Over 80 days of continuous passive observation (March 21 — June 9, 2026), our SSH honeypot intelligence platform captured and analyzed 26,429 attack sessions from 7,614 unique IPs across 114 countries. Cross-correlation of shared credentials, SSH fingerprints, malware downloads, and command sequences using 294,635 entity intelligence links reveals a unified picture of the global internet's security failure.

The centerpiece finding: the Outlaw/Dota3 botnet ("mdrfckr") — the world's most prevalent SSH attack campaign — operates 80 identified nodes simultaneously across Microsoft Azure, Google Cloud, Tencent Cloud, BytePlus (TikTok's cloud), DigitalOcean, and compromised national telecommunications infrastructure including Vietnam's military telecom (Viettel, led by a Major General) and Tanzania's education network (TERNET, connecting 67+ universities).

This single criminal operation plants SSH backdoors, deploys cryptominers, and maintains persistent access across the world's largest cloud providers — demonstrating that neither the $2 trillion cloud industry nor nation-state cybersecurity can prevent a Romanian/Portuguese-speaking criminal gang from weaponizing their infrastructure at will.

What is it? The Outlaw botnet (also Dota/Dota3) is the world's most prevalent SSH attack campaign, active since 2018. Named by Trend Micro from Romanian haiduc (outlaw/bandit). Kaspersky published definitive IR report April 2025 from Brazilian compromise. Independent research found mdrfckr responsible for ~80% of all interactive SSH honeypot attacks globally.

The SSH Key (check your systems):

If this key is in your ~/.ssh/authorized_keys, you are compromised. Check: grep -r "AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2" /home/*/.ssh/ /root/.ssh/

Monero Wallet: 483fmPjXwX75xmkaJ3dm4vVGWZLHn3GDuKycHypVLr9SgiT6oaZgVh26iZRpwKEkTZCAmUS8tykuwUorM3zGtWxPBFqwuxS

IRC C2: 45.9.148.99:443 (Netherlands, Stark Industries Solutions)

Six Chinese-owned cloud providers registered in Hong Kong, Singapore, and the US form the backbone of attack infrastructure. The pattern exploits the post-2020 HK National Security Law reality: HK corporate registrations no longer provide meaningful legal distinction from mainland PRC entities.

YISU Cloud (AS142403): Has an explicitly INVALID abuse contact in APNIC — meaning abuse reports go nowhere. Combined with max threat scores (100/100) and minimal BGP footprint = bulletproof hosting under HK veil.

UCloud (AS135377): Shanghai STAR Market-listed company with thin HK subsidiary using false phone (+000000000) in APNIC. Fully subject to PRC cybersecurity, data security, and national intelligence laws.

China's National Intelligence Law Article 7: "All organizations and citizens shall support, assist, and cooperate with national intelligence efforts." ByteDance, Tencent, UCloud — all subject. Whether their compromised infrastructure represents criminal abuse or state-directed activity is legally indistinguishable — which is a feature, not a bug.

The Budapest Convention Gap: The primary international instrument for cybercrime cooperation (Council of Europe, 2001) has NOT been ratified by Kazakhstan, Tanzania, Pakistan, China/Macau, or Vietnam. No foreign government can compel remediation of compromised infrastructure in these jurisdictions.

The Shared Responsibility Model: Cloud providers sell compute. Customers are responsible for what runs on it. There is no legal obligation for Microsoft, Google, or Tencent to monitor whether a $4/month VM is attacking millions of systems. When Silent Push documented FUNNULL acquiring 1,200+ Azure IPs for malware hosting, Microsoft banned them — but FUNNULL immediately acquired new IPs. The whack-a-mole game is the system working as designed.

CISA AA22-158A (NSA/FBI Joint): "PRC state-sponsored cyber actors readily exploit unpatched network devices to serve as additional access points for C2 and midpoints to conduct network intrusions." The same infrastructure pattern we observe in our data.