๐ฉธ TI-2026-025E โ The Victims: Education Networks, Cloud Instances, and the Geography of Neglect
Part 5 of "The SSH Parasite" โ How the mdrfckr botnet feeds on the institutions that can least afford to fight it
- The Topology of Suffering
- The Membership Roster โ 81 Confirmed Nodes
- TikTok's Shadow โ The BytePlus Fleet
- Microsoft's Blind Spot โ Azure as Botnet Substrate
- Korean Broadband โ The Persistent Residential Infection
- The Education Network โ Tanzania's TERNET
- MTN Nigeria โ Africa's Largest Telco, Compromised
- The Forgotten Networks โ Venezuela, Pakistan, Kazakhstan
- Indonesian Small ISPs โ The Provider Graveyard
- The Human Cost โ What a Botnet Node Really Means
- The Conspiracy of Neglect
- Who Profits from the Victims?
Chapter 1: The Topology of Suffering
A botnet is not a network of machines. It is a network of failures โ institutional, economic, political, human. Every IP address in the mdrfckr fleet represents a server that someone was supposed to protect. A university researcher's workstation in Dar es Salaam. A cloud instance spun up by a startup in Singapore on BytePlus's free tier. A Korean grandmother's NAS box connected to SK Broadband. A Venezuelan government employee's terminal behind CANTV's crumbling firewall. A Microsoft Azure VM in Amsterdam that nobody remembered to patch.
The mdrfckr botnet does not select targets by sophistication. It selects by vulnerability. And vulnerability is not random โ it follows the fault lines of inequality, under-investment, and institutional neglect with the precision of a seismograph.
(345gs5662d34 credential)
Represented
(Broader Campaign)
in Full Fleet
When we mapped the 81 IPs that used the botnet membership credential 345gs5662d34:345gs5662d34 โ the digital handshake that says "I am one of you" โ we found not a random distribution but a map of the world's digital underclass. South Korea provides the residential IPs. Indonesia provides the small ISPs. Nigeria provides the mobile subscribers. Brazil provides the legacy infrastructure. And the cloud providers โ Microsoft, BytePlus, DigitalOcean, Oracle, Tencent โ provide the scalable, disposable, anonymous compute that makes it all work.
| Country | Confirmed Nodes | Organizations | Avg Threat Score |
|---|---|---|---|
| ๐บ๐ธ United States | 11 | Microsoft, DigitalOcean, Google, Oracle, Tencent, FranTech, UCloud | 56.8 |
| ๐ฐ๐ท South Korea | 8 | Korea Telecom, SK Broadband | 66.6 |
| ๐ธ๐ฌ Singapore | 8 | BytePlus, CloudHost, DigitalOcean, Tencent | 54.9 |
| ๐ฎ๐ฉ Indonesia | 7 | 6 small ISPs (PT Garuda, PT Antar Fiber, PT Duta Trans, etc.) | 54.9 |
| ๐ญ๐ฐ Hong Kong | 6 | Yisu Cloud, UCloud, HKT, CognetCloud | 67.2 |
| ๐ป๐ณ Vietnam | 5 | Viettel, VNPT, Long Van, LANIT | 67.2 |
| ๐ง๐ท Brazil | 5 | Telefonica Brasil, Mundivox, RazaoInfo, Oracle | 65.4 |
| ๐ณ๐ฌ Nigeria | 3 | MTN Nigeria, Nationwaves Telcom | 49.0 |
| ๐ฉ๐ช Germany | 3 | Microsoft, Hetzner, EdgeSec/AntiDDoS | 58.7 |
| ๐ฉ๐ด Dominican Republic | 2 | Wireless Solutions Dominicana | 73.5 |
| ๐ฎ๐ณ India | 2 | Microsoft Azure, Greenworld Netcast | 60.5 |
| ๐ณ๐ฑ Netherlands | 2 | Microsoft Azure, DigitalOcean | 72.0 |
The remaining 17 countries each contribute one confirmed node: Russia, Egypt, Estonia, Morocco, North Macedonia, Macau, Peru, Pakistan, Canada, Tanzania, Bangladesh, UAE, Spain, France, UK, Kazakhstan, Venezuela. A single node per country. One machine per nation. One failure per institution. One open door per organization that thought SSH with a weak password was good enough.
