Between 2026-03-28 and 2026-05-12 (and still running as this dossier is published), a single Cowrie SSH honeypot captured the largest coordinated attack campaign in its history: 51,960 login sessions from 1,639 unique IPs across 456+ autonomous systems in 84+ countries. The campaign operates in two waves: the initial wave used HASSH fingerprint 03a80b21afa8… (SSH-2.0-libssh_0.11.1, 1,288 IPs), and on April 21 the operator silently upgraded to af8223ac9914… (SSH-2.0-libssh_0.12.0, 537 IPs), with 186 IPs confirmed to have switched between fingerprints. This is the Outlaw hacking group's mdrfckr botnet, first documented by Trend Micro in 2018, and the exact same RSA backdoor key has been in continuous use for six years.

The botnet's infrastructure spans three tiers: ~64% commercial cloud VPS (ByteDance, UCloud, DigitalOcean, Azure, Tencent, Oracle), ~14% compromised residential endpoints (Korean home routers, Starlink terminals, Mexican DSL), and ~3% deliberate bulletproof hosting (KoDDoS in Seychelles, Cloudie Limited on Spamhaus ASN-DROP). A critical finding: ByteDance's Volcano Engine and BytePlus platforms contribute approximately 90 IPs — the largest single corporate infrastructure owner — after correcting a geolocation database error that mislabeled their 14.103.0.0/16 block as China Telecom. The credential dictionary carries unmistakable Chinese cultural signatures (888 lucky numbers, QQ references, 520 love code, Pinyin keyboard patterns) and targets specific application service accounts (GitLab CI runners, Elasticsearch, n8n automation, Frappe ERPNext, Project Zomboid game servers, Huawei network equipment). One credential — 345gs5662d34:345gs5662d34 — is a confirmed botnet propagation marker: the bots are hunting machines already infected by other bots.

This dossier reproduces what the public registries return for every ASN, every BGP prefix, every abuse contact. We are not judges. We are the providers of what the records say and what the honeypot caught.

HAIDUC (SSH brute-force, C language, ~2018)
  │
  ├── Initial access: brute-forces weak SSH credentials
  │
  └── Delivers payload bundle:
       │
       ├── ShellBot (Perl IRC bot, C2 via port 6667)
       │     └── DDoS, lateral movement, command execution
       │
       ├── mdrfckr RSA key injection ← THE PERSISTENT BACKDOOR
       │     └── Same key reused for 6+ years
       │     └── Survives password changes
       │
       ├── XMRig / Monero miner
       │     └── Pool-based, operator-controlled
       │
       └── Hardware fingerprinter (post-2025 addition)
             └── 15-command probe: CPU, RAM, disk, arch
             └── Scores targets before deploying miner

The credential 345gs5662d34:345gs5662d34 is a botnet propagation marker — a password the mdrfckr campaign sets on machines it compromises so the operator can return later. Other nodes in the same campaign recognize the brand and skip re-exploitation. Independent honeypots (HK, UK, USA, Australia) report 2,300+ hits each. As one researcher put it: "The bots have become self-referential. They are brute-forcing the passwords that other bots set." Bot-on-bot poaching — Botnet B stealing Botnet A's fleet — is confirmed behavior.

grep -rF 'mdrfckr' /root/.ssh /home/*/.ssh /etc/ssh 2>/dev/null && echo "⚠️ COMPROMISED" || echo "✅ Clean"

Old passwords like ZAQ!2wsx2022! are deliberately retained — many servers set a password once and never change it. The operator knows a 2022 password may still be running in 2026.

Many passwords are engineered to satisfy enterprise complexity rules (uppercase + lowercase + number + special, 8+ chars): Zz123456. is the laziest possible password that passes NIST-derived policies. P@ssw0rd1234, Root888.., Master@2026 all satisfy four-class complexity. The dictionary also includes naive passwords (admin1234, jjjjjjjj) for unprotected servers. The operator has studied password policy requirements and designed for maximum coverage.

The IP block 14.103.0.0/16 (39 IPs in 3 adjacent /21 blocks) is not China Telecom. APNIC RDAP confirms it was reassigned to Beijing Volcano Engine Technology Co., Ltd. (ByteDance) in May 2022. Abuse contact: gnoc@bytedance.com. MaxMind, ip2location, and most geolocation databases still show stale China Telecom attribution — a common lag problem with portable IP block reassignments.

The Korean residential cluster (46 IPs) across Korea Telecom and SK Broadband is striking — these are home NAS devices, routers, and IoT running persistent SSH with weak credentials, never patched. HiNet Taiwan (9 IPs) shows .dynamic-ip.hinet.net rDNS — ADSL/fiber home connections. Telmex Mexico (10 IPs) — home DSL. And 4 Starlink terminals — geographically dispersed, physically remote, 24/7 operation with minimal monitoring. These aren't rented VPS — they are compromised home devices repurposed as botnet scanners.

