๐ฐ TI-2026-025E โ The Economics: Monero, Mining Pools, and the Mathematics of Parasitic Revenue
Executive Summary: The mdrfckr/Outlaw botnet is a business. Like any business, it has revenue, costs, margins, and a supply chain. Unlike legitimate businesses, its costs are externalized entirely โ borne by victims who don't know they're paying. This analysis reconstructs the complete financial architecture: from the XMRig miner configuration that determines hashrate allocation, through the HashVault mining pool that processes the work, to the Monero blockchain where rewards accumulate, to the OTC exchanges where XMR becomes fiat.
The numbers tell a story of spectacular inefficiency: an operation that generates $3,000-11,000/month in revenue while inflicting $150,000-5,500,000/month in damage. A business with a destruction-to-profit ratio of 50:1 that persists for eight years because the costs are invisible and the profits are anonymous.
Chapter 1: The Product โ Inside XMRig's kswapd0 Masquerade
Every compromised server runs the same payload. The "product" this business sells to the Monero network is hashrate โ computational proof-of-work that validates transactions and earns block rewards. Here is exactly how it works:
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โ THE PARASITIC SUPPLY CHAIN โ โ โ โ [Victim Server] โโSSH brute-forceโโโถ [Compromise] โ โ โ โ โ โ โผ โผ โ โ tddwrt7s.sh downloads dota.tar.gz from 198.98.56.205 โ โ โ โ โ โโโโถ .configrc5/a/init0 (competitor kill) โ โ โโโโถ .configrc5/b/run (Perl IRC bot, C2) โ โ โโโโถ .configrc5/c/kswapd0 (XMRig miner) โ โ โ โ โ โผ โ โ Connects to HashVault pool (port 3333) โ โ โ โ โ โผ โ โ Mining pool allocates work units โ โ โ โ โ โผ โ โ Monero block rewards โ operator wallet โ โ โ โ โ โผ โ โ XMR โ OTC/P2P โ Fiat (EUR/RON) โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Why Is the Miner Named "kswapd0"?
The real kswapd0 is a Linux kernel thread that manages memory page swapping. Every Linux server has one.
This is process camouflage. When a sysadmin runs top or htop and sees kswapd0 consuming 100% CPU, their first thought is "memory pressure" โ a common server issue. They might add swap space, increase RAM, or simply accept it as normal. They will not investigate because the process name provides a plausible innocent explanation. The naming is a social engineering attack on the sysadmin โ it exploits their mental model of what "normal" looks like.
โ What Exactly Is in the Payload?
SHA256: a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2. Downloaded by 81 IPs from 198.98.56.205.
The dota.tar.gz archive contains three components:
(a) init0 โ a shell script that kills competing miners. It searches for other mining processes (xmrig, minerd, etc.) and terminates them. This is the "turf war" module โ parasites competing for the same host.
(b) run โ a Perl IRC bot (ShellBot variant, obfuscated via perlobfuscator.com). Connects to an IRC C2 channel. Receives commands: scan new targets, update miner, DDoS. The brain.
(c) kswapd0 โ the XMRig binary itself. Configured to mine Monero using the RandomX algorithm. Connects to the mining pool on port 3333. The money maker.
โ Why Does the Botnet Kill Competing Miners?
The init0 script specifically hunts for and kills other cryptocurrency miners on the same system.
CPU is a finite resource. Two miners on one host each get ~50% of the hashrate. The mdrfckr botnet wants 100%. This reveals something important about the criminal ecosystem: the same servers are being competed over by multiple botnets simultaneously. A poorly secured SSH server in Ethiopia isn't compromised once โ it's compromised repeatedly by different groups. The "winner" is whichever botnet's killer script runs last. Ethio Telecom's server might change hands between criminal groups monthly without anyone at Ethio Telecom ever knowing.
๐ Reading Between the Lines
- The fact that competitor-killing is the first module in the payload (init0 = initialization step 0) tells you: the biggest threat to this botnet is not defenders โ it's other botnets. The criminal economy has more competition than the security economy has defenders.
- Using
perlobfuscator.comfor the IRC bot is a $0 decision. A legitimate obfuscation service, used for free, for criminal purposes. The infrastructure of convenience that enables crime: free email (for C2), free obfuscation (for evasion), free mining pools (for monetization). The operators pay for nothing. - The SHA256 hash
a8460f...has remained constant across 81 downloads. No polymorphism, no mutation. They don't need it โ the victims don't have detection capabilities to match against hashes. The operators don't invest in evasion because the targets don't invest in detection.
Sources: Kaspersky GERT (Mar 2025) ยท LSN Honeypot (SHA256 telemetry) ยท CyberCloud UPB
Chapter 2: The Money Processor โ HashVault and the Pool Problem
A mining pool aggregates hashrate from many miners, solves blocks collectively, and distributes rewards proportionally. HashVault (hashvault.pro) is one of the largest Monero pools. The mdrfckr botnet directs all mining work to HashVault on port 3333.
๐ฆ How Mining Pools Work (For Non-Crypto Readers)
Imagine 10,000 people each buying one lottery ticket per day. Individually, they almost never win. But if they pool their tickets and agree to split any winnings, someone in the pool wins every few days, and everyone gets a small, steady payment. That's a mining pool. The botnet's 81+ nodes each contribute a small amount of computing power. HashVault combines them. When the pool finds a Monero block, each contributor gets a fraction proportional to their contribution. The pool keeps 0.9-1.0% as its fee.
โ Does HashVault Know It's Processing Stolen Compute?