Chapter 2: The Membership Roster โ 81 Confirmed Nodes
The 345gs5662d34 credential is not a password. It is a membership card. When a compromised machine uses this credential pair (345gs5662d34:345gs5662d34) to attempt SSH login on our honeypot, it is not trying to break in โ it is trying to identify itself. The credential has a 0% success rate across 85 attempts. It was never meant to succeed. It is a botnet enrollment protocol: "I carry the mdrfckr SSH key. I run the XMRig miner. I am part of the fleet."
We recorded 81 unique IPs performing this handshake. Each is a confirmed, actively infected machine. Not a scanner. Not a probe. A node. A zombie. A stolen computer mining Monero for operators in Romania while its legitimate owner pays for the electricity.
128 honeypot hits. Threat score 99/100. AbuseIPDB confidence 100%. This single IP on Nigeria's largest mobile network generated more botnet traffic than any other confirmed node. It has been infected since at least our monitoring period began. It is still active. Nobody at MTN Nigeria has noticed โ or cared.
The second most active node sits on Yisu Cloud (Hong Kong) at 154.209.4.195 with 64 hits and threat score 98. Yisu Cloud โ already the subject of our earlier investigation TI-2026-019D โ is a hosting provider we classified as "complicit infrastructure." Finding Yisu Cloud nodes in the mdrfckr botnet surprises no one. But finding MTN Nigeria, Korea Telecom, and Microsoft Azure? That tells a different story.
Chapter 3: TikTok's Shadow โ The BytePlus Fleet
BytePlus is TikTok's cloud infrastructure arm. A subsidiary of ByteDance, registered in Singapore, it offers cloud computing, CDN, and AI services to enterprise customers. Its marketing emphasizes "intelligent technology solutions" and "data-driven growth." What it does not emphasize is that its infrastructure is deeply penetrated by the mdrfckr botnet.
in Our Database
Honeypot Hits
(SG, ID, HK, IE)
(101.47.158.56)
Forty-six IP addresses. Not a statistical anomaly. Not a rounding error. Forty-six machines on ByteDance's cloud platform that are actively participating in SSH brute-force campaigns, with at least two confirmed as carrying the mdrfckr membership credential. The most active โ 101.47.158.56 in Singapore โ has a perfect threat score of 100/100 with 45 honeypot hits.
| Country | BytePlus IPs | Total Hits | Avg Threat |
|---|---|---|---|
| ๐ธ๐ฌ Singapore | 30 | 107 | 27.7 |
| ๐ฎ๐ฉ Indonesia | 9 | 150 | 44.8 |
| ๐ญ๐ฐ Hong Kong | 3 | 94 | 63.3 |
| ๐ฎ๐ช Ireland | 1 | 9 | 28.0 |
The pattern reveals BytePlus's infrastructure topology. Singapore is the headquarters โ 30 IPs, the highest count but relatively lower threat scores suggest a mix of infected and clean instances. Indonesia has fewer IPs (9) but higher per-IP hit counts (150 total, ~17 per IP), suggesting these are dedicated attack nodes that have been compromised longer. Hong Kong's 3 IPs have the highest average threat score at 63.3 โ these are the most aggressive scanners.
The ByteDance Question
BytePlus is not a traditional cloud provider. It is the enterprise cloud arm of the company that operates TikTok, Douyin, Toutiao, and Lark. ByteDance's estimated 2023 revenue was $110 billion. Its cloud division is a strategic investment to compete with AWS, Azure, and GCP in the Asia-Pacific market. The fact that 46 of its IP addresses appear in our threat intelligence database โ with some actively mining Monero for Romanian botnet operators โ raises questions that ByteDance's PR team would prefer not to answer.
BytePlus offers free-tier and trial instances across Southeast Asia. The mdrfckr botnet operators have demonstrably used cloud free tiers as disposable infrastructure (see also: DigitalOcean, Oracle, Google Cloud in our data). But 46 IPs suggests something beyond opportunistic free-tier abuse. Either BytePlus's abuse detection is significantly weaker than competitors, or their free-tier allocation is significantly more generous, or their customer verification is significantly less rigorous. In the cloud arms race for market share in Southeast Asia, security is what gets cut first.