165 hosts running end-of-life software and 82 with exposed databases — these victims were low-hanging fruit before the botnet ever reached them.

The apparent volume decline starting April 21 was not an operational wind-down. On April 21, 2026, the botnet operator silently upgraded the SSH scanning library from libssh 0.11.1 to libssh 0.12.0, rotating the HASSH fingerprint from 03a80b21afa8… to af8223ac9914…. Any monitoring system tracking only the old fingerprint would see a campaign dying. In reality, the botnet was growing — recruiting 351 fresh IPs while 186 existing nodes switched to the new toolkit. The mdrfckr RSA key, the 345gs5662d34 marker credential, the 15-command hardware fingerprint, the rival-botnet cleanup routine — all identical. Only the SSH library version changed. This is the operational security of a 6-year veteran.

The credential pair seekcy:Joysuch@Locate2020 (16 IPs) and seekcy:Joysuch@Locate2026 (3 IPs) provides a rare window into active dictionary maintenance. The same username with the year portion bumped from 2020 to 2026 means the operator reviewed the dictionary, identified a year-tagged entry, and created an updated variant — while keeping the old one (because servers set passwords once and never change them). The 2026 variant appearing on only 3 IPs suggests it was added to the dictionary very recently, during the 0.12.0 rollout.

The US share increased significantly (20.5% vs 14.1% in old campaign) — the operator is diversifying toward Western cloud providers in the 0.12.0 wave.

The fingerprint switch from libssh 0.11.1 to 0.12.0 is not a trivial library update — it's an operational rotation designed to evade signature-based detection. Any firewall, IDS, or honeypot tracking HASSH 03a80b21afa8… lost visibility on April 21. The attack traffic continued at nearly identical volume (~732 sessions/day vs ~797/day before), but under a new fingerprint that reset all detection counters.

This tells us three things about the operator:

1. They are aware of HASSH fingerprinting — the upgrade specifically changes the KEX algorithm negotiation order, which is what HASSH measures
2. They maintain the botnet as a software project — the dictionary was refreshed, new target classes added (proxy servers, OpenVPN), and version-tagged credentials updated (seekcy 2020→2026)
3. They are not done — 351 new IPs recruited in 22 days means active expansion, not wind-down. The Maxi Cable Venezuela cluster (17 IPs in one /24) suggests bulk provisioning for scale

The mdrfckr botnet with combined fingerprints now stands at 1,639 unique IPs across 84+ countries — making it, to our knowledge, one of the largest SSH credential-spraying operations documented from a single honeypot vantage point. And the only reason we caught the switch is that 186 IPs appeared with both fingerprints — the same machines, running the same payload, just with a newer SSH library. Without that overlap, the two campaigns would appear unrelated.

The same key. Six years. Now with version control.

This section presents verified corporate structures, compromised institutional endpoints, financial assessments, and takedown recommendations derived from APNIC/RIPE/ARIN RDAP records, Spamhaus ASN-DROP feeds, BGP routing data, and direct honeypot observation. All entities are named with registry-verified identifiers. This intelligence is published to enable authorized structures with legal tools and jurisdiction to act against this criminal infrastructure.

🔴 Classic shell-company rotation: same building, same phone, same abuse IRT (IRT-CLOUDIE1-HK), different company names. When one ASN is blocklisted, a new entity is registered at the same physical address with a fresh ASN. The 2026-05-06 rebranding of AS24544 to "Law's Cloud Infrastructure" demonstrates active evasion in progress.

🔴 Seychelles incorporation provides: no extradition treaties, minimal disclosure, strong corporate secrecy. "DDoS protection" branding provides plausible cover for hosting servers that specifically won't be taken down.

Legal lever: China Cybersecurity Law Art. 47 obligates Volcano Engine to investigate/remediate known botnet activity upon notice. Failure to act is itself a violation. Report to CNCERT/CC (cert.org.cn) and MIIT.

Accountability lever: SSE-listed company (688158) — persistent unresolved abuse can be raised with SSE compliance or MIIT regulators. Public company = shareholder accountability and disclosure requirements.

🟡 Invalid abuse contact confirmed by APNIC = deliberate non-responsiveness. HK corporate / Guangzhou operations split is textbook Chinese BPH pattern for international banking + domestic infrastructure.

🔴 3-year-old Venezuelan ASN with zero hosted domains, single peer, US-located IPs, and 6.6% bot density is not consistent with legitimate cable TV operations. Likely purpose-registered for botnet hosting. Report to: abuse@cogentco.com (fastest takedown path) + abuse@lacnic.net

Immediate action: Abuse report to admin@frantech.ca citing ToS violation (IRC botnet C2). If unresponsive: FBI IC3 report + ARIN escalation. FranTech is a US entity — fully subject to US CFAA and can be compelled by court order.

