Chapter 1: The Name That Names Itself

What is "mdrfckr"?

The string appears in one place: the comment field of an RSA public key. In the language of SSH, this comment is optional metadata — a label for the key's owner. Legitimate keys might say "john@workstation" or "deploy-key-production." This one says mdrfckr.

It is a deliberate provocation. A signature. A dare. The operators have chosen to mark every machine they compromise with profanity — a middle finger embedded in the authorized_keys file of tens of thousands of servers. It says: we were here, we don't care that you know, and you can't stop us anyway.

The key itself:

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr

This is the same key found by:

• Trend Micro in November 2018 — first discovery
• CoinDesk reporting in June 2019
• Antiy Labs in January 2025
• Kaspersky GERT in March 2025
• CyberCloud/University Politehnica Bucharest in 2025
• Our own Cowrie honeypot in June 2026

Eight years. Same key. Zero rotation.

In legitimate cryptographic practice, key rotation is the most basic security hygiene. You rotate keys because compromise is assumed to be a matter of when, not if. The mdrfckr operators have never rotated their key. This tells us something profound: they have never experienced a consequence that would motivate key change. No takedown, no arrest, no infrastructure seizure has ever invalidated this key pair. The private half remains exclusively in their possession.

Why "Outlaw"?

The security industry name — "Outlaw" — was assigned by Trend Micro in 2018. It is a translation of the Romanian word haiduc: the name of the brute-force scanning tool the group primarily uses.

In Romanian folklore, the haiduci (plural) were rebel outlaws of the Ottoman period — part Robin Hood, part guerrilla fighter, part bandit. They robbed the rich, sometimes redistributed to the poor, always operated outside the law. They are lionized in folk songs, ballads, and national mythology. The most famous haiduc, Pintea Viteazul (Pintea the Brave), is a Romanian national hero.

The naming is not accidental. The tool's Romanian creator named it after cultural heroes who stole from the powerful. The self-mythology is: we take from those who have too much (computing power) and redistribute (to our Monero wallets).

But the haiduci of folklore robbed Ottoman tax collectors. This group robs Ethiopian telecom engineers and Bangladeshi university IT departments. The mythology is aspirational. The reality is parasitic.

Chapter 2: The Kill Chain — Anatomy of Four Seconds

Phase 1: Entry (SSH Brute Force)

The propagation begins with the haiduc tool scanning IP ranges for SSH servers accepting password authentication. It tries credential lists from /tmp/up.txt — typically root:root, admin:admin, test:test, oracle:oracle, and hundreds more. When a credential works, the kill chain begins.

Our honeypot sees this constantly. Between May 20 and June 10, 2026: 19 unique IPs attempted the mdrfckr key injection. These IPs are not the operators — they are already-compromised machines running the propagation tool on behalf of the botnet.

Phase 2: Persistence (SSH Key Injection + Password Change)

cd ~ && rm -rf .ssh && mkdir .ssh && echo 'ssh-rsa AAAA...oRw== mdrfckr'>>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

This single command: deletes all existing SSH keys (cutting off any other access), creates a fresh .ssh directory, injects the mdrfckr public key (granting permanent operator access), and sets permissions to lock out other users.

Simultaneously:

echo $(whoami):modzmodz | chpasswd

The password of whatever user was compromised is changed to "modzmodz" — another operator marker. The original administrator can no longer log in with their old password. The SSH key is the only remaining access method. The machine now belongs to the botnet.

Phase 3: Territory (Competitor Elimination)

The script .configrc5/a/init0 scans all running processes. Anything consuming >40% CPU that isn't whitelisted gets killed. The whitelist:

• kswapd0 — their miner (disguised as kernel memory management)
• rsync — their IRC bot (disguised as backup utility)
• tor — their mining pool proxy
• httpd, blitz, mass — other tools they use

This is digital turf warfare. The mdrfckr botnet doesn't just infect — it claims exclusive ownership. Other botnets (Redtail, TeamTNT, Kinsing) are all competing for the same pool of weakly-protected servers. The first thing mdrfckr does after gaining access is evict all competitors.

Think about what this implies: there is a contested commons of other people's computers. Multiple criminal enterprises are fighting for exclusive access to the same stolen resource. This is not cybercrime as anomaly — this is cybercrime as economy, with competition, territory, and market dynamics.