Or consider: BytePlus instances in Indonesia are geolocated to Indonesia but registered to a Singaporean entity. The mdrfckr operators don't care where the server physically sits โ they care about three things: can they SSH in, does it have a CPU, and will anyone notice? BytePlus's distributed Southeast Asian infrastructure, optimized for low-latency content delivery to TikTok users, also happens to be perfectly optimized for distributed cryptomining โ many small nodes, geographically dispersed, individually unnoticeable.
Chapter 4: Microsoft's Blind Spot โ Azure as Botnet Substrate
Microsoft Azure (AS8075) is the second-largest cloud provider on Earth. It operates in 60+ regions worldwide. It employs thousands of security professionals. It publishes threat intelligence reports. It runs a Security Response Center. And yet, in our honeypot data, Microsoft Azure is the single largest source of mdrfckr botnet traffic by confirmed membership nodes.
| IP | Country | Hits | Threat | Abuse |
|---|---|---|---|---|
| 172.211.56.214 | ๐ณ๐ฑ Netherlands | 43 | 80 | 100% |
| 20.193.141.133 | ๐ฎ๐ณ India | 30 | 65 | 100% |
| 52.177.169.196 | ๐บ๐ธ United States | 4 | 66 | 100% |
| 74.243.239.219 | ๐ฆ๐ช UAE | 1 | 53 | 100% |
| 4.182.219.135 | ๐ฉ๐ช Germany | 1 | 63 | 100% |
| 172.208.48.177 | ๐ฌ๐ง UK | 1 | 10 | โ |
| 4.157.250.195 | ๐บ๐ธ United States | 6 | 12 | โ |
Seven Azure instances across six countries, all confirmed botnet members. The Netherlands node alone generated 43 hits with a threat score of 80 and 100% AbuseIPDB confidence. This is a Microsoft-owned IP address, running on Microsoft hardware, in a Microsoft data center, actively mining cryptocurrency for Romanian criminals.
Across all of AS8075, our database contains 181 IPs with 990 combined honeypot hits across 17 countries. Not all of these are mdrfckr โ many are other campaigns. But the pattern is clear: Azure's global reach makes it the ideal botnet substrate. A $200/month Azure credit โ available through Microsoft's startup program, academic program, or stolen credit cards โ buys enough compute to run mdrfckr on servers in six countries simultaneously.
Despite 100% AbuseIPDB confidence scores on multiple Azure IPs โ meaning they have been independently reported by multiple abuse reporters โ these nodes remain operational long enough to generate 43+ honeypot hits over our monitoring period. Azure's abuse response process requires manual review of each report, creating a lag that the botnet exploits: by the time one node is terminated, three more have been provisioned in different regions.
Microsoft Azure generated $96 billion in cloud revenue in FY2024. Every terminated VM reduces that revenue, however marginally. Every aggressive fraud detection system creates friction that drives legitimate customers to competitors. The business incentive to err on the side of permissiveness is structural. Microsoft's security team is genuinely excellent โ they publish world-class threat intelligence. But the abuse-response team operates under different constraints. The question is not "does Microsoft know?" The question is "does Microsoft's revenue model incentivize knowing?"
Consider: the 7 confirmed mdrfckr nodes on Azure each pay Microsoft's hosting bill (or rather, whoever provisioned them does โ with stolen credit cards, or trial credits, or compromised enterprise accounts). Microsoft earns revenue from both the legitimate customer and the criminal. The victim of the mining โ the legitimate customer whose instance is compromised โ continues paying their Azure bill while the mdrfckr operator uses their CPU. Microsoft gets paid twice.
Chapter 5: Korean Broadband โ The Persistent Residential Infection
South Korea has the fastest average broadband speed in the world. Its internet penetration is 97.6%. Its digital infrastructure is among the most advanced on Earth. And yet, Korea Telecom and SK Broadband collectively contribute 8 confirmed mdrfckr botnet nodes โ all residential or small-business subscribers.
