FritzFrog is a peer-to-peer botnet written in Golang that compromises Linux servers, primarily through SSH brute forcing, and mines Monero in memory via XMRig. It has no central C2 and leaves almost no disk footprint. First documented by Guardicore in 2020, it returned in a February 2024 Akamai report (Frog4Shell) with Log4Shell (CVE-2021-44228) for internal spread and PwnKit (CVE-2021-4034) for privilege escalation; Akamai cited 20,000+ cumulative attacks and 1,500+ victims.

FritzFrog: The Serverless P2P Botnet That Mines in Memory

FritzFrog is a peer-to-peer botnet written in Golang that compromises Linux servers, originally and primarily through aggressive SSH brute forcing, and uses the hosts for covert Monero cryptomining via XMRig. It is notable for a decentralised, serverless P2P design with no single C2 and a fileless, in-memory execution model that leaves almost no disk footprint. First documented by Guardicore (now part of Akamai) in August 2020, it re-emerged in a February 2024 Akamai report branded Frog4Shell with added propagation via Log4Shell (CVE-2021-44228) for internal spread and a PwnKit (CVE-2021-4034) module for privilege escalation.

Overview & Timeline

Jan–Aug 2020. Earliest activity; Guardicore publishes the original analysis, reporting 500+ breached SSH servers including universities and a railway company.
1 Feb 2024. Akamai publishes the Frog4Shell update; cumulative figures cited are 20,000+ attacks and 1,500+ victims.

How It Works

Propagation: SSH brute forcing across large ranges, with newer variants reading host logs to pick likelier targets. T1110.001
2024 additions: Log4Shell (CVE-2021-44228) for internal lateral spread — scanning for HTTP servers on ports 8080, 8090, 8888 and 9000 — and a PwnKit (CVE-2021-4034) module for local privilege escalation. T1190 T1068
Persistence: adds an attacker SSH key to authorized_keys, keeping system file checksums intact. T1098.004
Fileless P2P: payloads assembled and run in memory over an encrypted peer-to-peer protocol with no central C2, so no single server takedown kills it. T1620
Mining: an XMRig module (run as a process named libexec) mines Monero, and an “antivir” module kills competing processes containing the string xmr to monopolise CPU. T1496 T1562.001

MITRE ATT&CK Mapping

Note

Analyst-mapped; FritzFrog has no official ATT&CK Software entry.

Tactic	Technique	Usage
Credential Access	T1110.001 Password Guessing	SSH brute force
Initial Access	T1190 Exploit Public-Facing Application	Log4Shell
Privilege Escalation	T1068 Exploitation for Privilege Escalation	PwnKit
Persistence	T1098.004 SSH Authorized Keys	Attacker key added
Impact	T1496 Resource Hijacking	XMRig Monero mining
Defense Evasion	T1562.001 Impair Defenses	Kills rival miners

Detection & Mitigation

Harden SSH: disable password authentication, enforce keys, rate-limit, and monitor authorized_keys for unauthorised additions.
Patch Log4j (CVE-2021-44228) and polkit (CVE-2021-4034) on internal hosts, not just the perimeter — the 2024 variant targets neglected internal systems.
Watch for XMRig-style CPU patterns, execution from /dev/shm or anonymous memory, the libexec process, and internal scanning of HTTP ports 8080/8090/8888/9000.

Defend Linux Server Estates

Mjolnir Security helps organisations harden SSH and detect cryptomining botnets on Linux.

Managed Detection & ResponseThreat HuntingLinux EDRIncident ResponseVulnerability Management

Managed Detection and Response Linux coverage for SSH brute force, in-memory execution and cryptomining.
Vulnerability Management Internal patching of Log4Shell and PwnKit that the 2024 variant exploits.
24/7 Incident Response Containment when botnet activity is detected. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 11, 2026

Overview & Timeline

How It Works

MITRE ATT&CK Mapping

Detection & Mitigation

Defend Linux Server Estates

Mirai (ELF)

Prometei Botnet