets do not materialize from nowhere. Each compromised server was breached through a specific, repeatable method. Understanding these vectors is the first step toward closing them.
SSH Brute Force
SSH brute force remains the single most common entry point for Linux server compromise in 2026. The SSHStalker botnet, discovered in early 2026 by Flare Systems, compromised at least 7,000 Linux servers by brute-forcing weak SSH passwords. Half of those servers were in the United States. SSHStalker blends old-school IRC command-and-control with modern mass-compromise automation: once inside, it deploys fileless malware, rootkits, log cleaners, and a wide array of kernel exploits — some dating back to 2009.
The attack pattern is industrial. Botnets scan port 22 across entire IP ranges, cycle through credential lists pulled from C2 servers, and attempt thousands of logins per hour. PumaBot, a Go-based botnet documented by Darktrace, follows the same playbook: retrieve target lists from a C2, brute-force SSH credentials, then install persistence via systemd services and authorized_keys injection.
As SANS Institute field CISO Chris Cochran put it: if you are still allowing password-based SSH access in 2026, you are essentially leaving the front door open.
CVE Exploitation
Unpatched vulnerabilities are the second major entry point, and the window between disclosure and exploitation keeps shrinking. SSHStalker itself carries exploits for Linux kernel flaws going back to CVE-2016-5195 (Dirty COW). The Outlaw cryptojacking botnet similarly chains SSH brute-force with exploitation of CVE-2016-8655 and other legacy flaws.
The SystemBC botnet, tracked across more than 10,000 infected systems in early 2026, targets servers averaging 20 unpatched CVEs each, with at least one critical-severity vulnerability per host. One compromised VPS was found to carry 161 unpatched vulnerabilities. The pattern is clear: botnet operators do not need zero-days. They need servers where “we’ll patch next quarter” became permanent policy.
Credential Stuffing
Credential stuffing goes beyond SSH. It targets web panels, hosting control panels, API endpoints, and admin dashboards. The Imperva 2025 Bad Bot Report found that 46% of all login attempts it observed were account takeover attempts, powered by automated bots cycling through leaked credential databases. The success rate is low per attempt — estimated between 0.1% and 4% — but at scale, even a fraction of a percent yields thousands of compromised accounts.
For VPS operators, the risk is specific: WHMCS panels, Plesk dashboards, and WordPress admin logins are all high-value targets. Attackers use residential proxy pools and browser fingerprint rotation to stay under rate-limit thresholds, making basic velocity rules insufficient on their own.
VPS Hijacking for Proxy and C2 Infrastructure
This is where the VPS threat model diverges sharply from IoT. SystemBC, a proxy malware first documented in 2019, now maintains an average of 1,500 compromised VPS bots daily across more than 80 C2 servers. Black Lotus Labs at Lumen Technologies found that nearly 80% of the SystemBC network consists of compromised VPS instances from large commercial providers.
The reason is economic: VPS systems offer far more bandwidth, uptime, and connection stability than residential IoT devices. A compromised VPS can relay high-volume traffic for weeks without triggering the kind of consumer-grade disruption that gets routers rebooted. SystemBC turns infected servers into SOCKS5 proxies, routing malicious traffic — including ransomware delivery, credential harvesting, and WordPress exploitation — through what looks like legitimate datacenter traffic. Infections lasted an average of 38 days, with nearly 40% persisting for over a month.
Cryptojacking
Cryptojacking remains one of the most common monetization paths for compromised servers. The Outlaw botnet, believed to be of Romanian origin and active since at least 2018, brute-forces SSH credentials, kills competing miners, then deploys XMRig to mine Monero. It uses an IRC-based C2 and Perl scripts for coordination, and aggressively scans for new targets from every compromised host.
The telltale sign is not subtle: unexplained CPU spikes, particularly at consistent times, are the most reliable indicator. But Outlaw also deploys SHELLBOT for remote control and DDoS capability, meaning a server hijacked for mining can be repurposed for attacks at any time.
API-Targeted Automation
APIs have become a primary attack surface. In 2024, 44% of advanced bot traffic targeted APIs rather than traditional web applications, according to Imperva. API endpoints that handle authentication, payments, and data retrieval are exploited through automated workflows that probe business logic vulnerabilities, not just technical flaws.
