RedTail staging: SSH-2.0-Go banner with immediate ELF upload

Arnold Chan@slaz

•updated Sep 11, 2026•0•0•4

Detects anomalous SSH sessions originating from potentially suspicious IP addresses that utilize an 'SSH-2.0-Go' banner and immediately perform file creation operations associated with the RedTail botnet (e.g., shell scripts or architecture-specific binaries).