SSH & Telnet traps catching credential stuffing.

# Comprehensive Threat Intelligence Report: SSH & Telnet Brute Force Intelligence - NadSec (2026-05)

**Key Points:**
*   **Massive Attack Volume:** The NadSec T-Pot honeypot infrastructure in Sydney captured over 1.16 million attacks originating from 8,683 unique IP addresses during May 2026.
*   **The "Outlaw" Cryptomining Campaign:** A highly coordinated campaign utilizing the `mdrfckr` SSH key and custom tools like `lockr` is aggressively targeting exposed Linux servers to deploy Monero cryptominers.
*   **IoT Botnet Resurgence:** The obscure string `345gs5662d34` emerged as a top username and password, pointing to widespread, automated credential stuffing by botnets specifically targeting Polycom CX600 IP phones.
*   **Bulletproof Hosting Abuse:** Significant attack volume originates from known high-abuse Autonomous System Numbers (ASNs) such as Pfcloud UG (AS51396) and Unmanaged Ltd (AS47890), which operate as safe havens for malicious infrastructure.
*   **Competitor Eradication:** Attackers are actively deploying scripts designed to kill competing malware processes (e.g., `secure.sh` and `auth.sh`) to monopolize compromised system resources.

**Introduction for the Layperson:**
In the digital world, "honeypots" are trap systems designed to look like vulnerable computers. Their sole purpose is to attract hackers and record everything they do. This report analyzes data captured by a specific set of honeypots located in Australia during May 2026. By reviewing this data, we discovered that cybercriminals are constantly scanning the internet for weak passwords. When they break in, their primary goal is either to force the compromised computer to mine cryptocurrency (like Bitcoin, but untraceable) or to recruit the device into a "botnet"—a massive army of infected devices used to attack other targets. We also found that these attackers are renting servers from "bulletproof" hosting companies that intentionally ignore abuse reports, allowing the hackers to operate with near impunity. 

**Understanding the Threat Landscape:**
This research provides a direct window into the automated nature of modern cyberattacks. Attackers do not manually type passwords; they use automated scripts that test thousands of devices per minute. The evidence suggests that while basic security hygiene—like disabling default passwords—could prevent the vast majority of these attacks, the persistence of these botnets highlights a systemic failure to secure Internet of Things (IoT) devices globally. The findings in this report lean toward the conclusion that until network providers enforce stricter abuse policies, attackers will continue to leverage high-risk hosting platforms to launch these automated campaigns.

***

## 1. Executive Summary

This comprehensive Threat Intelligence Report provides an exhaustive analysis of SSH and Telnet brute-force activity captured by the NadSec T-Pot honeypot infrastructure located in Sydney, Australia, during the period of May 2026. Leveraging high-interaction and medium-interaction sensors (primarily Cowrie and Heralding), the infrastructure recorded 1,164,310 discrete attack events spanning 296,193 sessions from 8,683 unique original indicators. 

The primary objective of this research is to dissect the telemetry data to uncover the origins, methodologies, and ultimate objectives of the threat actors operating within this spectrum. Our analysis reveals two dominant paradigms of attack. The first is a highly sophisticated, persistent cryptomining campaign attributed to the "Outlaw" threat group, characterized by the injection of the `mdrfckr` SSH public key and the use of competitive eradication scripts. The second paradigm involves the relentless subjugation of Internet of Things (IoT) devices—evidenced by the targeted brute-forcing of Polycom CX600 default credentials (`345gs5662d34`)—likely orchestrated by Mirai and Gafgyt botnet variants.

Furthermore, this report conducts a deep-dive infrastructure analysis, revealing that a disproportionate volume of malicious traffic originates from a concentrated subset of Autonomous System Numbers (ASNs). Networks such as Pfcloud UG and Unmanaged Ltd serve as critical operational hubs for these threat actors, providing the bulletproof hosting environments necessary to sustain high-volume scanning and command-and-control (C2) operations without regulatory interference.

## 2. Statistical Overview

The aggregate statistics derived from the full dataset of 8,683 indicators provide a macroscopic view of the threat landscape. The data highlights the geographical distribution of attack origins, the preferred infrastructural hosting providers, and the specific credential pairs favored by automated botnets.

### 2.1 Attack Origins by Country

The geographic origin of an IP address often reflects the location of the compromised infrastructure or the hosting provider utilized by the attacker, rather than the physical location of the human threat actor. 

| Rank | Country | Total Attack Events | Analysis / Significance |
| :--- | :--- | :--- | :--- |
| 1 | United States | 239,224 | Houses major cloud providers (DigitalOcean, Google, Microsoft) frequently abused via stolen credit cards for ephemeral attack nodes. |
| 2 | The Netherlands | 82,448 | A global hub for bulletproof and offshore hosting (e.g., Pfcloud UG). |
| 3 | Germany | 65,012 | High concentration of cheap VPS providers (e.g., Hetzner, Contabo). |
| 4 | China | 57,850 | Significant volume of compromised residential and commercial routers (Chinanet, China Telecom). |
| 5 | Singapore | 51,510 | Major Asia-Pacific cloud routing hub (Tencent, Alibaba, DigitalOcean SG datacenters). |
| 6 | Hong Kong | 42,633 | Proximate cloud hosting often used to target APAC regions. |
| 7 | Vietnam | 39,177 | High concentration of compromised IoT devices and domestic botnet nodes. |
| 8 | Indonesia | 36,414 | Similarly reflects a high volume of compromised residential ISP networks. |
| 9 | India | 31,807 | Large ISP footprints utilized for distributed scanning. |
| 10 | Brazil | 30,178 | Represents South America's largest footprint of compromised consumer edge devices. |