For hosting environments, this means control panel APIs, billing system endpoints, and provisioning interfaces are all targets. Attackers use bot frameworks that mimic legitimate API consumers — proper headers, valid TLS handshakes, realistic request timing — making detection by signature alone nearly impossible.
Volumetric DDoS
DDoS has become background radiation on the internet. Cloudflare mitigated 20.5 million attacks in Q1 2025 alone — 96% of its entire 2024 total. The largest recorded attack peaked at 31.4 Tbps in late 2025, launched by the Aisuru botnet in just 35 seconds. For context, the record 14 months earlier was 3.8 Tbps — a 700% increase.
Most attacks are smaller: 99% of network-layer DDoS events are under 1 Gbps. But the remaining 1% now reaches terabit scale. For a VPS operator, even a modest flood can exhaust conntrack tables, saturate uplinks, and trigger null-routing by upstream providers — effectively taking your server offline even if no application-layer defenses were breached. Meanwhile, CLDAP amplification attacks surged over 3,400% quarter-over-quarter in early 2025.
AI-Generated Attack Tooling
AI has lowered the barrier to entry for bot development. The Imperva report attributes the surge in simple bot attacks — up from 40% to 45% of all bot traffic — directly to generative AI making bot creation accessible to non-technical operators. DDoS-as-a-Service platforms now incorporate AI chatbot interfaces (such as GhostGPT) that let buyers generate attack scripts with simple prompts.
On the evasion side, AI enables rapid mutation of payloads, header rotation, beacon timing variation, and phishing lure customization. The implication for defenders is that static indicators — a single user-agent string, a specific URI pattern, one known hash — buy less time than they did a year ago.
Who Is Doing It: Notable Botnets Active Right Now
Understanding the current threat landscape means knowing which botnets are operational and what makes each one dangerous.
Aisuru / Kimwolf
Aisuru emerged in late 2024 and quickly became the most destructive botnet in recent history. By mid-2025, it was launching record-breaking DDoS attacks as it rapidly conscripted IoT devices. In October 2025, Aisuru seeded Kimwolf, an Android-based variant that introduced a fundamentally new spreading mechanism: instead of scanning the open internet, Kimwolf exploited residential proxy networks to tunnel into local networks behind home routers, infecting devices that were assumed to be protected by NAT.
Kimwolf infected over 2 million devices globally — primarily Android TVs, streaming boxes, and tablets. In March 2026, the DOJ, along with authorities in Canada and Germany, disrupted the C2 infrastructure for Aisuru, Kimwolf, JackSkid, and Mossad — four related botnets that together compromised more than 3 million devices and launched over 316,000 DDoS attacks. Aisuru alone was attributed roughly 200,000 of those attacks, including events exceeding 31 Tbps.
SystemBC
SystemBC is less about spectacle and more about persistence. First documented in 2019, it survived Europol’s 2024 Operation Endgame and continues to operate through more than 80 C2 servers. In early 2026, Silent Push identified over 10,000 active infections. Its developer, known as “psevdo,” continues posting updates on Russian-language forums.
What makes SystemBC significant for VPS operators specifically is its preference for commercial VPS infrastructure. Rather than conscripting consumer routers, it targets unpatched servers and converts them into high-bandwidth SOCKS5 proxies. It powers at least three downstream criminal proxy services — REM Proxy, VN5Socks, and a Russian web-scraping operation — and its presence on a server is frequently a precursor to ransomware deployment.
SSHStalker
Discovered in February 2026 by Flare Systems, SSHStalker is a scale-first operation that brute-forces SSH credentials across the internet. Its kit includes fileless malware, rootkits, log cleaners, and kernel exploits spanning 15 years of Linux CVEs. It uses IRC for C2 — a deliberately low-tech choice that avoids the infrastructure complexity of HTTPS-based control channels.
SSHStalker had compromised at least 7,000 servers by the end of January 2026. Flare researchers noted the operation is “loud” — its execution chain is easily detectable with behavioral monitoring — which suggests the operators prioritize speed of recruitment over stealth.