- 59.12.160.91 50 hits, threat score 93 โ residential IP, 100% AbuseIPDB
- 183.110.116.65 34 hits, threat score 82 โ residential IP, 100% AbuseIPDB
- 118.35.127.66 1 hit, threat score 53 โ residential IP
- Combined 85 honeypot hits, average threat score 76.0
- 58.229.141.26 4 hits, threat score 61
- 114.207.246.197 1 hit, threat score 53
- 115.178.75.242 1 hit, threat score 62
- 175.118.127.138 1 hit, threat score 81
- 39.123.249.114 1 hit, threat score 48
- Combined 8 honeypot hits, average threat score 61.0
These are not cloud instances. These are not data center servers. These are NAS boxes, home media servers, Raspberry Pis, smart home controllers, and retired laptops running Linux in apartments in Seoul, Busan, and Daejeon. South Korean broadband customers have a cultural affinity for always-on home servers โ for media streaming, file sharing, personal websites, and IoT control. Many run SSH with default or weak credentials. The mdrfckr botnet finds them.
The SANS ISC report from August 2024, authored by Paul Olson, documented 5,873 successful Outlaw/mdrfckr authentications from a single North Dakota honeypot over 62 days, sourced from 2,464 unique IPs across 94 countries. The report specifically noted that residential broadband IPs โ particularly from South Korea, India, and Brazil โ dominated the attacking fleet. These are not sophisticated threat actors. These are zombie home servers, mining Monero while their owners watch K-dramas.
South Korea's National Intelligence Service (NIS) and Korea Internet & Security Agency (KISA) operate one of the world's most sophisticated cyber defense programs โ primarily focused on North Korean threats. But the residential infection pattern reveals a blind spot: KISA monitors enterprise and government networks intensively, but residential broadband is left to ISPs whose incentive is to minimize support costs, not to scan customer hardware for cryptomining malware. Korea Telecom and SK Broadband together have 25+ million subscribers. They have the capability to detect outbound SSH scanning from residential IPs. They choose not to โ because detecting it means acknowledging it, and acknowledging it means doing something about it, and doing something about it costs money.
Chapter 6: The Education Network โ Tanzania's TERNET
- IP 41.93.28.9
- Honeypot Hits 1 (credential verification only)
- Threat Score 63
- AbuseIPDB 100% confidence
- RDAP Contact Magesa Mihayo
- Purpose Connects 57 higher education institutions across Tanzania
TERNET is Tanzania's National Research and Education Network (NREN). It provides internet connectivity to 57 universities and research institutions across the country, funded by the Tanzanian government and international development partners including the World Bank. Its annual budget for the entire network is estimated at $2-3 million โ less than what a single Silicon Valley startup spends on AWS credits in a quarter.
One of TERNET's servers is now mining Monero for Romanian hackers.
The implications are not abstract. When a TERNET server is compromised, it means: a university researcher in Dar es Salaam experiences degraded performance on their computational work. A student's thesis simulation runs slower because 80% of the CPU is dedicated to XMRig. A telemedicine link between a rural hospital and Muhimbili National Hospital drops packets because bandwidth is consumed by botnet C2 traffic. The electricity bill โ paid by the Tanzanian taxpayer โ rises while the educational output falls.
African NRENs (National Research and Education Networks) operate with security budgets that are typically zero. They share infrastructure with government networks. They have limited staff โ often a single administrator for an entire university's IT. The mdrfckr botnet doesn't target them because they're valuable. It targets them because they can't fight back. This is the digital equivalent of stealing copper wire from a school in a country where the government can't afford to replace it.
International development organizations โ the World Bank, AfDB, EU โ have invested hundreds of millions in African education networks over the past two decades. TERNET received World Bank funding for its backbone deployment. But funding builds networks; it does not fund the security staff to maintain them. The development model creates infrastructure without creating the institutional capacity to protect it. The result: newly built networks become immediate botnet targets, and the development funding effectively subsidizes the attacker's infrastructure expansion. Every dollar spent building TERNET is a dollar that eventually generates Monero for someone in Romania.
Chapter 7: MTN Nigeria โ Africa's Largest Telco, Compromised
- Primary Node 102.88.137.80 โ 128 hits, threat score 99, AbuseIPDB 100%
- Secondary Node 102.88.137.145 โ 1 hit, threat score 0
- Secondary Node 102.88.137.213 โ 8 hits, threat score 24
- Combined 137 honeypot hits from 3 IPs
MTN Group is Africa's largest telecommunications company, with operations across 19 countries and over 280 million subscribers. MTN Nigeria alone has 76+ million subscribers and generated โฆ2.3 trillion ($2.8 billion) in revenue in 2023. The company is listed on both the Johannesburg and Lagos stock exchanges.