### 2.2 Top Autonomous System Numbers (ASNs)

Analyzing ASNs provides critical insight into the administrative domains hosting malicious activity. The prominence of specific ASNs indicates systemic abuse or intentional complicity.

| Rank | ASN Organization | Event Count | Infrastructure Classification |
| :--- | :--- | :--- | :--- |
| 1 | Pfcloud UG (AS51396) | 120,878 | High-Abuse / Bulletproof Hosting |
| 2 | Unmanaged Ltd (AS47890) | 97,670 | Shell Company / Bulletproof Hosting |
| 3 | DigitalOcean, LLC (AS14061) | 46,931 | Cloud Provider Abuse (Ephemeral VPS) |
| 4 | Tencent Building (AS132203) | 41,390 | Cloud Provider Abuse |
| 5 | Chinanet (AS4134) | 41,165 | Compromised Residential / ISP Bots |
| 6 | Omegatech LTD | 34,570 | High-Abuse VPS |
| 7 | Interserver, Inc | 31,928 | Cloud Provider Abuse |
| 8 | Microsoft Corporation (AS8075) | 26,547 | Cloud Provider Abuse (Azure) |
| 9 | UCLOUD INFORMATION TECH | 25,248 | Cloud Provider Abuse |
| 10 | Uzbektelekom (AS8193) | 18,173 | Compromised ISP Infrastructure |

### 2.3 Top Targeted Credentials

The credential combinations tested by attackers reveal the specific hardware and software targets hardcoded into botnet propagation scripts.

#### Top Usernames
1. **root** (2,518) - The ultimate target for full system compromise on Linux/Unix systems.
2. **345gs5662d34** (1,303) - An obscure, highly specific string utilized by IoT botnets.
3. **admin** (928) - Universal default for web interfaces, routers, and switches.
4. **ubuntu** (648) - Default user for Ubuntu cloud instances (e.g., AWS EC2).
5. **user** (420) - Common fallback default credential.
6. **test** (395) - Frequently used during system staging and left active.
7. **ftpuser** (275) - Targeted for lateral movement via file transfer protocols.
8. **postgres** (262) - Database administrative account.

#### Top Passwords
1. **345gs5662d34** (1,303) - Pairs directly with the username above; default for Polycom CX600.
2. **3245gs5662d34** (1,295) - A known variant/typo of the Polycom credential.
3. **123456** (772) - The most universally abused weak password.
4. **123** (507) - Weak password variant.
5. **admin** (445) - Standard default pairing (admin/admin).
6. **1234** (438) - Weak password variant.
7. **12345** (331) - Weak password variant.

### 2.4 Top Post-Exploitation Commands

Upon successful authentication, the Cowrie honeypot simulates a shell, capturing the exact commands automated scripts attempt to execute.

| Command Executed | Frequency | Tactical Objective |
| :--- | :--- | :--- |
| `cd ~; chattr -ia .ssh; lockr -ia .ssh` | 1,343 | Defense Evasion / Persistence Preparation |
| `lockr -ia .ssh` | 1,343 | Defense Evasion (Custom Immutable bypass tool) |
| `uname -a` | 1,271 | Discovery (System Information) |
| `cat /proc/cpuinfo \| grep name \| wc -l` | 1,249 | Discovery (Hardware Profiling for Cryptomining) |
| `df -h \| head -n 2 \| awk 'FNR == 2 {print $2;}'` | 1,240 | Discovery (Storage capacity verification) |
| `rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh...` | 805 | Impact / Defense Evasion (Competitor Eradication) |

## 3. Infrastructure Deep Dive

A critical component of this threat intelligence research is profiling the physical and logical infrastructure utilized by the attackers. Our analysis of the 800-indicator sample and aggregate dataset reveals distinct categories of infrastructure: Bulletproof Hosting, Cloud Provider Abuse, and Compromised Residential Networks.

### 3.1 Bulletproof and High-Abuse Hosting

Threat actors actively seek out hosting providers that are notorious for ignoring abuse complaints (DMCA, spam, malware hosting). These networks act as operational sanctuaries.

#### Pfcloud UG (AS51396)
Pfcloud UG represents the highest volume of malicious activity in the dataset, accounting for over 120,000 attack events. Based in the Netherlands and Germany, this ASN is consistently flagged across global threat intelligence platforms for originating SSH brute-force attacks, port scanning, and acting as Command and Control (C2) infrastructure [cite: 1, 2].
*   **Modus Operandi:** Attackers lease VPS instances from Pfcloud using cryptocurrency to anonymize their identities. The permissive environment allows automated scripts to perform aggressive /24 and /16 subnet scanning.
*   **Sampled IOCs:** `176.65.132.242` (2003 events), `192.109.200.18` (1511 events), `176.65.139.203` (142 events). These IPs demonstrate high-velocity, repetitive brute-force behavior utilizing dictionaries containing `root`, `admin`, and `ubuntu`.

