TI-2026-007 โ "The Underground Economy" โ 6 Crime Networks, 36 Days, 1 Honeypot
The mdrfckr botnet documented in this dossier (23 IPs, captured March 21 โ April 26) continued operating after this report's cutoff. Follow-up monitoring through 2026-05-01 captured an additional 8 IPs running the identical toolkit with a rotated SSH backdoor key. Three of the published mdrfckr IOC IPs reappeared in the wider 31-IP roster. The marker credential 345gs5662d34:345gs5662d34 persisted. The investigation is closed โ see TI-2026-008 โ "The Backdoor-Key Harvester" for the full continuation, the expanded victim roster with verbatim WHOIS records, and the Max-Planck-Institut fรผr Informatik co-observer reframe.
๐ Executive Summary
Over 36 consecutive days (March 21 โ April 26, 2026), a single Cowrie SSH honeypot operating on our infrastructure captured 40,677 credential attempts from 1,824 unique IP addresses across 50+ countries. Deep OSINT analysis of the captured telemetry revealed not isolated attacks, but an interconnected underground economy โ six distinct criminal networks whose operations interlock like gears in a machine: bulletproof hosting and proxy networks provide the infrastructure, self-propagating worms and botnets generate the access, and SIM theft rings, ERP targeting campaigns, and cryptomining operations deliver the monetization. This dossier documents the complete ecosystem โ from the specific Telegram session fingerprint being hunted across the internet to the IRC server named bullshit-irc.net coordinating cryptominers, from a compromised Baidu AI server running Ollama to a Swiss-Panamanian bulletproof hosting provider running 225-port proxy farms on Windows servers.
๐ The Crime Pipeline โ How 6 Networks Form One Economy
These six networks are not independent โ they form a vertically integrated cybercrime supply chain. Infrastructure enables access, access enables monetization.
ISAEV Proxy โ Purpose-built ASN (37 days old), SSH tunnel harvesting, proxy-for-hire
mdrfckr Botnet โ 23 IPs, SSH key injection, IRC C2, mass activation events
ERP Targeting โ 316-username wordlist, version-specific Odoo โ wire fraud
mdrfckr Mining โ XMRig crypto mining โ launders proceeds
Each layer depends on the one below it. Together, they form a self-sustaining cybercrime economy.
Every session uses root:root (single attempt, 100% success โ pre-validated targets), executes an identical 9-command sequence in 1.8โ9.1 seconds, and disconnects. The commands search for: Telegram Desktop session data (tdata/ directories), GSM modem hardware (/dev/ttyGSM*, /dev/ttyUSB-mod*), SMS gateway infrastructure (smstools3, Qualcomm QMUX), and one specific Telegram session identified by fingerprint D877F783D5D3EF8C.
/ip cloud print โ MikroTik router detection
ifconfig โ Looking for PPP/USB/bridge interfaces
uname -a โ ARM = embedded, x86 = server
cat /proc/cpuinfo โ Qualcomm SoC = modem hardware
ps | grep '[Mm]iner' โ Competitor detection
ps -ef | grep '[Mm]iner' โ Extended miner check
ls -la ~/.../TelegramDesktop/tdata /dev/ttyGSM* /var/spool/sms/* ... โ 12 paths
locate D877F783D5D3EF8Cs โ Hunting ONE specific Telegram account
echo Hi | cat -n โ Shell validation marker
s in the search is not a typo โ Telegram Desktop appends s to create the tdata/ subdirectory name. Someone specific is being hunted across the internet. The operator already knows which account they want.
Compromised devices include: Android TV boxes (ADB port 5555 exposed), a 3D printer running OctoPrint (France), a building automation system with KNXnet/IP (Vietnam), BitTorrent NAS boxes (Sweden), and residential routers with TR-069 exposed. The botnet is accelerating โ inter-session gaps shrunk from 10 days to 0.36 days in the final week.
The mdrfckr (Outlaw/Haiduc) botnet is a well-documented cryptomining operation active since 2018. All 23 nodes inject an identical RSA public key with the comment mdrfckr, execute a 19-command attack sequence (SSH key persistence โ system recon โ competitor elimination โ mining viability assessment), and set unique per-bot 12-character passwords generated by the C2. The universal marker credential 345gs5662d34:345gs5662d34 appears in 100% of bots (23/23) โ functioning as a botnet fingerprint and re-entry mechanism.