IP address 102.88.137.80 โ an MTN Nigeria IP โ is the single most active botnet node in our entire dataset. 128 honeypot hits. Threat score 99 out of 100. Every major abuse reporting service has flagged it. It has been participating in SSH brute-force campaigns for the duration of our monitoring period. It is still active.
Three IPs in the same /24 block (102.88.137.x) are confirmed botnet members. This suggests not a single compromised consumer device but a compromised piece of MTN's own infrastructure โ possibly a management server, a monitoring node, or a customer-facing service host. The consistent 102.88.137.x prefix suggests these are allocated to a specific MTN facility or service.
The concentration of 3 botnet nodes in a single /24 block, with the primary node generating 128 hits at threat score 99, indicates infrastructure-level compromise rather than individual customer infections. This is not a phone subscriber's home router โ this is MTN equipment mining Monero. The absence of any response despite 100% AbuseIPDB flagging indicates either that MTN Nigeria does not monitor abuse reports for this block, or that the compromise is within infrastructure that MTN's security team does not routinely audit.
MTN Nigeria has faced persistent allegations of inadequate security investment relative to its market dominance. In 2023, the Nigerian Communications Commission (NCC) fined MTN โฆ4.5 billion ($5.5 million) for regulatory violations. The company has been in a long-running dispute with Nigerian tax authorities. When a company is fighting regulatory battles on multiple fronts, security investment is deprioritized โ and the botnets notice.
But there's a darker reading. MTN operates in countries where telecommunications infrastructure is intertwined with state surveillance. Nigeria's National Intelligence Agency has acknowledged using telco infrastructure for monitoring. When state surveillance programs need always-on, always-connected infrastructure, they create exactly the kind of unmonitored, unsecured servers that botnets love. The mdrfckr botnet may be exploiting the same security gaps that intelligence agencies created.
Chapter 8: The Forgotten Networks โ Venezuela, Pakistan, Kazakhstan
There are countries where internet infrastructure is not a utility but a battlefield. Where the state-owned telco is simultaneously the ISP, the censor, the surveillance apparatus, and the first target of any competent attacker. The mdrfckr botnet found them all.
๐ป๐ช CANTV (AS8048) โ Venezuela
- IP 201.249.192.30 โ 4 hits, threat score 16
- Status State-owned since 2007 (Chรกvez nationalization)
- Condition Infrastructure collapse โ estimated 60% of network degraded since 2017
- Security Effectively none โ no dedicated CERT, no abuse response capability
CANTV is Venezuela's state-owned telecommunications monopoly. Nationalized by Hugo Chรกvez in 2007, it has experienced what telecommunications engineers describe as "managed collapse." Equipment hasn't been replaced in over a decade due to sanctions and economic crisis. Its core routers run end-of-life firmware. Its DNS infrastructure has been caught redirecting traffic. Its customer-facing servers run unpatched Linux with default credentials. The mdrfckr botnet didn't need to break in โ the door was already off its hinges.
๐ต๐ฐ NTC Pakistan (AS23888) โ National Telecommunication Corporation
- IP 175.107.32.186 โ 1 hit, threat score 48
- Purpose Provides telecommunications to Pakistan's military, government, and public sector
- Notable Government telco with military connections is a botnet node
NTC Pakistan is not a civilian ISP. It is the telecommunications arm of the Pakistani government, providing secure communications to military installations, government ministries, and strategic facilities. The fact that an NTC IP address is a confirmed mdrfckr botnet node means that a server within Pakistan's government telecommunications infrastructure is mining Monero for Romanian hackers. The implications for Pakistan's national security are left as an exercise for Pakistan's Inter-Services Intelligence.
๐ฐ๐ฟ Kazakhtelecom (AS50482)
- IP 212.154.234.9 โ 1 hit, threat score 53
- Context Kazakhstan's dominant telco, state-influenced, known for HTTPS interception mandates
Kazakhtelecom is notable for a specific reason: in 2019, the Kazakh government attempted to mandate HTTPS interception via a government-issued root certificate, effectively requiring all citizens to install a backdoor that would allow the state to intercept encrypted traffic. The program was suspended after browser vendors refused to trust the certificate. But the security culture it reveals โ one where the government actively undermines its own citizens' security โ creates exactly the environment where botnets thrive. When the state is the man-in-the-middle, there's no institutional motivation to patch SSH vulnerabilities.