#### Unmanaged Ltd (AS47890)
Unmanaged Ltd is responsible for nearly 98,000 events. Corporate registry investigations reveal that Unmanaged Ltd is a UK-registered entity (incorporation in Rushden, England, utilizing a self-storage facility address) but operates its routing and server infrastructure out of Romania [cite: 3, 4].
*   **Modus Operandi:** This "Jingle Shells" corporate structure provides a facade of legitimacy to organizations like RIPE, while effectively functioning as a safe haven for cybercriminals [cite: 4]. It is deeply associated with Mirai botnet variants, scanning for IoT vulnerabilities (e.g., CVE-2023-1389), and hosting malicious payloads [cite: 5, 6, 7].
*   **Sampled IOCs:** `2.57.122.190`, `92.118.39.236`. Activity from these IPs frequently involves executing architecture-discovery commands (`uname -m`) to download the appropriate Mirai binary architecture.

### 3.2 Cloud Provider Abuse

Legitimate, hyperscale cloud providers are frequently abused by threat actors. Attackers use compromised corporate credentials, stolen credit cards, or trial abuse to spin up powerful instances. These instances are used briefly to launch massive brute-force campaigns before being detected and banned by the provider.

*   **DigitalOcean (AS14061) & Tencent (AS132203):** These providers accounted for ~46,000 and ~41,000 events, respectively. Attackers leverage the high bandwidth and geographical diversity of these clouds. 
*   **Observed Behavior:** Instances on these ASNs heavily utilize credential stuffing methodologies, testing leaked password databases against port 22. For example, the Tencent IP `43.153.100.210` executed 330 events utilizing masked variations of common passwords, while DigitalOcean IP `159.65.2.17` executed 208 events.

### 3.3 Compromised Residential and IoT Networks (Botnets)

A massive volume of low-and-slow brute-force activity originates from consumer ISP networks.

*   **Chinanet (AS4134) & Cyber Internet Services PK (AS9541):** Telemetry from these ASNs is indicative of widely distributed botnets. Unlike cloud abuse, where a single IP might launch thousands of requests, these networks exhibit thousands of unique IPs launching only a handful of attacks each (e.g., `85.217.149.39` with 2 events).
*   **Infection Vector:** These IPs are typically residential routers, IP cameras, or DVRs that have been previously compromised by Mirai or Gafgyt and are now participating in distributed scanning to infect new devices.

## 4. Malware Analysis and Post-Exploitation Behavior

While specific file hashes were not extracted in the smart sample, the high-interaction capability of the Cowrie honeypot captures the exact command-line syntax executed by the attackers. These commands function as behavioral signatures that can be directly attributed to specific malware families and operational playbooks.

### 4.1 The "mdrfckr" SSH Key Injection

The most prominent and sophisticated attack sequence observed in the dataset involves the injection of a specific SSH key ending with the comment `mdrfckr`. This attack sequence is highly automated and executes in milliseconds [cite: 8, 9].

**The Attack Chain:**
1.  **Environment Preparation:** `cd ~ && rm -rf .ssh && mkdir .ssh`
    The attacker forcefully deletes the victim's existing `.ssh` directory. This serves a dual purpose: it prepares a clean slate for the attacker's key and immediately locks out legitimate administrators or rival botnets relying on SSH keys [cite: 9].
2.  **Key Injection:** `echo "ssh-rsa AAAA[...]+oRw== mdrfckr">>.ssh/authorized_keys`
    The attacker writes their public RSA key into the `authorized_keys` file. The distinct `mdrfckr` comment acts as a unique forensic artifact [cite: 10, 11]. By injecting a key, the attacker ensures persistent, passwordless access to the server, surviving password resets by the legitimate owner [cite: 12].
3.  **Permission Hardening:** `chmod -R go= ~/.ssh && cd ~`
    The attacker restricts permissions on the directory so that only the root user can access it, hiding their tracks from less privileged processes.

### 4.2 Attribute Manipulation: `chattr` and `lockr`

To prevent the victim (or a competing malware strain) from simply deleting the newly injected `mdrfckr` key, the malware attempts to make the `.ssh` directory immutable. 

**The Execution:**
`cd ~; chattr -ia .ssh; lockr -ia .ssh` [cite: 13, 14]

*   **`chattr -ia`:** The attacker attempts to remove the immutable (`i`) and append-only (`a`) flags from the directory. They do this *before* injecting their key, just in case a previous botnet already locked the file [cite: 13, 15]. Once their key is placed, they will typically run `chattr +i` to lock it themselves.
*   **`lockr -ia`:** Recognizing that experienced system administrators or competing botnets might rename or remove the `chattr` binary to prevent its use, the attackers download and execute a custom binary named `lockr` that performs the exact same system calls as `chattr` [cite: 9, 13]. This demonstrates an advanced level of operational security and redundancy.

### 4.3 Competitor Eradication Scripts

Botnets compete for finite system resources (CPU for mining, bandwidth for DDoS). Consequently, mature malware families include "cleanup" routines.