The two Kubernetes API findings (Pakistan NTC + Myanmar MPT) represent nation-state level risk exposure delivered by a financially-motivated botnet. Container orchestration at government/military scale with a persistent SHELLBOT backdoor creates a pathway to classified application infrastructure. Additionally, 97 IPs have exposed databases (MySQL/PostgreSQL/MongoDB/Redis) and 4 Starlink terminals in Bogota, Colombia are confirmed compromised. The cryptomining is the revenue stream. The backdoor is the weapon.

rule Outlaw_mdrfckr_2026 {
    meta:
        description = "Outlaw/mdrfckr botnet SSH key injection + attack sequence"
        author      = "LSN Threat Intelligence"
        date        = "2026-05-12"
        tlp         = "WHITE"
    strings:
        $key_comment = "mdrfckr"
        $marker      = "345gs5662d34"
        $lockr       = "lockr -ia .ssh"
        $hosts_deny  = "echo > /etc/hosts.deny"
        $chattr      = "chattr -ia .ssh"
        $rsync_dir   = ".mountfs/.rsync/"
        $satan_svc   = ".satan"
    condition:
        2 of them
}

# Detect by key comment
grep -r "mdrfckr" /root/.ssh/ /home/*/.ssh/ 2>/dev/null

# Detect by SHA256 fingerprint
ssh-keygen -l -f /root/.ssh/authorized_keys 2>/dev/null | \
  grep "MkYY9qiVsFGBC5WkjoClCkwEFW5iSjcGQF7m4n4H7Cw"

# Detect hidden botnet directories
ls -la /tmp/.bin/ /tmp/.vd/ ~/.rsync/ ~/.configrc6/ ~/.mountfs/ 2>/dev/null

# Detect masqueraded processes
ps aux | grep -E "cron|anacron" | grep -v "/usr/sbin/cron"

# C2 Server (IMMEDIATE BLOCK)
198.98.56.205    # bullshit-irc.net — IRC C2
Port 6667/tcp    # IRC plain
Port 6697/tcp    # IRC TLS

# HASSH Fingerprints (SSH client signatures)
03a80b21afa810682a776a7d42e5e6fb  # SSH-2.0-libssh_0.11.1 (original wave)
af8223ac9914f509afdadfaf5f7ee94e  # SSH-2.0-libssh_0.12.0 (upgraded wave, Apr 21)

# RSA Key SHA256
MkYY9qiVsFGBC5WkjoClCkwEFW5iSjcGQF7m4n4H7Cw

This intelligence brief is compiled from: APNIC RDAP (AS137718, AS150436, AS135377, AS55933, AS134196, AS154206, AS138152, AS142403, AS272857); RIPE NCC RDAP (AS206264, AS35100); ARIN RDAP (AS53667); Spamhaus ASN-DROP JSON feed (live, 2026-05-12); BGP.he.net (peering data, prefix ownership); LSN Honeypot (direct observation, 1,639 IPs, 51,960 sessions, April 4–May 12, 2026); Trend Micro (Oct 2018, Nov 2018, Jun 2019, Apr 2025); Microsoft Azure Security Center (May 2019); Shodan (port/service fingerprints); GreyNoise (classification data); AbuseIPDB (reputation scores). All registry data is authoritative and court-admissible. Honeypot observations represent passive collection without active intrusion.

The mdrfckr botnet is not sophisticated by nation-state standards. It does not exploit zero-days. It does not target critical infrastructure. It brute-forces weak SSH passwords on Ubuntu VMs, game servers, and business ERP systems — the kinds of servers that a small business, indie developer, or gaming community operates with a cheap VPS and a default password.

And yet: 1,639 hosts across 84+ countries, 456+ autonomous systems, every major cloud provider on the planet, Starlink terminals in rural locations, Korean home NAS devices, Indonesian web hosting, Seychelles bulletproof hosting, Venezuelan bulk VPS — all stitched together by one RSA public key that a Romanian-origin threat group has been reusing since 2018, now operated (or at minimum, maintained) by a Chinese-speaking actor who knows what 888 means, what QQ is, and how to buy VPS instances on ByteDance's cloud with Alipay.

The same key. For six years. And it still works.

That's the real story. Not the sophistication of the attack — the simplicity. The mdrfckr botnet doesn't need to be clever. It just needs ubuntu:Password01 to remain the most common credential on cloud VMs in 2026. And it is.

Data source: Cowrie SSH honeypot (port 2222). Analysis period: March 28 – May 12, 2026 (45 days, ongoing). OSINT enrichment: Shodan InternetDB (844 IPs), GreyNoise Community, Team Cymru, APNIC/RIPE RDAP. Infrastructure research: APNIC WHOIS, RIPE RDAP, Spamhaus ASN-DROP, BGP.HE, IPInfo, company websites, cPanel CSI forensics tool, independent honeypot datasets (HK, UK, USA, AUS T-POT, Azure, Cowrie 48hr). All IOCs are published for community defense. Personal data appears exactly as public registries return it.