๐ญ TI-2026-025C โ The Operator
Romanian IRC Nicks, a $3.50 C2 Server, and the Man Who Reads Our Research
Chapter 1: The Ghost Behind the Botnet
Eighty-one machines across twenty-nine countries. Eighteen thousand scanning sessions in forty-five days. A kill chain so automated it runs while its operator sleeps. But behind every autonomous weapon system, there is a human being who pressed the first key.
This dossier follows the evidence trail backward โ from compromised servers to IRC channels, from IRC channels to a $3.50/month VPS in New York, from that VPS to a set of Romanian nicknames active during Central European business hours, and from those nicknames to a folklore archetype that reveals more about the operator's self-image than any corporate registration ever could.
Chapter 2: The IRC Command Channel
While the world moved to HTTPS callbacks, Discord webhooks, and Telegram bots for malware command-and-control, the Outlaw operators chose a protocol from 1988: Internet Relay Chat.
This is not nostalgia. It's engineering.
The C2 Architecture
The Perl Shellbot โ dropped as part of every successful mdrfckr infection โ connects to a hardcoded IRC server at 198.98.56.205:443. Port 443 is the standard HTTPS port. To any network monitoring tool that doesn't perform deep packet inspection, this traffic appears to be an encrypted web connection. It's IRC over TCP/443 โ hiding in plain sight.
rsync process, runs in background, ignores SIGTERM, connects to IRC using randomly generated nicknames, and joins predefined channels. Capabilities include: arbitrary shell execution, DDoS attacks (UDP/TCP/HTTP floods), port scanning, and file transfer via HTTP.
Why IRC in 2026?
The operator trades sophistication for survivability. A custom HTTPS implant with domain fronting would be harder to detect โ but it would also be harder to maintain, harder to update, and dependent on cloud providers who respond to abuse reports. IRC on a $3.50 VPS at an abuse-tolerant host will outlive any sophisticated infrastructure dependent on mainstream cloud providers.
Chapter 3: FranTech Solutions โ The Perfect Host
The C2 server lives at 198.98.56.205, within the 198.98.48.0/20 prefix announced by AS53667 (PONYNET), operated by FranTech Solutions, doing business as BuyVM.
The Company
| Entity | Detail |
|---|---|
| Legal Name | FranTech Solutions |
| DBA | BuyVM (buyvm.net) |
| ASN | 53667 โ branded as "PONYNET" |
| Founder | Francisco Dias |
| Locations | Las Vegas, NV & New York, NY (datacenters) |
| Entry Price | $3.50/month KVM VPS โ no ID verification |
| Abuse Page | buyvm.net/abuse/ โ returns 404 |
FranTech/BuyVM occupies a deliberate market position: the hosting provider that doesn't ask questions. Their corporate website (frantech.ca) redirects entirely to BuyVM, as if trying to outrun its own reputation. The LowEndTalk hosting community has documented years of rebranding attempts:
โ LowEndTalk community post about FranTech โ BuyVM transition
Our Own Intelligence on PONYNET
FranTech isn't just hosting the mdrfckr C2. Our honeypot has recorded attacks from 19 distinct IPs within the 198.98.48.0/20 prefix alone:
| IP | Threat Score | Hits | Role |
|---|---|---|---|
198.98.52.145 | 82 | 12 | Active scanner |
198.98.55.60 | 75 | 18 | Active scanner |
198.98.50.7 | 75 | 6 | Scanner |
198.98.56.215 | 71 | 6 | Scanner (10 IPs from C2!) |
198.98.56.205 | 61 | 4 | THE IRC C2 SERVER |
198.98.60.130 | 58 | 0 | Enrichment-flagged |
The C2 server itself (198.98.56.205) has been seen by our honeypot making 4 scanning attempts โ suggesting the IRC server doubles as a reconnaissance node. And 198.98.56.215, just 10 IP addresses away on the same /24, is an active scanner with threat score 71. This is not coincidence. The operator likely controls multiple VPS instances on the same provider.
๐ The Deeper Question: Provider Complicity vs. Negligence
FranTech's abuse page returns 404. They host Tor exit nodes, known spam infrastructure, and now a confirmed IRC C2 for a multinational botnet. The standard explanation is "abuse-tolerant hosting" โ a company that prioritizes customer retention over abuse response.
But consider: 19 malicious IPs on one /20 prefix hitting a single honeypot. At what point does negligence become de facto complicity? At what point does "not asking questions" become "knowing the answer and choosing not to hear the question"?
Francisco Dias built a business model where the product is plausible deniability. The customers pay $3.50/month for a VPS. What they actually buy is the guarantee that no one will look too closely.
