TunnesshClient Backdoor Credential Retrieval

Elgonad .@elgonad

•updated Mar 10, 2026•1•0•71

Detects HTTP POST requests to "/api/get_challenge" or "/api/get_credentials" on port 5000. This is the initial communication pattern of the TunnesshClient backdoor, a component of the BoryptGrab campaign, to retrieve SSH credentials from its C2 server before establishing a reverse SSH tunnel.