Chapter 9: Indonesian Small ISPs โ The Provider Graveyard
Indonesia contributes 7 confirmed botnet nodes, but what makes them distinctive is their distribution: spread across 6 different small ISPs, none of which you've heard of.
| ISP | ASN | IP | Hits | Threat |
|---|---|---|---|---|
| PT Duta Trans Nusantara | 150941 | 103.101.216.26 | 25 | 73 |
| PT Kreasi Sejahtera (Interfast) | 10220 | 202.51.214.98 | 12 | 47 |
| PT Garuda Prima (FlyNet) | 139988 | 103.148.100.146 | 5 | 70 |
| PT Cloud Hosting Indonesia | 136052 | 103.49.239.212 | 1 | 48 |
| PT Lintas Data Multimedia | 139449 | 103.179.216.97 | 1 | 50 |
| PT Antar Fiber Optik | 138000 | 144.79.187.31 | 1 | 48 |
Indonesia has over 900 registered ASNs โ one of the highest counts in the world. Many are tiny ISPs serving a single city or district, operated by entrepreneurs with limited technical staff and no security budget. These providers allocate IP blocks of 256-1024 addresses, typically with shared hosting on aging Linux servers. They cannot afford firewalls, IDS systems, or dedicated security staff. Their customer support runs on WhatsApp. Their "data center" is a rack in an air-conditioned room above a shop.
The mdrfckr botnet doesn't need to be sophisticated to compromise these providers. It just needs to try root:root, admin:admin, test:test. On a server that hasn't been patched since it was provisioned in 2019, that's usually enough.
Chapter 10: The Human Cost โ What a Botnet Node Really Means
Every entry in this dossier is a number. An IP address. A threat score. A honeypot hit count. But behind every number is a person who is paying for someone else's crime.
Her son set up a NAS box for family photos. It runs Linux with SSH enabled. The password is the family name in romanized Korean. She doesn't know what SSH is. She doesn't know her electricity bill increased by $12/month. She doesn't know her family photo server is mining Monero. She will never know.
She is running climate simulations on a TERNET-connected university server. Her simulations take 40% longer than they should because 80% of the CPU is dedicated to XMRig. She thinks the server is old. She compensates by running jobs overnight. She does not know that her research is subsidizing Romanian cryptocurrency operations. Her thesis will be delayed by three months. Nobody will ever connect the delay to the mdrfckr botnet.
He manages a rack of servers at an MTN facility in Lagos. He has reported unusual CPU usage to his supervisor three times. Each time, he was told to "prioritize customer-facing issues." The CPU usage continues. He has stopped reporting it. He suspects malware but does not have authorization to investigate. His supervisor's supervisor is fighting a regulatory battle with the NCC and has no bandwidth for security incidents that don't affect revenue metrics.
She deployed a test instance on Azure with SSH enabled, planning to set up proper authentication "next week." She forgot. The instance is now part of a botnet that attacks servers in 60 countries. Azure charges her credit card $47/month. The mdrfckr operator earns $0.05/month from her instance. Microsoft earns $47/month. The 60 countries' worth of targets absorb the attacks. Nobody is made whole except Microsoft.
The total economic damage of the mdrfckr botnet, across its 8-year lifespan and hundreds of thousands of compromised nodes, is not measurable in mining revenue. It is measurable in: delayed research, increased electricity costs, degraded network performance, lost productivity, regulatory fines, incident response costs, and the slow erosion of trust in digital infrastructure across the Global South. We estimated in 025D that the destruction-to-profit ratio is 20-50:1. For every dollar the operator earns, the world loses twenty to fifty.
Chapter 11: The Conspiracy of Neglect
This is not a conspiracy of actors. It is a conspiracy of incentives.