**The Execution:**
`rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;` [cite: 8, 13, 16, 17]

*   **`rm -rf` and `pkill -9`:** The attacker forcefully deletes and terminates `secure.sh` and `auth.sh`. These scripts belong to rival botnet operations [cite: 13, 17]. By killing them, the current attacker frees up CPU cycles.
*   **`echo > /etc/hosts.deny`:** Wiping the `hosts.deny` file ensures that no firewall or TCP wrapper rules established by administrators (or other malware) will block the attacker's C2 IP addresses from connecting back to the host [cite: 13, 17].
*   **`pkill -9 sleep`:** Kills sleep commands often used by defense scripts or other staging malware [cite: 13, 17].

### 4.4 Hardware Profiling for Cryptomining

After establishing persistence, the automated script evaluates the hardware to determine if deploying a cryptominer is profitable.

**The Execution:**
`cat /proc/cpuinfo | grep name | wc -l` and `df -h | head -n 2 | awk 'FNR == 2 {print $2;}'` [cite: 8, 14, 18]

These commands count the number of CPU cores and check available disk space. Threat actors mapping to the `mdrfckr` infrastructure utilize this logic to conditionally download CPU-intensive Monero (XMR) miners, commonly masquerading the mining process under legitimate-sounding names like `kswapd0` (a real Linux kernel swap daemon) to evade superficial administrator detection [cite: 10, 11].

## 5. Campaign Analysis

Based on the telemetry, two distinct, large-scale campaigns are currently operating simultaneously against the Australian-based sensor infrastructure.

### 5.1 Campaign 1: The Outlaw (mdrfckr) Cryptomining Botnet

*   **Threat Actor:** Tracked by the intelligence community as "Outlaw" [cite: 11].
*   **Target:** Unsecured, internet-facing Linux servers (cloud instances, VPS).
*   **Objective:** Illicit cryptocurrency mining (Monero) and establishment of persistent C2 backdoors.
*   **Signatures:** 
    *   SSH Key Comment: `mdrfckr` [cite: 10, 11]
    *   Evasion tools: `lockr` [cite: 9, 15]
    *   Payload: `kswapd0` [cite: 11]
*   **Analysis:** The Outlaw botnet is highly sophisticated. It utilizes cloud provider IP spaces to rapidly spray passwords. Once root access is achieved, it neutralizes competitors (`secure.sh`), profiles the CPU (`/proc/cpuinfo`), locks the SSH directory using custom utilities (`lockr`), and deploys a cryptominer. The presence of this campaign in the 2026 dataset indicates that despite being publicly documented for years, the actor's infrastructure and playbook remain highly effective, adapting slightly (e.g., updating SSH libraries) to evade basic signatures [cite: 19].

### 5.2 Campaign 2: IoT Subjugation via Polycom Credentials

*   **Threat Actor:** Operators of Mirai and Gafgyt botnet variants [cite: 5, 20].
*   **Target:** Internet of Things (IoT) devices, specifically IP phones and routers.
*   **Objective:** Expanding botnet node counts for Distributed Denial of Service (DDoS) extortion operations.
*   **Signatures:**
    *   Usernames/Passwords: `345gs5662d34`, `3245gs5662d34` [cite: 21, 22, 23]
*   **Analysis:** The string `345gs5662d34` is historically tied to the default credentials for Polycom CX600 IP telephones [cite: 21, 22, 24]. The massive occurrence of this exact string (and its typo variant) as both a username and password indicates a blind, automated credential stuffing attack [cite: 25]. IoT botnets like Mirai hardcode these credentials into their scanner modules. When a compromised router (often on residential ASNs like Chinanet) scans the internet, it blindly throws these credentials at any open port 22 or 23, resulting in the massive statistical anomalies seen in our dataset [cite: 20, 25]. 

## 6. MITRE ATT&CK Mapping

The behaviors observed in the honeypot telemetry map directly to the following tactics and techniques in the MITRE ATT&CK framework:

| Tactic | Technique (T-Code) | Description & Observational Context |
| :--- | :--- | :--- |
| **Initial Access** | T1110.001 (Password Guessing) | Automated testing of weak passwords (`123456`, `admin`) via SSH and Telnet. |
| **Initial Access** | T1110.003 (Password Spraying) | Using targeted strings (`345gs5662d34`) across thousands of exposed ports [cite: 23]. |
| **Execution** | T1059.004 (Unix Shell) | Execution of bash commands (`cd`, `rm`, `echo`) upon successful authentication [cite: 7]. |
| **Persistence** | T1098.004 (SSH Authorized Keys) | Injecting the `mdrfckr` public key into `~/.ssh/authorized_keys` to bypass future password prompts [cite: 12, 26]. |
| **Defense Evasion** | T1562.001 (Disable or Modify Tools) | Manipulating `/etc/hosts.deny` to prevent firewall blocks; using `lockr` to manipulate file immutability flags [cite: 9, 13]. |
| **Defense Evasion** | T1036.004 (Masquerading) | Naming cryptomining payloads `kswapd0` to mimic legitimate Linux kernel threads [cite: 11]. |
| **Discovery** | T1082 (System Info Discovery) | Running `uname -a` and `cat /proc/cpuinfo` to assess OS architecture and hardware capability [cite: 18, 26]. |
| **Impact** | T1489 (Service Stop) | Terminating rival botnet scripts (`pkill -9 secure.sh`) [cite: 17]. |
| **Impact** | T1496 (Resource Hijacking) | Utilizing compromised CPU cycles for Monero mining via `xmrig` [cite: 10]. |

## 7. Detection & Mitigation

Defending against the campaigns identified in this report requires a multi-layered approach involving network boundary restrictions, behavioral monitoring, and system hardening.