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAA...oRw== mdrfckr">>.ssh/authorized_keys
# SHA256: MkYY9qiVsFGBC5WkjoClCkwEFW5iSjcGQF7m4n4H7Cw
chpasswd for password change โ newer, more reliable methodLegacy (2 IPs): Uses interactive
passwd โ older variant, HK and Egypt
198.98.56.205 (FranTech/BuyVM, AS53667) โ hostname: bullshit-irc.net โ runs IRC on ports 6667/6697. FranTech is a known bulletproof-adjacent hosting provider. This is the IRC C2 server coordinating the mdrfckr botnet. The IRC Shellbot C2 pattern matches documented Outlaw/mdrfckr campaigns since 2018.
A centrally-coordinated worm distributes an identical binary (SHA256: 94f2e4d8d...a4c00) masquerading as sshd. Each spreader receives a unique set of ~51 target IPs with near-zero overlap (only 2 shared IPs across 3 non-empty lists) โ maximizing coverage. The binary is deployed via nohup ./.<random_19_digit>/sshd <targets> & โ the 19-digit directory names match Java Random.nextLong(), indicating the dropper is written in Java.
| Spreader | Location | ASN | Targets | Notable |
|---|---|---|---|---|
180.76.175.142 | ๐จ๐ณ Beijing | AS38365 Baidu | 51 | ๐ค Compromised AI server โ Ollama 0.5.10 + Portainer exposed |
144.31.152.46 | ๐ซ๐ฎ Helsinki | AS215590 DpkgSoft | 0 (empty) | Bulletproof hosting โ relay/proxy node |
107.175.150.94 | ๐บ๐ธ Buffalo | AS36352 ColoCrossing | 51 | 12 CVEs incl. regreSSHion, tagged "proxy" |
154.241.22.37 | ๐ฉ๐ฟ Algiers | AS36947 Telecom Algeria | 51 | Residential ISP โ compromised device |
180.76.175.142) is a Baidu cloud AI development server running Ollama 0.5.10 (LLM inference engine) and Portainer 2.16.2 (Docker UI) โ both publicly exposed with known CVEs. Likely compromised through the Portainer authentication bypass (CVE-2024-33661). A developer's AI playground turned into a worm launchpad.
Confirmed worm propagation: Target IP 46.101.107.202 (DigitalOcean Frankfurt) subsequently attacked our honeypot using the exact same credential dictionary in the exact same order โ confirmed active bot. Target 36.137.79.219 (China Mobile Shanghai) attacked us before appearing in the target list โ the C2 aggregates previously-known vulnerable hosts. China dominates the target distribution (31%), consistent with the Beijing origin of the first spreader.
Private Layer INC (AS51852) โ registered in Panama, operating from Bellinzona, Switzerland โ is a well-documented bulletproof hosting provider. Two IPs (179.43.133.154 and 179.43.139.58) have conducted persistent, low-and-slow SSH scanning since Day 1 of the honeypot (March 21). They use almost exclusively admin/admin (94.6%) with automated ~30-minute intervals. Zero post-exploitation commands โ pure credential validation.
Both IPs are Windows servers running as proxy farms: 179.43.133.154 has 159 ports in the 12000โ12999 range alone โ each a separate SOCKS proxy listener. Both expose Windows services (RPC:135, SMB:445, WinRM:5985) and share 28 identical port numbers, confirming the same base image/configuration. A third IP (179.43.9.2) ran a more sophisticated credential-stuffing burst on April 24 using Chinese-origin passwords.
185.246.128.133, AS42237/W1N Ltd, 1,119 attempts over 35 days) uses the identical credential pattern (admin/admin + admin/123456), runs the same Windows services, and shows the same persistent behavior. Both started on Day 1. Strong evidence of the same operator using infrastructure from two different bulletproof hosting providers.