Outlaw
Outlaw is a Perl-based cryptojacking botnet of likely Romanian origin, active since at least 2018. It brute-forces SSH servers, deploys XMRig miners, and uses SHELLBOT for remote control and DDoS. In April 2025, Kaspersky documented Outlaw targeting Linux environments in Brazil, with payloads that actively kill competing miners before installing their own.
Outlaw’s longevity illustrates a persistent truth: unsophisticated attacks work when fundamentals are neglected. It targets the same weak SSH credentials year after year and continues to find them.
ShadowV2 / Mossad / JackSkid
These botnets, disrupted alongside Aisuru and Kimwolf in March 2026, represent the broader ecosystem surrounding the Aisuru operator cluster. JackSkid averaged over 150,000 daily victims in early March 2026, peaking at 250,000 on March 8. The Mossad botnet, though smaller (roughly 1,000 DDoS commands attributed), contributed to the same criminal infrastructure. All three targeted IoT devices — routers, cameras, DVRs — and monetized access through DDoS-for-hire and extortion.
The VPS-Specific Threat Model
There is a reason botnets increasingly target VPS infrastructure instead of (or in addition to) IoT devices. Understanding this shift is critical for anyone running a virtual server.
Why VPS Replaced IoT as the Preferred Substrate
IoT botnets like Mirai proved that consumer devices could generate massive traffic. But IoT has limits: low bandwidth per device, unreliable uptime (users reboot routers), and residential IPs that are easy to flag and block in bulk. VPS infrastructure solves all three problems.
A compromised VPS offers datacenter-grade bandwidth, near-perfect uptime, and IP addresses that coexist with legitimate services — making reputation-based filtering much harder. Black Lotus Labs found that SystemBC specifically targets VPS over residential devices because it enables high-volume, stable proxy traffic for sustained periods. A single compromised VPS can relay more malicious traffic than hundreds of IoT devices.
The Provider-as-Weapon Problem
When your server is compromised and enlisted into a botnet, you are not just a victim — you become the attacker. Your IP sends the DDoS traffic, then appears in abuse logs and you would get blacklisted. For a business running on that server, the consequences cascade: email delivery fails, customers see security warnings, search rankings drop, and upstream providers may null-route or suspend the IP entirely.
This is the “provider-as-weapon” dynamic. The attacker monetizes your infrastructure. You absorb the costs — reputational, operational, and financial.
IP Reputation Consequences
IP reputation damage from botnet enrollment is not theoretical. Blacklist databases like Spamhaus, AbuseIPDB, and threat intelligence feeds propagate quickly. Once your server’s IP appears on multiple lists, the damage persists long after the compromise is cleaned up. Delisting takes time, requires evidence of remediation, and in some cases involves contacting multiple list operators individually. For a hosting customer, this can mean weeks of degraded email deliverability and blocked API integrations.
What VPS Owners Should Do: 6 Hardening Actions, Prioritized
These are not generic security tips. They are ranked by impact against the specific threats described above, ordered from highest-leverage to supporting measures.
Kill Password-Based SSH Authentication
This single action blocks the entire attack surface that SSHStalker, Outlaw, PumaBot, and every SSH-scanning botnet depends on. Switch to key-based authentication, disable PasswordAuthentication in sshd_config, and remove password login entirely. If you must allow password access temporarily, put it behind a VPN and set a migration deadline.
# /etc/ssh/sshd_config PasswordAuthentication no PermitRootLogin prohibit-password PubkeyAuthentication yes MaxAuthTries 3
Pair this with fail2ban or sshguard for rate-limiting, and restrict SSH access to known IP ranges where feasible. On a VPS.US server, you can configure firewall rules directly through the control panel to limit SSH source IPs.
Patch Aggressively and Inventory Everything
SystemBC targets servers with an average of 20 unpatched CVEs. SSHStalker exploits kernel flaws from 2009 and 2016. The pattern is consistent: botnet operators do not need zero-days when patch backlogs exist.
Set up unattended-upgrades for security patches on Debian/Ubuntu or dnf-automatic on RHEL/Fedora. Maintain an inventory of every service running on your VPS — including Docker containers, cron-installed binaries, and one-off scripts. If you cannot list every process that should be running on your server, you cannot tell when something should not be there.