### 7.1 System Hardening
1. **Disable Password Authentication:** The most effective defense against T1110 (Brute Force) is configuring the `sshd_config` file to enforce `PasswordAuthentication no`. Only cryptographic key-based authentication should be allowed [cite: 12].
2. **Disable Root Login:** Set `PermitRootLogin no` to prevent attackers from immediately gaining administrative control even if they guess a password [cite: 9].
3. **Change Default IoT Credentials:** Network administrators must segment IoT devices (IP phones, cameras) on separate VLANs and alter all default manufacturer credentials (e.g., Polycom's `345gs5662d34`).

### 7.2 SIEM & Behavioral Monitoring (Sigma Queries)
Security Operations Centers (SOCs) should implement monitoring for the post-exploitation commands associated with the Outlaw botnet.

**Query 1: Detection of Immutable Flag Manipulation**
```text
index=linux_auditd OR sourcetype=linux_secure 
| search command="*chattr -ia*" OR command="*lockr*" OR command="*chattr +i*"
```

**Query 2: Detection of Competitor Script Eradication**
```text
index=linux_auditd 
| search command="*pkill -9 secure.sh*" OR command="*pkill -9 auth.sh*" OR command="*echo > /etc/hosts.deny*"
```

**Query 3: Detection of Suspicious Hardware Profiling**
```text
index=linux_auditd
| search command="*cat /proc/cpuinfo | grep name | wc -l*"
```

### 7.3 Network Defense (Snort/Suricata Signatures)
Deploy network intrusion detection system (NIDS) rules to detect the transmission of the `mdrfckr` SSH key in unencrypted stages (or via logged payload drops) and specific botnet User-Agents.

```suricata
# Detect transmission of the Outlaw/mdrfckr public key
alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"ET EXPLOIT Possible Outlaw Botnet SSH Key Injection (mdrfckr)"; flow:established,to_server; content:"echo |22|ssh-rsa "; content:"mdrfckr|22|>>"; fast_pattern; classtype:attempted-admin; sid:1000001; rev:1;)

# Detect Polycom Default Credential Stuffing Activity
alert tcp $EXTERNAL_NET any -> $HOME_NET [cite: 5, 27] (msg:"ET SCAN Polycom Default Credential Usage (345gs5662d34)"; flow:established,to_server; content:"345gs5662d34"; nocase; threshold:type limit, track by_src, count 1, seconds 60; classtype:suspicious-login; sid:1000002; rev:1;)
```

## 8. IOC Appendix

The following table highlights a subset of high-priority IP addresses extracted from the 800-indicator sample. These IPs are categorized based on their hosting provider and observed malicious activity. *Note: As hashes and URLs were not captured in the extracted sample dataset, the focus is placed on infrastructural C2 and scanner origins.*

| IP Address | Target Port | ASN & Organization | Country | Context & Threat Classification |
| :--- | :--- | :--- | :--- | :--- |
| `176.65.132.242` | 22 (SSH) | AS51396 (Pfcloud UG) | DE | Massive Brute Force (2003 events). Bulletproof Hosting source. |
| `192.109.200.18` | 22 (SSH) | AS51396 (Pfcloud UG) | BG | High volume brute force (1511 events). Pfcloud infrastructure. |
| `2.57.122.190` | 22 (SSH) | AS47890 (Unmanaged Ltd) | RO | Botnet node/Scanner. Associated with Unmanaged Ltd bulletproof hosting. |
| `45.87.249.100` | 22, 80 | AS210006 (Shereverov Marat) | SC | Heavy SSH scanner (192 events). Suspected Botnet C2. |
| `43.153.100.210` | 22 (SSH) | AS132203 (Tencent) | US | Cloud Abuse (330 events). Executed credential stuffing attacks. |
| `43.135.168.126` | 22 (SSH) | AS132203 (Tencent) | US | Cloud Abuse (419 events). Extensive credential list testing. |
| `165.154.36.71` | 22 (SSH) | AS135377 (UCLOUD HK) | US | Cloud Abuse (250 events). Testing `ubuntu` default accounts. |
| `66.70.198.252` | 23 (Telnet) | AS16276 (OVH SAS) | CA | High volume Telnet scanner (340 events). IoT botnet activity. |
| `20.12.41.6` | 22 (SSH) | AS8075 (Microsoft) | US | Azure Cloud Abuse (250 events). Brute forcing Linux cloud endpoints. |
| `142.202.188.211` | 5900 (VNC) | AS398019 (Dynu Systems) | US | VNC brute forcer (1053 events). Captured by Heralding sensor. |

## 9. Sources & Citations

The methodologies, botnet attributions, and command string analyses documented in this report are verified against the following global cyber threat intelligence repositories and research publications:

