🧬 TI-2026-025F — The Evolution: Eight Years of Adaptation and the Fingerprint That Never Dies

Chapter 1 — The Long Arc: 2018–2026

Most malware has a shelf life measured in months. A campaign launches, defenders document it, signatures get written, and the operators pivot to something new. The mdrfckr botnet doesn't follow this model. It has been continuously operational for eight years — not through technical sophistication, but through a strategy of minimal adaptation. It changes exactly what it needs to change to survive, and nothing more.

What follows is the documented evolutionary history of a botnet that has outlasted hundreds of security vendors' reports, multiple generations of defensive tooling, and at least three complete cycles of the cybersecurity industry's attention span.

Chapter 2 — The Three Waves of 2026

Our honeypot captured the most detailed view of a botnet toolkit transition ever documented from a single observation point. Three distinct campaign waves, each with measurable differences in tooling, operational security, and tactical behavior.

The Crossover Event: May 13, 2026

The most significant moment in our dataset isn't a spike — it's a crossover. On May 13, 2026, Wave 2 traffic (libssh 0.12.0, HASSH af8223ac...) dropped below Wave 3 traffic (libssh 0.9.6, HASSH f555226d...) and never recovered.

Wave 2 (libssh 0.12.0) Wave 3 (libssh 0.9.6)

Chapter 3 — What Changed and What Didn't

The evolutionary strategy of mdrfckr is best understood through what the operator chose to change — and what they deliberately left unchanged. Each modification has a purpose. Each invariant is a structural dependency.

The Mutable Shell

The Immutable Core

Chapter 4 — The Operator Reads Our Research

The most disturbing finding of this investigation is not the botnet's persistence — it's the operator's awareness. We have direct evidence that the mdrfckr operator monitors published security research and adapts in response.

Evidence Chain

Chapter 5 — The lockr Mystery

In every wave, in every variant, in every sample documented by every researcher over 8 years, one command appears that serves no visible purpose:

lockr is not a standard Linux utility. It fails with "command not found" on every host in every wave. It has never been observed to succeed. Yet it has never been removed from the script template.

Hypotheses

Chapter 6 — The Credential as DNA

Beyond the RSA key, the credential 345gs5662d34:345gs5662d34 serves as the botnet's immune system — a self-recognition mechanism that distinguishes "self" (already-compromised hosts) from "other" (new targets).

The Re-entry Protocol

Wave 3 introduced per-session random passwords, which means new victims can no longer be re-identified by their root password alone. But the RSA key in authorized_keys serves as the persistent marker. The credential probe 345gs5662d34 now functions as a backward compatibility check — identifying nodes from Waves 1 and 2 that haven't been re-compromised with Wave 3 tooling.

Chapter 7 — The Survival Theorem

Why has this botnet survived when hundreds of more sophisticated operations have been disrupted? The answer is not technical — it's architectural. The mdrfckr botnet is optimized for a specific environmental niche, and that niche is expanding.

The Niche

This is not a design for maximum impact. This is a design for maximum persistence. The botnet occupies an ecological niche that no defender has sufficient incentive to eradicate:

Chapter 8 — The Version History: An Evolutionary Record

Like geological strata, each component version change tells us something about what the operator prioritized at each evolutionary stage.

Chapter 9 — The HASSH Migration: A Case Study in Botnet Fleet Management

The transition from HASSH af8223ac... to f555226d... is not just a version change — it's a logistics operation comparable to a firmware update across a distributed IoT deployment. Understanding how it happened reveals the operator's command-and-control capabilities.

Day-by-Day Migration Data

Chapter 10 — The Arms Race We're Losing

The mdrfckr botnet's evolutionary trajectory reveals an uncomfortable truth: the botnet is winning the arms race. Not through superior technology — through superior adaptation speed.

The Adaptation Asymmetry

What Still Works

Despite the operator's adaptation speed, the immutable core provides permanent detection opportunities:

Chapter 11 — What Comes Next

If the operator follows their established pattern, publishing this dossier series will trigger specific responses. Based on 8 years of observed behavior, we can predict:

Expected Adaptations (High Confidence)

• New HASSH fingerprint: A third SSH library variant within 2–4 weeks of this publication
• Persistence directory change: .configrc7 or an entirely new naming convention
• XMRig update: Version increment to 6.23.x or newer, possibly with new disguise name
• New credential taunt: Expect a credential referencing "shuffle-on" or "LSN" in the next wave

Possible Adaptations (Medium Confidence)

• IRC C2 migration: If we've brought sufficient attention to 198.98.56.205, the operator may establish a backup C2 on a different BPH provider
• Package name change: dota3.tar.gz → dota4.tar.gz or something less distinctive
• Competitor displacement update: New target filenames as the rival malware ecosystem evolves

Things That Won't Change (High Confidence)

• The RSA key — changing it risks fleet fragmentation
• The 345gs5662d34 credential — the fleet's self-recognition mechanism
• The kill chain order — functionally optimized, no room for improvement
• Monero mining — the only viable cryptocurrency for this operation model
• The operator's language — Romanian cultural markers will persist in any new code

Chapter 12 — The Botnet as Organism: A Final Analysis

Over six dossiers, we have dissected the mdrfckr/Outlaw botnet from every angle: its kill chain, its infrastructure, its operator, its economics, its victims, and now its evolution. The picture that emerges is not of a sophisticated cybercrime operation — it's of an organism.

The mdrfckr botnet is not a tool that someone runs. It is an entity that lives on the internet. Its operator is less a programmer and more a rancher — tending a herd of compromised machines, updating their toolkit when predators (security researchers) get too close, moving them to new pastures (new HASSH fingerprints) when the old ones are grazed bare.

Series Conclusion — The SSH Parasite

This six-part investigation has traced a single SSH key comment — mdrfckr — from its first appearance in a 2018 Trend Micro report to its continued presence in our honeypot logs today. Along the way, we documented:

• 025A — The Anatomy: The kill chain that makes infection autonomous
• 025B — The Infrastructure: 81 confirmed botnet nodes across 29 countries
• 025C — The Operator: Romanian attribution, IRC C2 on FranTech's bulletproof hosting
• 025D — The Economics: $0.50–$2.00/day per node × 1,000+ nodes = quiet income
• 025E — The Victims: Education networks, cloud instances, state telcos — the geography of neglect
• 025F — The Evolution: Eight years of adaptation and the fingerprint that never dies

The mdrfckr botnet is not the most dangerous threat on the internet. It is not the most sophisticated. It is not the most profitable. But it may be the most durable. And in that durability lies its lesson: the internet's security model is optimized for dramatic incidents, not chronic infections. A ransomware attack on a hospital makes headlines and triggers law enforcement. A botnet that silently steals CPU cycles from 1,000+ servers across 29 countries for 8 years generates reports that nobody with enforcement authority reads.

The parasite thrives not because it is strong, but because the host — the global internet infrastructure — is structured so that no one is responsible for removing it.