Between 2026-03-24 and 2026-05-19 (55+ days, ongoing), a coordinated credential-stuffing operation targeting Linux servers with database and DevOps credentials deployed 32 confirmed IPs across 16 countries and 20 autonomous systems. The campaign uses three distinct toolsets, at minimum two threat actor clusters, and infrastructure tied to a new bulletproof hosting web anchored on WHITELABEL-MNT.

Krane is not simply another SSH scanner. It is a Mirai-family derivative with a Go-based access phase, a multi-architecture tux.* dropper chain, a confirmed XMRig fork miner, and explicit credential targeting for Solana validators. Running in parallel is the mdrfckr backdoor workflow documented in TI-012, reusing the same RSA key, the same three-step authentication pattern, and the same host-scoring logic.

• 8,854 login attempts produced 303 successful authentications
• C2 and staging infrastructure spans FranTech/PonyNET, xTom Germany, and Westcall
• GPU enumeration indicates the operator is scoring hosts for higher-yield mining workloads, not just opportunistic CPU abuse
• Correlation against 5,300+ honeypot IPs shows a centrally managed fleet, not uncontrolled worm propagation

Correlation analysis across the full honeypot corpus found no independent expansion wave carrying the full postgres/oracle/zabbix/odoo/hadoop fingerprint. The operator is choosing and managing infrastructure deliberately — a significant distinction from opportunistic worm-like SSH malware.

┌─────────────┐    ┌──────────────┐    ┌─────────────────┐    ┌──────────────┐
│ PHASE 1     │───▶│ PHASE 2      │───▶│ PHASE 3         │───▶│ PHASE 4      │
│ Credential  │    │ System       │    │ Environment     │    │ Miner        │
│ Stuffing    │    │ Profiling    │    │ Validation      │    │ Deployment   │
└─────────────┘    └──────────────┘    └─────────────────┘    └──────────────┘
  SSH brute-force    uname, nproc,      writable dir test,     XMRig fork
  DB/DevOps creds    CPU model, GPU,    BusyBox/container      (not captured
  Go/libssh tools    lspci nvidia       detection, PATH        in honeypot)

                        WHITELABEL-MNT
                       (Daniel Mishayev)
                       DE address, IL code
                              │
                ┌─────────────┴──────────────┐
                ▼                             ▼
         OMEGATECH                    StormIndustries
         AS202412                     AS214472
         Seychelles shell             "Offshore LC"
         Created Jan 2026             Kentucky LLC #1375656
         Turkey physical
                                              │
                                              ▼
         GhostyNetworks  ───routes──▶  STARK-INDUSTRIES
         AS205759                      AS44477
         Kentucky LLC #1531972         Ivan Neculiti
         Created Jan 2026              Moldova/Russia, EU-sanctioned

Krane is not just an intrusion set; it is an ecosystem. Seychelles shells, Kentucky LLCs, sanctioned-route transit, and bulletproof hosts allow one campaign to move between jurisdictions faster than most abuse processes can keep up.

This campaign shares the mdrfckr RSA key, the same three-step authentication pattern (345gs5662d34), the same hardware-scoring commands, and overlapping infrastructure (W1N AS42237, OMEGATECH AS202412) with the campaign documented in TI-012 — “The mdrfckr Botnet.”

TI-012 exposed the enduring backdoor. TI-013 exposes the additional access-and-mining layer wrapped around it — turning what looked like a single botnet into a broader, brokered multi-actor campaign.

Best detection stack: HASSH + SSH banner + process telemetry + DNS to dedyn.io / bargainejuice.xyz + hunt for the mdrfckr RSA key in authorized_keys. Any one signal can be noisy; the combination is not.

Krane is the missing upper layer on top of the mdrfckr story. TI-012 showed the persistence mechanism. TI-013 shows the access pipeline, the miner staging, the Solana-aware credential targeting, and the brokered hosting web that ties the operation together.

The strongest signal in this dossier is not one wallet or one IP. It is the combination of shared credentials, shared post-auth tradecraft, shared broker infrastructure, and synchronized ASN administration. That is what transforms a pile of scanners into a campaign.

Bottom line: defenders should treat this as an active multi-actor crypto-mining ecosystem targeting administrative Linux access at global scale. If your estate still allows SSH password authentication for database or DevOps accounts, this campaign is built to find you.