Chapter 4: The Romanian Haiduc
The name "Outlaw" is Trend Micro's taxonomy label. The operators didn't choose it. But they did choose what came before โ and what came before tells us everything.
The Hacking Tool Called "Haiduc"
The original propagation tool used by this group was named haiduc. Trend Micro (2018): "Translation derived from the Romanian word haiduc, the hacking tool the group primarily uses."
In Romanian and South Slavic folklore, a haiduc (hajduk) is an outlaw-brigand-rebel figure. Part Robin Hood, part highwayman. Someone who robs the Ottoman tax collectors, the feudal lords, the powerful. The haiduc is not a common criminal โ he is a folk hero who steals from those who steal from everyone else.
This is how the operators see themselves. Not as criminals mining someone else's electricity. As rebels taking back what the cloud providers, the corporations, the systems of power have taken from everyone else.
The self-mythologizing is precise and culturally specific. It could only come from someone who grew up hearing haiduc stories.
The IRC Nicks
Trend Micro's 2018 report documents the IRC operator nicknames observed in the command channels:
| Nick | Analysis | Cultural Context |
|---|---|---|
luci | Short for "Lucian" โ common Romanian male name | Top-20 Romanian male name; informal truncation standard in chat |
lucian | Full Romanian male name | Latin-derived name widespread in Romania |
dragos | Romanian for "dear/beloved" (also historical figure) | Dragoศ โ founder of Moldavia in Romanian legend |
mazy | Anglicized handle | Possibly from "mazฤre" (pea) โ Romanian slang for someone small/quick |
The C2 Domain
In the 2018 campaign wave, the C2 domain was luci.madweb.ro:
.roโ Romanian top-level domainluciโ matches the IRC nick, short for Lucianmadwebโ suggests a web hosting or underground service brand
The operator registered a C2 domain in their own country's TLD, using their own chat nickname as the subdomain. This is either breathtaking arrogance or the confidence of someone who knows Romanian law enforcement has limited capacity for cybercrime prosecution โ or both.
The Working Hours
โ Trend Micro, Outlaw Report (2018)
Activity concentrated in Central European Time (CET) business hours. Romania is EET (UTC+2/+3) โ one hour ahead of CET. The pattern is consistent with operators who:
- Treat this as a job, not a hobby
- Have a regular daily schedule (9-5 ยฑ timezone)
- May have other employment (botnet as side income)
- Do not operate during Romanian nights or weekends
Chapter 5: "mdrfckr" โ The Username Decoded
Every compromised machine gets one file written to /root/.ssh/authorized_keys: the RSA public key with the comment field mdrfckr. Eighty-one IPs in our observation window. All carrying this same calling card.
The Etymology
mdrfckr is almost certainly a vowel-stripped abbreviation of "muie de la frate" โ Romanian vulgar slang that roughly translates to "BJ from a brother/bro." This is a common Romanian internet insult and greeting in gaming and underground contexts. It is crude, masculine, and extremely common in Romanian online spaces.Critical distinction: This does NOT translate meaningfully to Portuguese or English. The phonetic pattern and cultural context are exclusively Romanian. The common English interpretation "motherfucker" is wrong โ it's not the English slur abbreviated, it's the Romanian one.
The username is both a taunt and a cultural fingerprint. Like a graffiti tag that only locals understand, it marks territory in a language that most security researchers won't recognize.
The Key That Never Changes
The RSA backdoor key is the single persistent identifier across the entire campaign history. Passwords change. HASSH fingerprints diversify. C2 domains rotate. But the SSH key โ the mdrfckr key โ has remained identical from 2018 to June 2026. This tells us something profound about the operator: they have never lost control of their private key. No compromise, no law enforcement seizure, no operational accident has forced them to rotate it in eight years.
๐ Why Keep the Same Key for 8 Years?
The standard security practice is key rotation. The standard criminal practice is to change identifiers when heat increases. The mdrfckr operator does neither. Why?
Hypothesis 1: The key IS the infrastructure. Changing it means losing access to every previously-compromised host simultaneously. The key is the single thread connecting 81+ machines across 29 countries. Cut that thread and the entire network fragments.
Hypothesis 2: The operator has never been seriously threatened. Eight years without arrest, without key compromise, without operational disruption. The key persists because nothing has ever forced it to change.
Hypothesis 3: There is no single operator anymore. The key was generated once and has been shared among a small crew. Changing it requires coordination across multiple people who may not fully trust each other. The key persists because changing it is a political problem, not a technical one.
Chapter 6: The 345gs5662d34 Protocol
Among the tens of thousands of credential pairs used in SSH brute-force attacks, one stands out as a unique operational signature: 345gs5662d34:345gs5662d34.
This credential is designed to fail. It is not an authentication attempt โ it is a protocol signal.