Phase 4: Monetization (XMRig Deployment)

The binary .configrc5/a/kswapd0 is XMRig version 6.19.0, UPX-packed, compiled for CPU-only mining. It connects to pool.hashvault.pro:443 and begins hashing Monero. The process name mimics kswapd0 — a legitimate kernel process responsible for memory page swapping. An administrator checking top would see high CPU usage from what appears to be the kernel doing memory management.

The mining configuration uses:

• CPU-only (no GPU, maximizing compatibility with VPS/cloud instances)
• Multiple pools with failover
• Tor-accessible backup pool for anonymity
• Randomized worker names

Phase 5: Command & Control (Perl IRC Shellbot)

The file .configrc5/b/run is a Perl script — the IRC Shellbot. Obfuscated via perlobfuscator.com, it connects to 198.98.56.205:443 (the FranTech/BuyVM IRC server). It disguises its process as rsync. Once connected, it joins a predefined channel and waits for commands.

The bot supports: DDoS attacks (UDP/TCP flood), port scanning, reverse shell, file download/upload, and arbitrary command execution. It is a full remote access tool hidden inside a Perl script connecting to IRC over the HTTPS port.

Phase 6: Propagation (Haiduc Self-Replication)

Finally, the haiduc scanner is deployed on the victim machine. It begins scanning local subnets (192.168.0.0/16, 172.16.0.0/16) and random external IP ranges for more SSH servers with weak credentials. When it finds one, the cycle repeats.

Each victim becomes an attacker. The 19 IPs that hit our honeypot this month are themselves victims. Filing an abuse report against them punishes the zombie, not the necromancer.

Chapter 3: The Infrastructure That Enables Everything

198.98.56.205 — The IRC Server That Won't Die

Every compromised machine connects to 198.98.56.205 on port 443. This is the command-and-control nexus. It runs on FranTech Solutions / BuyVM (AS53667), a Canadian-founded hosting provider that advertises:

• "DDoS-protected" VPS hosting
• Cryptocurrency payment accepted
• Privacy-focused operation
• Starting at $2/month

Francisco Dias, the founder, operates from Canada/Nevada. BuyVM is ARIN-registered. This is not dark web infrastructure — it is commercially available hosting that happens to be very tolerant of what its customers run.

The question nobody asks: This IP has been documented as mdrfckr C2 in:

• Academic papers
• Kaspersky incident reports
• Multiple threat intelligence platforms
• Our own entity-link graph

For at least four years.

Has anyone ever filed an abuse report? If so, what happened? If BuyVM received a report documenting that 198.98.56.205 is an IRC C2 for a botnet controlling tens of thousands of servers — and did nothing — that is a business decision, not an oversight. If nobody filed the report, that is a collective failure of the entire security industry that documents threats but never acts on the documentation.

The Bulletproof Hosting Ecosystem

FranTech is not unique. The mdrfckr infrastructure spans:

• MEVSPACE (Poland) — propagation nodes, minimal KYC
• W1n Ltd (AS42237) — UK-registered, active attacker infrastructure
• Private Layer INC (AS51852) — Swiss privacy hosting

These are not "bulletproof" in the classic sense (they won't host child exploitation or terrorism). They are "abuse-complaint-resistant" — operating in a gray zone where a service like IRC is legitimate, Monero mining is legitimate, and proving that a specific customer's traffic is criminal requires more effort than any single abuse reporter is willing to invest.

The Mining Pool — Where Stolen Compute Becomes Money

pool.hashvault.pro is a Monero mining pool. It accepts hashrate from anyone. It does not verify that the compute power connecting to it was legitimately obtained. The pool takes a fee (typically 0.9-1%) from every block reward and distributes the rest to miners based on contributed hashrate.

HashVault's business model is straightforward: more hashrate = more fees. Whether that hashrate comes from a data center purchased by a legitimate miner or from 10,000 compromised university servers in developing nations is — from HashVault's perspective — irrelevant.

This is the monetization layer that makes everything possible. Without mining pools willing to accept anonymous hashrate, there would be no botnet. The pool is the fence that converts stolen goods (compute) into money (XMR).

Chapter 4: The Victims Nobody Counts

Who Is Being Compromised?

Our honeypot data reveals the geographic distribution of mdrfckr propagation nodes — machines that are already compromised and now scanning on behalf of the botnet:

Notice the pattern: these are not random. The botnet preferentially occupies infrastructure where:

1. IT budgets are minimal or nonexistent
2. SSH key management is not practiced
3. Servers stay unpatched for years
4. Abuse reports have no enforcement mechanism
5. Electricity is subsidized (theft harder to detect via billing)
6. There is no security vendor presence to detect anomalies

The Cloud Provider Problem

But it's not just developing nations. Our data shows 46 BytePlus/ByteDance IPs and 7 Microsoft Azure IPs actively propagating the botnet. These are machines belonging to customers of trillion-dollar companies.