*   [cite: 8] Skinner, C. (2024). *SSH Attack Trends: Insights from a Cowrie Honeypot*. 
*   [cite: 13] Port22. (2023). *Mdrfckrs Part Two - SSH Botnet Evolution*.
*   [cite: 9] Cyder Inc. *Honeypots: Know Your Adversary*. Details on `lockr` usage and `mdrfckr` keys.
*   [cite: 19] Ironcastle. (2026). *New Malware Libraries Means New Signatures*. Tracking the 8-year evolution of the mdrfckr campaign.
*   [cite: 12] AhnLab Security Intelligence Center (ASEC). (2024). *Attacks Against Linux SSH Servers: Backdoor Accounts*.
*   [cite: 26] Waits, R. (2026). *From Brute Force to Backdoor: A Honeypot Kill Chain*.
*   [cite: 21] SANS Internet Storm Center. (2024). *The Top 10 Not So Common SSH Usernames and Passwords*. Identifies `345gs5662d34` as Polycom CX600 defaults.
*   [cite: 22] InfoSec Writeups. (2024). *Honeypots 103: Decoding Your SANS DShield Honeypots Data*.
*   [cite: 23] RiskRecon / Baffin Bay. (2023). *Threat Intel Report*. Documents the massive credential stuffing associated with `345gs5662d34`.
*   [cite: 24] SweetCam Honeypot Research Paper. Aalborg University / DTU. Identifies `345gs5662d34` as IoT/Polycom credentials.
*   [cite: 1, 28] AbuseIPDB. Threat reports detailing Pfcloud UG (AS51396) as a 100% confidence abuse source.
*   [cite: 29] Recorded Future. (2025). *Malicious Infrastructure Finds Stability*.
*   [cite: 5] CUJO AI. (2023). *The IoT Botnet Report*. Documents Unmanaged Ltd (AS47890) involvement in botnets.
*   [cite: 4] Team Cymru. (2024). *Jingle Shells: How Virtual Offices Enable a Facade of Legitimacy*. Details the shell company nature of Unmanaged Ltd.
*   [cite: 25] MDPI. *Empirical Characterization and Lifecycle Studies of IoT Botnets*.
*   [cite: 10] Salzner, D. (2024). *SSH Botnet Honeypot Pt. 3 - Analysis*. Associates the `mdrfckr` key directly with the XMRig cryptominer.
*   [cite: 11] Waits, R. (2026). *Tracing a Honeypot Attack to a Named Threat Actor*. Attribues the `mdrfckr` playbook to the "Outlaw" botnet group.
*   [cite: 30] USENIX Security Symposium. (2025). *Identifying Compromised SSH Servers*.
*   [cite: 17] Goslin, D. (2024). *Analyzing the Attack Pattern of Brute Force Attack on SSH Port*. Explains the breakdown of the `secure.sh` competitor eradication script.