AS200730 (ISAEV Igor Maratovich) โ a single /24 prefix in Warsaw, Poland โ was created on 2026-02-20, just 37 days before its first attack. It announces only one /24 block (256 IPs), is registered to an individual with a Russian patronymic name, and has upstream transit from MEVSPACE (Polish hosting) and Shesternin Vladimir (Russian individual, AS212835). This is a purpose-built scanning infrastructure.
Mar 29 โ Apr 11
4 IPs (.141,.145,.147,.149)
1-2 attempts each
Apr 17 (single session)
IP .146 runs full system profiling script checking
AllowTcpForwarding, router firmware
Apr 20-21 (22.7h)
IP .150 โ 114 sessions,
DNS tunnel via 1.1.1.1:53
Apr 21-26 (118h)
IP .176 โ 506 sessions,
7-min handoff from .150
The recon script (IP .146) specifically checks for AllowTcpForwarding, PermitTunnel, GatewayPorts in sshd_config, probes for MikroTik, OpenWrt, Ubiquiti router firmware, and checks for tunneling tools (socat, chisel, gost, ncat). The 620 tunnel tests send a byte-identical DNS query for a.to (shortest resolvable domain) through direct-tcpip to 1.1.1.1:53. If the DNS response returns โ tunnel works โ target is a usable proxy.
A coordinated credential-spraying campaign from 7 Akamai/Linode VPS nodes (all AS63949, Cedar Knolls, NJ) targeting enterprise financial systems. The 316-username wordlist reveals extraordinary breadth: version-specific Odoo (14โ18), Frappe/ERPNext, databases (PostgreSQL, MySQL, Elasticsearch with 7 variant usernames), CI/CD systems (Jenkins, GitLab), Chinese enterprise software (KingBase, DM Database, GBase, ๅฅ็บฆ้), and even AI services (claude, chatgpt, gpt, cursor, nvidia).
Post-authentication behavior is pure fingerprinting: every successful login runs uname -s -v -n -r -m only โ zero downloads, zero lateral movement. The attacker is building a database of accessible ERP systems for later exploitation. The inclusion of cowrie in the username list proves honeypot awareness. Password claude2026 shows real-time wordlist maintenance tracking current-year AI trends.
Connections between the six networks that prove this is not random internet noise โ it's an ecosystem.
| Connection | Evidence | Significance |
|---|---|---|
| mdrfckr โ Bulletproof Hosting | 198.98.56.205 (FranTech/BuyVM) hosts bullshit-irc.net โ mdrfckr IRC C2 server. FranTech is bulletproof-adjacent hosting. |
Botnet C2 runs on bulletproof infrastructure |
| Private Layer + W1N Ltd | Both started Day 1 (Mar 21). Identical credential pattern (admin/admin). Same Windows services. Same persistence model. |
Same operator, two bulletproof providers for redundancy |
| ISAEV Escalation Pattern | Probe (Mar 29) โ Recon (Apr 17) โ Tunnel test (Apr 20) โ Sustained (Apr 21-26). 37-day-old ASN. | Professional proxy builder, purpose-built infrastructure |
| Worm โ Honeypot Feedback | 46.101.107.202 confirmed in worm target list, then attacked us with identical worm credentials. 36.137.79.219 attacked us first. |
Worm successfully creating new attack nodes |
| mdrfckr Mass Activation | 10 IPs in 12 hours on April 11 โ simultaneous across BytePlus, Google Cloud, DigitalOcean, FranTech | C2 coordinated multi-cloud campaign push |
| SIM Bot Acceleration | Inter-session gaps: 10 days (early) โ 0.36 days (late April). Cadence tripling. | Operator ramping up โ possibly facing deadline or competition |
| Shared Credential: 345gs5662d34 | Universal mdrfckr marker credential present in 100% of botnet nodes (23/23). | Botnet self-identification + re-entry mechanism |
| ERP โ Worm Overlap | ERP wordlist includes claude, docker, kubernetes โ same targets worm compromises for compute |
Different monetization of same victim pool |
What we observed over 36 days is not six isolated attack campaigns. It is the visible surface of a vertically integrated cybercrime economy.