Why don't cloud providers detect this?

The detection signatures are trivial:

1. SSH key injection from external IP → alert
2. Sustained 100% CPU from process named "kswapd0" that isn't actually kswapd0 → alert
3. Outbound IRC traffic to 198.98.56.205:443 → alert
4. Outbound connections to known mining pools → alert

Any one of these is detectable with basic behavioral analysis. The combination is unmistakable. And yet: 46 BytePlus instances running the mdrfckr payload simultaneously.

The conspiracy theory writes itself, but the truth is probably more banal: perverse incentives. An infected VM running a miner at 100% CPU is a VM that might need to be upgraded to a larger instance. A customer notified of compromise might leave the platform. The financial incentive to detect and remediate is negative.

Chapter 5: The Questions Nobody Asks

Q: Why has this botnet survived eight years with zero evolution?

A: Because nothing has forced it to evolve. The attack surface (Linux servers with password-based SSH authentication and weak credentials) has not meaningfully shrunk since 2018. Cloud providers default to password auth. Universities don't enforce key-only access. The developing world's servers were installed once and never maintained. When your prey never develops defenses, you don't need to develop new weapons.

Q: Who benefits from the botnet's continued existence?

A: More parties than you'd expect:

• The operators — passive Monero income
• Mining pools — fee revenue from botnet hashrate
• BuyVM/FranTech — hosting revenue from C2 ($2-10/month)
• Cloud providers — infected customers consume more resources = more revenue
• Security vendors — the threat's existence justifies product sales
• Researchers — publications and conference talks

Everyone in the ecosystem benefits from the botnet's existence except the victims. And the victims have no voice — they're a university in Bangladesh, a hospital in Ethiopia, a small business in Mexico.

Q: Is this negligence or structural complicity?

A: The distinction may not matter. If ByteDance's cloud hosting 46 active botnet nodes produces the same outcome as if they were deliberately providing infrastructure — does intent matter? The philosopher would say yes. The Ethiopian IT administrator whose server was stolen would say no.

Q: What would it actually take to shut this down?

A: Technically: one abuse report to BuyVM about 198.98.56.205, taken seriously, kills the C2. The botnet's IRC architecture has a single point of failure — the central server. No server, no commands. The bots would continue mining (the XMRig config has embedded pool addresses) but would lose coordination, DDoS capability, and the ability to receive updates.

Practically: BuyVM would need to enforce their ToS. Or ARIN would need to threaten AS53667's address space. Or the FBI (the IP is in Nevada) would need to issue a takedown. None of these have happened in four years. Predict whether they will happen in the next four.

Q: Who are the operators, really?

A: Romanian nationals. Almost certainly a small crew (2-5 people). Evidence:

• "Haiduc" = Romanian cultural reference
• Romanian IRC channels documented as coordination space
• Portuguese code comments suggest Portuguese-speaking collaborator (Romanian diaspora in Brazil is significant)
• The credential "345gs5662d34" — meaningless in English but might have Romanian keyboard-layout significance
• Operating hours (from temporal analysis) consistent with Central European Time

But "Romanian" is geography, not identity. We don't have names. We don't have faces. We have a dialect, a cultural reference, a timezone, and a trail of stolen compute stretching across 84 countries for eight years.

Q: Is this "advanced"?

A: No. This is the opposite of advanced. It is brutally, insultingly simple. SSH brute-force with common passwords. A Perl script from the 1990s. IRC for C2. XMRig downloaded from a tar archive. The entire operation uses no zero-days, no novel techniques, no sophisticated evasion. It works not because it's clever but because the targets are neglected. It is advanced only in the sense that a pickpocket targeting tourists in a crowded market is "advanced" — the skill is target selection, not technique.

Q: What does "345gs5662d34" mean?

A: Unknown. Theories:

• Random string chosen once, never changed (operational habit)
• Internal identifier (operator nickname, crew code)
• Keyboard pattern on specific layout (test this with Romanian/Portuguese keyboard maps)
• Truncated hash of something meaningful

What we know: it's used as both username and password. This means it's not a credential — it's a handshake. When the botnet scans for SSH servers and tries 345gs5662d34:345gs5662d34, it's not trying to break in. It's asking: "Are you one of mine?" If the server accepts this credential, it was already compromised by the botnet. It's a roll-call, not an attack.