**Sources:**
1. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE7moOoPHCShCBwDubaC8T8HPxaaFQezkU52lSmHoKsDgVebphEGUGTn1TgLHG487-rEu2f-nFFx73cglrZy-e3CHDrgYqih6QfI84C2ACkxZLaurF1dyv0dUMU85zhorZRrTq-)
2. [ibmcloud.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEHIvc_NOz6_im9XVXofQHWf1JhMRaMdiKdvKKYDgt4w9hmxk5GGI5Ec4URBsN70TDMQR-20JF6JIOuMliebvmSxVR7mb7dVqYT5zsQGpq8hjiKDMx-f_hE_18XYEjXlvbtxAjC73FaVRn5MnCJEU-N)
3. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEwG_rRNXI1wYDxu2yg1yluSQClj9h3ztOB7WdYqijIxsfWcGSP6n3cALPQxXwjDhwi3MEovO-1_UVQwV-3eblwtCtR1KH64bcowUQEy3jPxpSWz5ugM0WakfRZoINtMUgpm-qbCNdrpvo=)
4. [team-cymru.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHzULemfdsWH9gArlIzxcPnL0XTXOsqzOuMuZl-WbYO73dtLo_aS3rdq93KNvmX66SNtqqALGLy1vD9_rVYcUkO5yayzWuLPGOYwzSqSmhPkUT-_qldKvA0GY1pQGSLdV986iQzkDfnhft1-Oe7OPL1OCT7thDUcY41ztJVa9_3VsC4zfTqAL8hVu5SgvNGYpjrs8kW2w==)
5. [cujo.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGHUhnBObAu6v7_byHPmdz6XkVvVo54LCxb_HduzoDLJl2_Dpsz4MvGduklpO9VpzdgYcaTCFSDG2D4lKfnd4bsmzidqxb-F1X1sq1jrBEh9U-JWfvLSUSvhKhqHHpuiHUwPIm3e2uTws3Er26zJE7xAODl5WoalT6biZFWMZZgAMYOViIp)
6. [qianxin.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEqzM-eBeCXE7saN_7XuZgvcASSPSBZkrrStoD8Eo8USJ43BXL1CS0Jr-KdLyvlE1WMyTPYxZKMS7DPrD78hYw9tulb_MWK5728n7kFgmB81N1DWhUp5Dzy0PuDXu07SzNv)
7. [f5.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFHA-Js4hdqMu8IPhPnu86BLFpmptz-mhJAflW_Cu5CilQDClIrFSb-_M9A1mZjTsBGxd3KH9ko_zS_uto1-3FFsdZj-4Dc6SDhjZSAfgIxyE-6_xG_-2hhmeCzYo0tT_lgQPQ8QWasQ1b7Y-W8i12SZ-15zja8x4nGIbQ0)
8. [codyskinner.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH19vQkYlZ8V2R3XGKoPW3Vc63RbEUv_ZK9uF72J5oLWthrWQJR9OXEI6xBAHsOjy4mp_mIJWiItFrLwWcaIuzHDMYQf9BoaLuTxZCTkdx_LN-U8hTiVek2MWpPHYW4DKAybnG-fRhsIfAiiICvmH9DIz7F_EAbHBv6S5VxX2uzqQOlDyNi)
9. [cyderinc.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHawh5m3i4xyJtMD_aJP50SmXZQpPeZ7B__tlv5kUT78hf9mtsQ0kXxpN63pMSpvdMfU6oSGsPEhCyY502xO2f2gWaPbDLFe0KZCUGLdjao3L1BzKMftEkVgb836t4TYgrTrAvBSCBLAlAZVoTCPJs04qKEiSkcAvX0kJg3woci0fY_AU0Vlo2Hx1FkpaSuRg==)
10. [dennissalzner.de](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEiMl96WjT2bWnUC8KJaS9cC9hM426MZf2x5kGHAreuXYo2YZlzgNsP2vQqpUBJxNJCKcuP6OTPrnUpXSwbbTCHFIvbFrAtFe575as9Sv8x-V9PdlYE0lzmrwpKjDTGhERikyXaij7kfLSnerRnqtsVfOsywDdPY6fbtFtTzL_2EQ_JPcG0MA==)
11. [medium.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG3JTn2IaaOVDqQnuJkxVaFXfkiQD7jA98bfWOfWrAAd3LTRljqv_TP7ufn4QdQvm07hOEF76t_TWOiQvivOl-zcu2NoVyIBi5v2AuAzgBB47icywmAYZJo0AOBkV94MU1Wstd5pFq_S_tUB7_dF7Bt-C6crDnyapN714Uqki9x52dyoAqf60ucTWZQfVcvtdNDZYt7QZ0Y9KS_8_71I6S141gaty96)
12. [ahnlab.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGaU-oy83edEPdz_XDZbZ5MDDQ0FkhqNR9u_YBR_s3hCBlVUvzyRIzs4VHbUt9yuKX0mHKMA6rCcDBZw4_C4hVwR-1mj4pfqyLh_hZkcN8hhJg-Evh4OZg=)
13. [port22.dk](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF1VMeZnlKr8tTRptJHrLSnkTZ4Dc_jygh6D4GACliJRv9-fozAN5vrYAA8BZUtLcLMtlIjYFRAfwNSPkWTrGTm1Lo1gzuB8oGCGjVRuhCuuRim9mrdplxuxCQTCFARkw==)
14. [medium.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEu5yDBF6KzEtWQK5IVGlghVVm8JMBuemZzIdUCSjGh7_Nde1A8t73q5QPnxIIwSyBMAFXDH3SudnsVcu8NhBge39DIjeU8mBokIB4jaan2n1aBxlOGF1F9ff8pGeFsZw35IFxvxLzImmLrIdfrrtyGRfv8u-Z1hdvjXerZMUtbziINQS6VbwS0OUOQeAODrnjsQQ==)
15. [ntop.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHBvlKPNF6TYv7rEM3NZU4BmWE0Cyn-C1buO6SJPKE-VCrpg4yjrmEfnpGKwx1PWS5lkcAYUgunUrm9AE-D4rL2GNuKYyzi7_e4wmVfuECWcAU30wB57YAD3O_VceB_Y7laOyvGwg==)