The Three-Step Authentication Sequence
| Step | Credential | Expected Result | Purpose |
|---|---|---|---|
| 1 | 345gs5662d34:345gs5662d34 | FAIL | Connection probe โ confirms target accepts SSH |
| 2 | root:3245gs5662d34 | Success = already owned | Re-infection check โ if this works, host was compromised in a prior wave |
| 3 | root:<password> | Success โ payload | Actual exploitation attempt |
Step 2 is the elegant part. Infected hosts have their root password set to 3245gs5662d34. If this credential succeeds with zero follow-up commands, the scanner knows the machine is already compromised and moves on. It's a botnet membership check โ like knocking a pattern on a door.
The credential string
345gs5662d34 is not random. It is 12 characters, alphanumeric, beginning with digits. It appears to be a truncated hash or a specific password-generation pattern. The same string (with prefix "3" as 3245gs5662d34) is used as the post-compromise root password. This indicates the operator has a specific password generation algorithm or template โ a fixed operational artifact that has remained constant across waves.
Chapter 7: The HASSH Fingerprints
SSH clients announce their capabilities during the handshake. The HASSH algorithm fingerprints these announcements into a hash. For the mdrfckr campaign, these fingerprints tell the story of operational evolution.
The Primary Fingerprint
Six hundred and sixteen IPs sharing one SSH client fingerprint. This is not random โ this is a fleet. Every one of those 616 machines is running the same compiled binary, the same libssh 0.12.0 scanner, the same automated propagation tool. They are the botnet's nervous system, endlessly probing for new hosts to colonize.
The Wave 3 Addition
The second fingerprint appeared precisely when NINGI researcher "pagzlol" documented the first. The timeline is not subtle:
y6ekwUbyoOkk, uses libssh 0.12.0 onlyChapter 8: The Operator Who Reads Our Research
The most chilling evidence of the mdrfckr operator's awareness comes not from network telemetry, but from their credential lists.
Username: HONEYYYFAGGOT
Password: HONNEYPOT-FAG-GO-FUCK-YOURSELF-SKID
This isn't a functional credential. It's a message. Written directly into the brute-force dictionary, it fires against every honeypot the scanner encounters. The operator knows honeypots exist. Knows researchers are watching. Knows this credential will appear in published analysis. And sends a message anyway.
The Wave 3 OPSEC improvements are a direct response to published research. NINGI-WRITEUP-015 states explicitly: "Whoever is operating mdrfckr appears to have read analysis of wave 1/2 (either public reporting or through their own monitoring of honeypot interactions) and responded by removing the most obvious forensic correlator: the shared password."
What the Operator Changed (and What They Couldn't)
| Element | Changed? | Why/Why Not |
|---|---|---|
| Shared password | โ Yes โ now random per session | Direct response to it being used as campaign correlator |
| HASSH fingerprint | โ Partially โ added second | Diversification against HASSH-based blocking |
| SSH RSA key | โ No | Changing would sever access to existing infrastructure |
| Kill chain commands | โ No | Too deeply embedded in automation scripts |
lockr -ia .ssh | โ No | Present in every script, never executes (vestigial) |
345gs5662d34 credential | โ No | Required for re-infection check protocol |
| XMRig masquerade name | โ No | kswapd0 is functionally optimal |
The operator is intelligent enough to read research, understand what is being tracked, and modify the most visible indicators. But they are constrained โ the architecture they built in 2018 has become a cage. Change the SSH key and you lose the botnet. Change the credential protocol and existing nodes can't recognize each other. The operator is trapped inside their own success.
๐ The Metacognitive Arms Race
Consider the layers:
- We observe the operator. (Honeypot โ NINGI โ this dossier)
- The operator observes us. (HONEYYYFAGGOT credential, Wave 3 timing)
- We observe that the operator observes us. (This chapter)
- The operator will read this dossier. (Guaranteed โ they monitor publications)
So what does the operator do after reading this? They cannot change the SSH key. They cannot change the 345gs5662d34 protocol. They cannot change the lockr fingerprint. They can only change what is already public โ passwords, client versions, connection patterns. By publishing this analysis, we have defined the unchangeable boundaries of their operational freedom.
This is not a report. It is a move in a game.
Chapter 9: The Portuguese Question
If the operator is Romanian, why does Kaspersky's 2025 Brazil incident contain Portuguese-language comments in the Perl Shellbot?
Three Hypotheses
The original operators (Romanian: lucian, dragos) recruited Portuguese/Brazilian speakers into the operation. The Perl Shellbot template was modified by a Brazilian member who added Portuguese comments. This is consistent with the underground freelance market where specialized skills (Perl coding, infrastructure setup, money laundering) are purchased across language barriers.