At the infrastructure layer, bulletproof hosting providers (Private Layer in Switzerland, W1N Ltd, FranTech) provide servers that ignore abuse complaints, while purpose-built ASNs like ISAEV Igor's harvest SSH proxies to anonymize all operations. These two capabilities โ persistent hosting and anonymous routing โ are the foundation everything else depends on.
At the access layer, self-propagating worms and brute-force botnets continuously expand the pool of compromised machines. The SSHD worm's partitioned target lists ensure maximum coverage with minimum overlap. The mdrfckr botnet's IRC C2 coordinates mass activations across clouds. Together, they maintain a constantly-growing inventory of compromised hosts โ the raw material of cybercrime.
At the monetization layer, different operators extract value from this inventory in parallel: the SIM/Telegram botnet steals 2FA codes and messaging sessions for bank fraud, the ERP campaign maps financial systems for wire fraud and BEC attacks, and cryptominers like mdrfckr convert stolen compute directly into Monero. Each monetization path is independent but they all draw from the same pool of compromised infrastructure.
A single honeypot, running for 36 days, captured enough data to map this entire ecosystem. The internet's criminal underground isn't hidden โ you just have to know where to listen.
| Technique | Name | Networks Observed |
|---|---|---|
T1595.002 | Active Scanning: SSH | All 6 networks |
T1078.001 | Valid Accounts: Default Credentials | SIM, mdrfckr, Worm, Private Layer, ISAEV, ERP |
T1110.001 | Brute Force: Password Guessing | mdrfckr (27-102 creds), ERP (316 usernames) |
T1110.003 | Brute Force: Password Spraying | Private Layer, ISAEV (admin/admin at scale) |
T1059.004 | Unix Shell Execution | SIM (9 cmds), mdrfckr (19 cmds), Worm, ISAEV (.146 recon) |
T1098.004 | SSH Authorized Keys Manipulation | mdrfckr (key injection with mdrfckr comment) |
T1082 | System Information Discovery | SIM, mdrfckr, Worm, ISAEV, ERP (uname) |
T1083 | File and Directory Discovery | SIM (12 paths for tdata/GSM/SMS) |
T1120 | Peripheral Device Discovery | SIM (/dev/ttyGSM*, /dev/modem*) |
T1528 | Steal Application Access Token | SIM (Telegram auth_key via tdata/) |
T1496 | Resource Hijacking (Cryptomining) | mdrfckr (XMRig/Monero) |
T1071.001 | Application Layer Protocol: IRC | mdrfckr (bullshit-irc.net C2) |
T1090.003 | Multi-hop Proxy | Private Layer (200+ ports), ISAEV (SSH tunnels) |
T1583.003 | Acquire Infrastructure: VPS | Private Layer, ISAEV, ERP (Linode cluster) |
T1584.005 | Compromise Infrastructure: Botnet | SIM (15 residential), mdrfckr (23 IPs), Worm (151 targets) |
T1562 | Impair Defenses | mdrfckr (chattr -ia, kill competitors, clear hosts.deny) |
Key indicators of compromise across all 6 networks. Full IOC tables available in individual reports.