Chapter 6: The Conspiracy of Comfortable Neglect

Why Security Researchers Document But Don't Act

The mdrfckr botnet has been documented by:

• Kaspersky (2025) — full incident response report
• Trend Micro (2018) — original discovery and naming
• Antiy Labs (2025) — ongoing activity analysis
• CyberCloud/UPB Romania (2025) — honeypot capture
• Multiple independent researchers (2019-2026)
• This investigation (2026) — live honeypot confirmation

Not one of these has resulted in:

• An arrest
• A C2 takedown
• An ISP depeering
• A hosting provider enforcement action
• A law enforcement investigation (publicly known)

Why? Because the security industry's incentive structure rewards documentation over action. A Kaspersky blog post generates brand awareness. A Trend Micro threat report justifies product licensing. A conference talk advances careers. Actually shutting down a botnet generates... nothing billable.

The botnet persists because it is useful to the industry that documents it.

The IRC Server That Nobody Reports

198.98.56.205 has been publicly documented as a botnet C2 for years. The Kaspersky report, published globally, names the infrastructure. Our threat intelligence platform has tracked it. The entity-link graph contains it.

Filing an abuse report to BuyVM is free. It takes five minutes. The evidence is overwhelming and public. And yet the server remains operational.

Possible explanations:

1. Nobody has bothered. Every researcher assumes someone else will do it. The bystander effect, applied to cybercrime.
2. Reports were filed and ignored. BuyVM's abuse handling may route reports to /dev/null when the customer pays in cryptocurrency and the evidence requires IRC protocol knowledge to evaluate.
3. Law enforcement is watching. Sometimes C2 servers are left operational intentionally so investigators can monitor the botnet. If this is the case, eight years seems... patient.
4. The server has been "cleaned" multiple times but the operator re-provisions. Taking down one VPS when the operator has cryptocurrency and a BuyVM account takes them offline for approximately the time it takes to provision another $2/month instance.

The most likely answer combines all four: some people assumed others would act, some reports were ignored, some enforcement was token, and the operational cost of re-provisioning is nearly zero.

The University Politehnica Bucharest Irony

CyberCloud, the SOC at University Politehnica Bucharest (UPB), documented mdrfckr attacks against their own honeypot. They published a detailed analysis. They are Romanian researchers studying a Romanian botnet attacking Romanian infrastructure.

UPB is one of Romania's top technical universities. Their computer science department presumably trains some of the people who will become Romania's cybersecurity workforce. And they are being attacked — 150+ times — by malware named after a Romanian folk hero, using a tool named in Romanian, operated by someone likely within their own country's timezone.

The academic publication generates a DOI and a citation. It does not generate an arrest. The irony compounds: Romanian academia studies Romanian crime and produces knowledge rather than consequence. The publication exists in the same ecosystem as the botnet — both are self-sustaining, both generate value for their operators, and neither has any mechanism to end the other.

Chapter 7: The Numbers — What Is Stolen and From Whom

Conservative Estimate (What We Can See)

Realistic Estimate (What We Can't See)

Our honeypot is one machine. We see what attacks us. The total botnet includes every machine that has been compromised and is scanning — and every machine that has been compromised and is only mining (not scanning). Kaspersky's global telemetry suggests:

What Does the Victim Pay?

For each compromised server:

• Electricity: A server running at 100% CPU draws ~200-400W more than idle. At $0.10/kWh: ~$15-30/month per machine. Across 10,000 machines: $150,000-300,000/month in stolen electricity.
• Hardware wear: CPUs running at 100% 24/7 degrade faster. RAM and power supplies fail. SSD writes from swap increase. Conservative: $50/machine/year in accelerated depreciation.
• Opportunity cost: A server mining Monero at 100% CPU cannot serve its intended purpose. University students can't access their LMS. Hospital systems run slowly. Business payroll is delayed.
• Remediation cost: When finally discovered, re-imaging a server, changing all credentials, auditing other machines — $500-5000 per incident.

The total victim cost vastly exceeds the attacker's revenue. This is not a zero-sum game — it is a negative-sum game. The operators extract $1M while causing $10-50M in damage. This is the economics of parasitism: the parasite is always smaller than the host, and always costs the host more than the parasite gains.