16. [reddit.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE9fH6Jo-n0vVA-ALNbDE0OPWWiUKyI7lJ8LTfYuILG1vNRLNC4z0sN1i2aOi6BMfnnq8_4ZsRnqIwHzaFTuFY4FSM2ziA_dykCeDy4-ow49JRBVq7Bhy1NC2aWL6g4Tg1Uyfc-RNIHXFJ4NXE_MBIQALKg5nPufJGQVP37Vz8OkBm0d01VC1-tTXBvh9nGZp_mtER7kBNaWdI11WyI)
17. [ncirl.ie](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFR7lIF-BdXAJBjWdirg9O2k0YaiJ0E3VIfJn_8ysfdy-R6VmT8iFtckZtidVjVDdHyQleuNCE_qvNovNchZIBLksNQ1ID8MnQC3wPiLcRxVmRnK-5Zf2zoCeAomVjMCP-LUnWhEg==)
18. [jhu.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEurnhctokhwc6u3KYDNwp8TmfYDsKgcnLIk4qbPdjdZ-UrjjuyHA5K95Ss7bwbPtt7KiP0unAhFsL90oozQ92-3b7iee9Dar_gXnO5qdp5Hyab07HWSRBrYKd64jg4fvC5tIucQQsjqKFrjWUNBujOTbBMQLbHVT5kATp-WbEvfO-doNgtUC6ykw==)
19. [ironcastle.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFuYgmg7lSpa-lrXi8973pDDbG7SFUdYBAAH2m1dNyzzyf61IbPdYHJMEa8JVlGG-RFgOmLPrCChZz9G_i3iEmexk0yRYqN0X7XR2G0Yeecj7SsGst7cxS9dbJZkw5dbKVgE29jtL7oSBTEcM8Gy5NQMsYvW2paGXZk8y7pYLlYQRJ-B_PhDO5QaS0o-wgHb2tETMMwjA==)
20. [sfu.ca](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF-6Gp7pNKG5xLur8tSPqbyhW_e1oj6MzsK3bSUa1BB4aLhhSjTDB9gOI74g53YGCXQRqgXpSdOJOjp2ujgguwljfdYpRKWjO_gH52qZHakC-OAOG--LVNFgEQcnPFFrVrrfUKnRQAtw6L_NZ3T1Ao6d3qKBajHuBmlpjjI_LjwmrBYFxVjx9zwifMUv1CB)
21. [sans.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHIHGEdvAOdB1RZ9jY8PnEy7Hr55OSNwSZ0USwaG4y_1qfLep3ALMTIKxmhgq_FJHdS0yf5N8JAsjeHoW_Ym8xi2qu7ovIDWoEXJFT5O3gClto6anxsRg==)
22. [infosecwriteups.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFG1_VG2Zv59HANNWFvXdUdmnjJN0HoUhOtbp3flXZwxaKAO00CvBBWfuOb-Hl6UMC_jrvChewacm_yJsa3UBYKRzpeTqJQVdqwJo42mk-IT4uS33v2YT0QkBOgz7_vVhdax1M0SLStpxgodDvg4oL4f-TzpC_LjLmtgb9TR9f_ILTG10XgQx6a3h0uFQ4Xyed4JeAAAss=)
23. [riskrecon.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE4UOx-xkL0wufg-eFD0e9TH2Qih7Ea4F0rTnS_HTuiIHKaNF7voSVX_f3QIh4zpf9zaczSEr80V7qXoW7ENlFZg1RPaMQdeiS5HX10VS4EOkrxdJEnLY1RQwYtDCfyuXqF1TCAj5JLz6yUlK5WBuBMnMM2Bbir)
24. [dtu.dk](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGGpmPPg65OgOKPjijYOEq5oI_81Cc6yN-zO-O1JYGYPd7n4WuE629tvA_RBWd8R1wgGd2_-Mygo2lGq6lygkIJF7c-xe0NVxPWiJpWLw7oOAG2Oogyn3x5EiXoIP3EMCH3LX8NNhi90RKFOJmfD34KuVqYb9ZcBrg1ZuqrBTnxETH0u04=)
25. [mdpi.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHFr429y1GzXQgoxF9cF3nkA5_nAi9R2b1-GhWOtghLtDiV7cQv_tjavllJTPOrCdv0i6ON8gYLa4UY31p8PRacWBoi5j7aUn5vGZwdlFyoEznPIYBJ1Dl8LhNZ)
26. [medium.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEtN600GVpA2keMCRWehe26L_BnQYLitTobwAUONTaayq-br6mqC6V-LcDfH7oJk4ZbZCGYDRH_sQKU6CLskB8KBVTVe8E4dTknH84Bykii5O-GGF7HAYvsUKwhRMLLlDdvwC-BKGzpDc_lpYBzfFK0A3ULuimDlpSBlrXVibooGBK_5tox_t-NJDoyVuSdrcyaVJdh9R8=)
27. [crowdsec.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHmgh8_2lOzwsNy-XswvbvD7_C2I-IgRnlWIOAKOPrmTu7cHk9NKnkj8Fy79gIWqScYNRj4DH-tJcYGClz68vceAMnywcYIHPl8rq5Kt6juYPoD5Q_mkzt7qesjj9IQzFQ=)
28. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHin_q7Sl3id0ZZj0lvATu8xyf76wxdJR--srcQVJok60jqq92Hy9aItbfB1bcboC2PTQT9DTRC_hzB0Pvnz8PZ9kLmtqrTyaOIMhIB9DVbV02N0QUUbyoA25bjsJHjjiHgWNqU)
29. [recordedfuture.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGcxzEsQtAFIh_-0wCbXsKBFiIBhdBysjmA-EhIXY1TUrsJU-9g6LaYbtBcKIC0z5722BMu0zrB4WP0N0quCcyPShOUQdV4wZNmUnFODVEJ3XcwzC74PRHtFPqYJiCBBG3DXqfYfBQdw87q6NuNxm52LH7f0PX57VF_wfPoLuL8FH2DJLVD9HYtvIcvhTLyUaCdINPYMQgpgFtl)
30. [usenix.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFIlvhMxdFAZfuIFnwv5_XqluEA4caHIPFysUZP0w23wf7Q9eH21pcMx6QjbDMWyZ1sJdBiODii9n15gILdgvaN2_L6Yy3_cPyGqYAW1TyetMazJlMnO4at7dORbLhsN847vQz6AmYnguLnb4W6Tpd0EKiTmWDp0g==)