The Perl Shellbot code was not written by the mdrfckr operators. It was sourced from public GitHub repositories, underground forums, or purchased from a Brazilian malware author. The Portuguese comments predate the Romanian operators' adoption of the code. This is consistent with the Shellbot's generic capabilities (DDoS, shell exec, file transfer) โ it's a commodity tool, not a custom-developed weapon.
The Portuguese comments are deliberately planted false flags. A Romanian operator who understands attribution methodology could inject Portuguese strings to confuse national-origin analysis. This is more sophisticated than typical Outlaw behavior but not impossible for an operator who reads published research.
Chapter 10: The lockr Ghost
In every mdrfckr kill chain execution we have observed โ across 81 IPs, across three documented waves, across eight years of campaign history โ one command appears and fails:
bash: lockr: command not found
The command is present in the secure.sh script template. It executes. It fails. It has never succeeded on any honeypot. It has likely never succeeded on any real host either, because lockr is not a standard Linux utility.
What Is lockr?
The command lockr -ia .ssh appears to be an attempt to call a custom binary that would apply chattr +ia (immutable + append-only) to the .ssh directory. The actual immutability is achieved later in the script with the standard chattr +ia command. The lockr call is vestigial โ a remnant of an earlier version of the toolchain where the operator compiled or installed a custom utility for this purpose.
๐ The Archaeology of lockr
Why hasn't it been removed?
The operator updates passwords, adds HASSH fingerprints, rotates strategies. But lockr persists through every version. This tells us the script modification process is additive, not rewriting. The operator adds capabilities on top of existing code but does not clean up dead paths. This is consistent with:
- A non-programmer operator who modifies scripts by copy-paste rather than understanding the full codebase
- An operator who fears removing any line might break something else (cargo cult programming)
- Multiple operators working on the same template, with no one understanding which lines are necessary
The lockr command is a fossil. Like an appendix in the human body โ it tells us about the evolutionary history of the organism without serving any current function.
Chapter 11: The Profile
Synthesizing all evidence, the mdrfckr operator profile emerges:
Chapter 12: The Question of Justice
No one has been arrested. In eight years of continuous operation โ from the first haiduc scans documented by Trend Micro in 2018, through the Kaspersky incident in Brazil in 2025, to the 81-machine swarm hitting our honeypot in 2026 โ no law enforcement action has disrupted this operation.
Why?
๐ The Tolerance Question
Consider what it means for a botnet to operate continuously for eight years without disruption:
- Either law enforcement is genuinely unable to act (resource constraints, jurisdictional fragmentation)
- Or someone decided this particular operation is not worth disrupting
- Or the operation serves a purpose that outweighs its cost
A persistent SSH scanner that compromises servers across 29 countries and maintains persistent access via SSH keys is, from an intelligence perspective, a pre-positioned access network. Whether or not the current operator understands this, the infrastructure they've built โ 81+ machines with root SSH access across government, education, telecom, and cloud networks โ has intelligence value far exceeding its cryptomining revenue.
Who benefits from a distributed access network spanning Tanzania's education system, Afghanistan's government networks, Korean telecoms, and Microsoft Azure?
Perhaps no one currently. Perhaps the mining revenue is genuinely all there is. But the capability exists. And capabilities, in the intelligence world, eventually find buyers.
What We Know. What We Don't.
- Romanian-speaking operator(s), active since 2018
- IRC nicks: lucian, dragos, luci, mazy
- C2 domain: luci.madweb.ro (historical), 198.98.56.205:443 (current)
- Tool of choice: libssh 0.12.0 scanner, Perl Shellbot, XMRig as kswapd0
- OPSEC: reads published research, adapts within architectural constraints
- Revenue: Monero mining, $15-50/day at current scale
- Real identities behind lucian/dragos/luci/mazy
- Physical location (Romania likely, but could be Romanian diaspora anywhere in EU)
- Total revenue (Monero wallet balance not publicly queryable)
- Whether the operation has been sold, inherited, or franchised since 2018
- Whether any intelligence service has approached the operator
- Whether the pre-positioned access has ever been used for purposes beyond mining
Conclusion: The Man in the Machine
The mdrfckr operator is not a ghost. He is a Romanian-speaking male in his 30s or 40s who works weekdays, reads security research, names his tools after folk heroes, and has maintained the same SSH key for eight years because he has never needed to change it. He taunts researchers with crude credentials because he can. He adapts his passwords because he must. And he persists because no one โ not the FBI, not DIICOT, not FranTech, not Microsoft, not any of the 29 countries hosting his infrastructure โ has decided that a $3.50/month IRC server running a $50/day cryptominer is worth the paperwork.
The haiduc rides on.