Chapter 8: The Romanian Underground — Context and Culture

Hackerville: The Origin Story

Râmnicu Vâlcea — nicknamed "Hackerville" by Western media — is a small city in southern Romania that became globally notorious in the 2000s for producing prolific internet fraudsters. The story is well-documented: young men in a post-communist economy with high technical education and low employment opportunities discovered that eBay scams and credit card fraud were more profitable than any available legitimate work.

The mdrfckr operators exist in this cultural context even if they're not from Râmnicu Vâlcea itself. Romania produces excellent programmers (the country's math/CS education tradition is strong) in an economy where median salary is still ~€800/month. A botnet generating €5,000-50,000/month in untraceable cryptocurrency is... transformatively lucrative by Romanian economic standards.

The IRC Culture

Romanian cybercriminal groups have historically organized on IRC. The choice of IRC for C2 is not just technical — it is cultural. These are people who grew up on IRC, who formed their criminal networks on IRC, who trust IRC as a communication medium because they understand it intimately.

The Perl Shellbot is not legacy code reluctantly maintained — it is the C2 of choice for operators who think in IRC terms. Channels = campaigns. Nicknames = bots. Operators = admins. The protocol maps naturally to botnet command structure because both emerged from the same 1990s internet culture.

Why Not Upgrade?

Modern botnets use HTTPS beaconing, DNS over HTTPS for C2 resolution, Tor hidden services, blockchain-based dead drops. These are technically superior. Why does mdrfckr still use IRC?

Because IRC works. And because the operators haven't been caught despite using it for eight years. If your OpSec is sufficient with IRC, upgrading to HTTPS C2 adds complexity without benefit. The operators are not lazy — they are correctly optimizing. The threat model they operate under (basically: none) does not require more sophisticated C2.

If law enforcement ever demonstrated the ability to take down IRC-based botnets, the operators would upgrade. They haven't needed to. This tells us more about law enforcement capability than about operator sophistication.

Chapter 9: The Institutional Failure Chain

Layer 1: Cloud Providers (Detection)

Microsoft, ByteDance, Google, DigitalOcean, OVH, Tencent — all host active mdrfckr nodes. All have security teams. All have behavioral detection capabilities. None detect the trivially-identifiable pattern of SSH key injection + kswapd0 CPU saturation + IRC traffic to a known C2.

Why: Shared responsibility model. "The customer is responsible for securing their VM." This is legally true and morally bankrupt. It's equivalent to a landlord saying "the tenant is responsible for not getting robbed" while refusing to install locks on the doors.

Layer 2: ISPs (Transit)

Ethio Telecom, PT Telekomunikasi Indonesia, UNINET Mexico — these ISPs carry the scanning traffic. Their networks are the highway the botnet uses for propagation. They could, in theory, detect and block SSH brute-force at scale. They don't because:

• Bandwidth monitoring costs money
• SSH is legitimate traffic (can't block port 22)
• Their customers would need to be notified (expensive)
• There is no regulatory requirement to detect botnet traffic

Layer 3: Hosting Providers (C2 Infrastructure)

FranTech/BuyVM hosts the C2. MEVSPACE hosts propagation nodes. Private Layer hosts related infrastructure. These providers profit from criminal customers. Their business model is designed to avoid knowing what their customers do.

Layer 4: Mining Pools (Monetization)

HashVault accepts anonymous hashrate. They do not verify that compute is legitimately sourced. They cannot — and this is by design. Monero's privacy features exist specifically to prevent transaction tracing. The mining pool is the money laundering machine that converts stolen compute into spendable currency.

Layer 5: Cryptocurrency Exchanges (Cash-Out)

Somewhere, XMR is converted to EUR or USD or RON. This is the only point where traditional financial regulation could intervene. But Monero's privacy features make tracing the specific coins impossible, and numerous non-KYC exchanges exist.

Layer 6: Law Enforcement (Prosecution)

Romanian police, FBI (C2 is in Nevada), Europol — all have jurisdiction over some part of this operation. None have acted. The reasons:

• Total damage per victim is low (electricity + depreciation)
• Victims are in 84 countries — no single jurisdiction "owns" the case
• Monero makes financial investigation impossible
• Attribution is circumstantial (language + timezone, no names)
• Prosecution resources are allocated to higher-profile cases

The result: Six institutional layers that could stop this botnet. Zero have acted. Each layer's inaction is individually rational. Collectively, it produces eight years of uninterrupted criminal operation.