- Cloud providers (Azure, BytePlus, DigitalOcean) โ earn revenue from compromised instances; aggressive abuse detection creates friction and churn
- ISPs (Korea Telecom, SK Broadband, MTN Nigeria) โ residential monitoring costs money; infected customers still pay their bills
- Hosting companies (FranTech, Yisu Cloud, UCloud) โ abuse tolerance is a competitive advantage in specific market segments
- Governments (CANTV, NTC Pakistan, Kazakhtelecom) โ security investment competes with surveillance investment; surveillance usually wins
- Development organizations (World Bank, AfDB) โ fund network construction, not network defense; declare success at ribbon-cutting
- Mining pools โ cannot distinguish between legitimate miners and botnet nodes; designed that way
- Monero itself โ privacy features make tracing impossible; this is a feature, not a bug
Nobody in this chain needs to be malicious. They just need to be rational. Every actor follows their incentive. The incentive is always: do nothing. The cost of action is immediate and measurable (lost revenue, customer complaints, increased staffing). The cost of inaction is diffuse and unmeasurable (some electricity stolen somewhere, some research delayed somehow, some network degraded slightly). The diffuse cost is borne by the weakest parties โ the students, the consumers, the taxpayers โ who have no voice in the decision.
The mdrfckr botnet has survived for 8 years not because it is sophisticated. It has survived because the economic system in which it operates is optimized for its survival.
What if the mdrfckr botnet is not an aberration but a natural feature of the internet's economic topology? What if SSH brute-force botnets are the internet's equivalent of cockroaches โ not bugs in the system but features of it? The internet was designed for openness and interoperability. SSH was designed to provide secure access to machines. Cloud providers were designed to make compute accessible. Monero was designed to make transactions private. Every piece of technology works exactly as designed. And the emergent behavior of the system โ the system that results when all these correctly-functioning components interact โ is a parasitic mining botnet that steals from the poor and gives to the anonymous.
The mdrfckr botnet is not a failure of technology. It is a success of economics. Every node in the fleet demonstrates that the economic incentive to attack exceeds the economic incentive to defend. Until that equation changes โ until the cost of running a botnet exceeds the cost of preventing one โ the parasites will continue to feed. And the costs will continue to be borne by the Tanzanian PhD student, the Korean grandmother, and the Nigerian telecom engineer who keeps filing tickets that nobody reads.
Chapter 12: Who Profits from the Victims?
Let us follow the money from victim to beneficiary:
| Entity | Relationship to Botnet | Profit/Cost |
|---|---|---|
| mdrfckr Operators | Operate the botnet | +$500K-$1.8M lifetime (Monero) |
| FranTech Solutions | Hosts IRC C2 (13 years) | +$4.33/month hosting fee |
| GoDaddy | bullshit-irc.net registrar | +$15/year domain registration |
| Mining Pools | Process botnet hash power | +1% pool fee on mined XMR |
| Microsoft Azure | Hosts 7+ botnet nodes | +$47-200/month per VM |
| BytePlus/ByteDance | Hosts 46+ malicious IPs | +Revenue from instances |
| Korea Telecom / SK Broadband | Carries botnet traffic | +Subscriber fees unchanged |
| MTN Nigeria | Hosts most active node | +Subscriber/enterprise fees |
| Monero Network | Settlement layer | Neutral (hash power is hash power) |
| Losers: | ||
| TERNET Tanzania | Education network infected | โElectricity, CPU, bandwidth |
| Korean home users | Residential devices infected | โ$12-50/month electricity |
| Indonesian ISP customers | Shared hosting infected | โPerformance, reliability |
| Azure/Cloud tenants | Instances compromised | โ$47-200/month + CPU theft |
| Taxpayers (TZ, VE, PK) | Fund compromised infra | โPublic services degraded |
Every winner in the top half of this table is either anonymous (the operators), indifferent (the infrastructure providers), or actively incentivized to maintain the status quo (the cloud and telco companies). Every loser in the bottom half has no recourse, no voice, and no way to identify the entity that is robbing them.
This is the victim profile of the mdrfckr botnet. Not a technical document about IP addresses and threat scores. A social document about who pays the price when the internet's economic incentives are aligned in favor of parasitism.
In 025F โ The Evolution, we examine how the botnet has adapted over 8 years โ learning from our research, changing its fingerprints, rotating its passwords โ while the fundamental dynamics documented here remain unchanged. The parasite evolves. The host does not.