| Network | IP | ASN | Country | Role |
|---|---|---|---|---|
| SIM/Telegram | 178.160.209.67 | AS12297 | ๐ฆ๐ฒ Armenia | First bot (Day 1) |
90.76.178.5 | AS3215 | ๐ซ๐ท France | OctoPrint 3D printer bot | |
171.241.43.241 | AS7552 | ๐ป๐ณ Vietnam | KNXnet/IP building automation bot | |
| mdrfckr | 198.98.56.205 | AS53667 | ๐บ๐ธ FranTech | IRC C2 (bullshit-irc.net) |
101.47.159.125 | AS150436 | ๐ธ๐ฌ BytePlus | TikTok cloud compromised | |
182.93.50.90 | AS4609 | ๐ฒ๐ด Macau | 180+ CVEs, ancient PHP | |
| SSHD Worm | 180.76.175.142 | AS38365 | ๐จ๐ณ Baidu | Compromised AI server |
107.175.150.94 | AS36352 | ๐บ๐ธ ColoCrossing | regreSSHion CVE, proxy-tagged | |
| Private Layer | 179.43.133.154 | AS51852 | ๐จ๐ญ Switzerland | 225-port proxy farm |
179.43.139.58 | AS51852 | ๐จ๐ญ Switzerland | 125-port proxy farm | |
| ISAEV | 87.251.64.146 | AS200730 | ๐ต๐ฑ Warsaw | Recon script executor |
87.251.64.176 | AS200730 | ๐ต๐ฑ Warsaw | Workhorse (506 sessions) | |
| ERP Targeting | 66.175.212.125 | AS63949 | ๐บ๐ธ Linode | Primary spray node, 685 attempts |
45.79.134.22 | AS63949 | ๐บ๐ธ Linode | 18 ports, likely C2 panel |
345gs5662d34:345gs5662d34 (mdrfckr marker) ยท
D877F783D5D3EF8Cs (targeted Telegram fingerprint) ยท
SSH key SHA256:MkYY9qiVsFGBC5WkjoClCkwEFW5iSjcGQF7m4n4H7Cw (mdrfckr) ยท
Binary SHA256:94f2e4d8d...a4c00 (worm sshd) ยท
Payload SHA256:a8460f446b...9f8f2 (mdrfckr miner) ยท
DNS probe \x00\x16\xab\xcd to 1.1.1.1:53 for a.to (ISAEV tunnel test)
Five days after this dossier's cutoff (April 26), continued honeypot monitoring captured 8 additional IPs running the same toolkit with a rotated SSH backdoor key. Three of the IOC IPs published above reappeared in the new wave. The investigation closed on 2026-05-01 with the expanded TI-2026-008 dossier.
| IP | Role in TI-007 (mdrfckr) | Role in TI-008 (Backdoor-Key Harvester) |
|---|---|---|
198.98.56.205 | IRC C2 (bullshit-irc.net), FranTech AS53667 | Dropper, 2026-04-11 11:06 |
101.47.159.125 | "TikTok cloud compromised", BytePlus AS150436 | Dropper, 2026-04-09 โ 04-11 |
182.93.50.90 | "180+ CVEs, ancient PHP", CTM Macau AS4609 | Dropper, 2026-03-30 โ 04-19 (19d) |
Every TTP documented for mdrfckr above is reproduced byte-for-byte in TI-008's 31-host roster:
cd ~; chattr -ia .ssh; lockr -ia .ssh(TI-008 captured the actual binary namelockrโ semantic equivalent ofchattr -ia, undocumented in TI-007's mdrfckr writeup)rm -rf /tmp/secure.sh /tmp/auth.sh; pkill -9 secure.sh auth.sh; echo > /etc/hosts.denyโ competitor-eviction sequence- 12-character per-bot random root password via
chpasswd|bashwithpasswd-interactive fallback on hardened hosts - Marker credential
345gs5662d34:345gs5662d34โ TI-007 logged it as the universal mdrfckr signature; in TI-008 it appears in103.187.146.90's captured credential list (alsoroot/3245gs5662d34as a typo'd variant) - 19-command attack sequence (key install โ recon โ cleanup โ fingerprint) โ identical ordering and timing (~700 ms between commands)
MkYY9qiVsFGBC5WkjoClCkwEFW5iSjcGQF7m4n4H7Cwmdrfckr13:47:1e:8f:5a:18:fc:8e:35:0a:51:cc:7d:b4:06:61The two keys are different RSA pairs (different fingerprints, different blob prefixes). The operator rotated the key between the two waves โ and removed the mdrfckr comment, presumably because TI-007 publication made the original comment a recognizable IOC. Same operator, same toolkit, fresh key.
The mdrfckr operator is still active. The 23-IP roster published in this dossier is a snapshot, not the full population โ TI-008 expanded it to 31 confirmed dropper IPs across 22+ countries, and even those are just the ones that hit one honeypot. The campaign survived the publication of TI-007 by rotating the most obvious IOC (the SSH key comment), but kept every other TTP intact โ the same competitor-eviction sequence, the same per-bot password rotation, the same marker credential. For defensive purposes, treat mdrfckr and Backdoor-Key Harvester as one continuous campaign; for blocklisting, both rosters should be combined; and for monitoring, watching for the marker credential 345gs5662d34 remains the most reliable family-level detection because the operator clearly does not consider it worth changing.