Chapter 10: What If?

What if the botnet is monitored by law enforcement?

It's possible. Intelligence agencies sometimes leave criminal infrastructure operational to gather intelligence. If the FBI or Romanian SRI is monitoring 198.98.56.205's IRC traffic, they could be mapping the entire network — every bot that connects, every command issued, every target selected. Eight years of patience would be unusual but not unprecedented for organized crime investigations.

Counter-argument: No intelligence value justifies allowing a botnet to compromise hospitals and universities for eight years. The "we're watching" explanation only works if the end goal is a massive coordinated takedown with arrests. We have seen no indication this is coming.

What if this is a cover for something else?

The Perl Shellbot has capabilities beyond mining: DDoS, port scanning, reverse shells, file transfer. What if the Monero mining is the visible operation — the one that gets documented by researchers — while the actual operation is data exfiltration, network reconnaissance, or DDoS-for-hire?

A botnet of 10,000+ nodes capable of coordinated DDoS is worth far more as a service than as a Monero miner. The mining could be the "legitimate business" that keeps the servers online while the real revenue comes from selling DDoS attacks.

Counter-argument: No evidence of DDoS activity from these nodes in our data. The IRC commands we've intercepted (via Kaspersky's deobfuscation) show mining deployment, not DDoS coordination. But absence of evidence is not evidence of absence.

What if the credential "345gs5662d34" is a cryptographic key?

12 characters. Mix of numbers and letters. Used as both username AND password. What if this string is not random but derives from something — a hash fragment, a key derivation, a date-encoded identifier? Testing:

• MD5("outlaw") = a06e... (no match)
• Romanian keyboard layout mapping: no obvious pattern
• Reverse hash lookup databases: no match found
• ASCII value analysis: 51 52 53 103 115 53 54 54 50 100 51 52 — no pattern

Most likely: it was randomly typed once in 2018 and became permanent through operational habit. Like a password on a sticky note that becomes the company standard because nobody bothers to change it.

What if there are multiple operators?

Evidence for a single group: same SSH key everywhere, same credential, same directory structure, same IRC server. But: the "modzmodz" password marker is different from the historical markers. The Portuguese comments suggest a non-Romanian collaborator. Some variants use slightly different payload names (dota vs dota3).

Theory: the infrastructure is shared (one group maintains the IRC server and the payload hosting), but multiple crews use it for propagation. This would explain the variants while maintaining operational consistency. Think of it as a criminal franchise: one entity provides the tools, multiple entities deploy them.

Chapter 11: The View From June 2026

Current Activity (Our Honeypot, Last 30 Days)

As of June 2026, the mdrfckr botnet is actively attacking our infrastructure:

• 19 unique IPs attempted the mdrfckr SSH key injection
• 21 credential attempts with 345gs5662d34
• Password change commands captured (modzmodz, kTsIO5K4q24E)
• Source IPs span: South Korea, Indonesia, Mexico, Ethiopia, W1n Ltd (UK), Private Layer (Switzerland)

The botnet is not a historical artifact. It is current. It is attacking us right now. And by "us" I mean not just our honeypot but every SSH server on the internet that allows password authentication.

What Has Changed Since 2018?

Almost nothing. The operators:

• Did NOT change the SSH key
• Did NOT change the propagation credential
• Did NOT change the directory structure
• Did NOT change the C2 protocol (IRC)
• Did upgrade XMRig (from older versions to 6.19.0) — because hash algorithm changes require miner updates
• May have added collaborators (Portuguese comments)
• Expanded geographic reach (Syria, now documented)

The only change in eight years is updating the miner binary. Everything else remains static because nothing forced it to change.

Prediction

In 2028 — ten years after discovery — this same SSH key will still be active. The same IRC server will still respond on port 443. The same credential will still be scanned. And some new researcher will document it, publish a blog post, and move on.

Nothing will change until either:

1. SSH password authentication is disabled by default in major Linux distributions (unlikely — breaks too many workflows)
2. Cloud providers implement mandatory behavioral detection for cryptomining (unlikely — conflicts with legitimate mining customers)
3. Law enforcement develops a prosecutable case (unlikely — jurisdiction problems, Monero anonymity, low individual harm)
4. The operators make a mistake that reveals their identity (unpredictable but possible)
5. A more aggressive competitor takes over their infrastructure (possible — the turf war continues)

The most likely scenario is: the botnet outlives the researchers documenting it.