# Debian/Ubuntu: enable unattended security updates sudo apt install unattended-upgrades sudo dpkg-reconfigure --priority=low unattended-upgrades
Lock Down Egress Traffic
Most default firewall configurations focus on inbound rules and leave outbound traffic wide open. That is exactly what botnet operators rely on — once inside, they need unrestricted egress to reach C2 servers, scan new targets, and relay proxy traffic.
Restrict outbound connections to only the ports and destinations your services actually require. A web server typically needs outbound 80/443 for package updates, 53 for DNS, and whatever your database or object storage endpoint requires. Everything else should be denied by default.
# nftables example: restrict egress to known services
nft add rule inet filter output tcp dport { 80, 443, 53 } accept
nft add rule inet filter output udp dport 53 accept
nft add rule inet filter output ct state established,related accept
nft add rule inet filter output drop
This single measure makes SystemBC-style proxy enrollment and Outlaw’s scanning behavior immediately visible: denied egress attempts show up in logs and can trigger alerts.
Monitor for Behavioral Anomalies, Not Just Signatures
Signature-based detection misses new variants by definition. Focus on behavioral indicators instead:
- Unexpected outbound connections: Any process initiating connections to IPs or ports outside your known dependency set.
- DNS queries to unfamiliar resolvers: C2 beaconing often starts with DNS lookups to domains you do not recognize.
- CPU spikes at consistent times: Cryptojacking (Outlaw, XMRig) often runs on a schedule to avoid peak-hour detection.
- Process trees that do not match your stack:
bashorpythonspawning undernginxorphp-fpmis a classic reverse shell indicator.
Tools like Suricata (for packet-level detection) and ntopng (for flow analysis) provide this visibility. On a VPS, even lightweight monitoring — a cron job comparing ss -tlnp output against a known-good baseline — catches most enrollment attempts early.
Harden Web Panels and APIs
Plesk, cPanel, and WordPress admin panels are credential stuffing targets. Enforce MFA on every administrative interface. Place admin panels behind IP restrictions or VPN access. Disable legacy authentication protocols (basic auth, IMAP/POP3 where unused). Monitor for login velocity anomalies — bursts of failed attempts from diverse IPs followed by a successful login should trigger immediate investigation.
For APIs, enforce rate limiting per authenticated session, not just per IP. Validate that API consumers match expected behavioral patterns (request sequencing, header consistency, timing).
Plan for Compromise, Not Just Prevention
Prevention fails eventually. What matters is detection speed and recovery time. Build your recovery process before you need it:
- Snapshot your VPS regularly so you can forensically examine a compromised image without losing evidence.
- Automate reprovisioning so a clean replacement can be deployed via API in minutes, not hours of manual SSH sessions.
- Separate state from compute: keep application data in external databases or object storage so that destroying and rebuilding a VPS instance is a routine operation, not a crisis.
- Pre-write your abuse response: know which blacklists to check, which upstream contacts to notify, and what evidence to preserve.
On VPS.US, you can snapshot, destroy, and redeploy instances through the control panel or API, making automated recovery workflows practical even for small teams.
2026 Outlook: What Changes and What Stays the Same
StormWall forecasts it will mitigate 58 million attacks in 2026 — nearly three times the 2025 volume. The average botnet size is projected to grow to at least 200,000 devices. AI is accelerating both sides: attackers use generative models to create scripts, mutate payloads, and mimic legitimate traffic; defenders use behavioral analytics and automated mitigation to respond at machine speed.
What changes: attack tooling becomes more accessible, payload mutation outpaces static signatures, and multi-vector campaigns (blending DDoS, credential stuffing, and API abuse in a single operation) become standard. The DDoS-for-hire economy continues to mature, with tiered subscriptions and SLA guarantees.
What stays the same: the fundamentals still decide the fight. SSH keys beat passwords. Patched servers resist exploitation. Egress filtering exposes enrollment. Behavioral monitoring catches what signatures miss. The botnets documented in this article — SSHStalker, Outlaw, SystemBC — all rely on the same basic failures: weak credentials, unpatched software, and unrestricted outbound access. Fix those three, and you have eliminated the entry point for the majority of active threats.
The servers that get conscripted in 2026 will not be the ones running cutting-edge zero-trust architectures. They will be the ones where someone left password authentication on and planned to patch next quarter. Do not be that server.