A mining pool can see: wallet addresses, hashrate contributions, IP addresses of connecting miners. It cannot see: whether the miner is authorized on the machine it runs on.
HashVault processes millions of shares per day from tens of thousands of miners. It has no mechanism to distinguish legitimate mining from parasitic mining. The protocol is designed for privacy โ Monero was built specifically so that transaction participants cannot be identified. This privacy protection, intended for legitimate users, is exactly what makes the botnet's revenue untraceable. HashVault collects its 0.9% fee regardless of whether the hashrate was generated by a farm in Iceland or a stolen server in Ethiopia. It is, by design, indifferent.
โ Could Mining Pools Implement KYC (Know Your Customer)?
Banks must verify identity. Could mining pools do the same?
Technically possible: pools could require verified identity before accepting hashrate. Practically impossible: (1) Monero's ethos is privacy โ KYC pools would lose their legitimate customers to non-KYC competitors, (2) miners can use VPNs/Tor, making IP-based identity worthless, (3) there's no regulatory requirement โ mining pools aren't classified as financial institutions in most jurisdictions, (4) the criminal would simply switch to a pool that doesn't require KYC (there are hundreds). Monero was designed to resist exactly this kind of gatekeeping. The feature is not a bug โ it's the core value proposition.
โ What Is HashVault's Complicity?
HashVault earns fees from the botnet's mining. The botnet earns revenue through HashVault. Is the pool an enabler?
The question is jurisdictional. HashVault is infrastructure โ like a highway. You don't sue the highway when a stolen car drives on it. But: (1) If HashVault knows specific wallets are botnet-controlled and continues processing, that's different. (2) The concentration of hashrate from botnet wallets might be detectable (hundreds of small miners with the same wallet, contributing small amounts from diverse geolocations). (3) No mining pool has ever been prosecuted for processing botnet hashrate. The legal framework treats them as neutral infrastructure. Whether that framework is adequate is a policy question, not a technical one.
๐ Reading Between the Lines
- HashVault earns ~1% of everything the botnet earns. If the botnet generates $100K/year, HashVault takes $1K. Over 8 years: $8K from the mdrfckr botnet alone. Multiply by every botnet using the pool. The pool's incentive: more hashrate = more fees. Whether that hashrate is stolen is irrelevant to the revenue model.
- Monero's privacy features were designed to protect dissidents, whistleblowers, and people under authoritarian surveillance. The same features protect criminals. This is not a design flaw โ it's the fundamental tension of privacy technology. You cannot have privacy for the good without privacy for the bad. The mdrfckr botnet is the cost of Monero's civil liberties benefit.
- Port 3333 is the standard, unencrypted stratum mining port. The traffic is plaintext. Any ISP in the path could detect it. None do, because mining pool traffic is not considered malicious (it's just numbers). The botnet hides in plain sight because the gatekeepers don't care about the content of the traffic โ only whether it's paid for.
Chapter 3: The Ledger โ Calculating Parasitic Revenue Across Eight Years
We cannot see the operators' Monero wallet. Monero is designed to prevent exactly that. But we can calculate revenue from first principles: nodes ร hashrate per node ร time ร Monero network reward รท total network hashrate.
| Period | Est. Nodes | Hashrate/Node (H/s) | Total Hashrate | XMR/Day (est.) | USD/Day (at period price) |
|---|---|---|---|---|---|
| 2018 (peak) | ~180,000 | 150-300 | 27-54 MH/s | 10-30 | $800-$8,000 |
| 2019-2020 | ~50,000 | 200-400 | 10-20 MH/s | 3-8 | $150-$600 |
| 2021 (crypto boom) | ~30,000 | 300-500 | 9-15 MH/s | 2-5 | $400-$1,400 |
| 2022-2023 | ~10,000 | 300-500 | 3-5 MH/s | 0.5-1.5 | $75-$250 |
| 2024-2026 | ~1,000-3,000 | 400-600 | 0.4-1.8 MH/s | 0.1-0.5 | $15-$100 |
๐ Lifetime Revenue Estimate: $500,000 - $1,800,000
Conservative: 3,422 XMR ร weighted average price = ~$500K. Aggressive: 11,304 XMR ร weighted average = ~$1.8M. The true figure is unknowable โ Monero's privacy architecture ensures this. What we know: enough to sustain 3-5 operators in Romania for 8 years at a comfortable standard of living (Romanian median salary: โฌ800/month = โฌ48K over 8 years for a "team").
โ Why Would Anyone Run a Botnet for $15-100/Day?
Current revenue is pathetically low. $15-100/day for an 8-year-old criminal operation? Why bother?
Three reasons: (1) Inertia โ the infrastructure is already built, the C2 is running, the bots propagate themselves. Ongoing effort is near zero. It's passive income. (2) Sunk cost โ walking away means losing the entire botnet. Even $30/day is $900/month, tax-free, in a country where median salary is โฌ800. (3) Optionality โ if Monero price 10x's (as it did in 2017 and 2021), the same botnet suddenly earns $300-1000/day. The operators are holding a lottery ticket that costs them nothing. The rational choice is to never turn it off.
โ How Does This Compare to a Legitimate Job in Romania?
Romanian median salary: โฌ800/month (~$870). Romanian minimum wage: โฌ560/month (~$610).
At current rates ($30-100/day), the botnet earns $900-3,000/month โ 1-4x the median Romanian salary, completely tax-free, with zero commute and zero boss. At 2018 peak rates ($800-8,000/day for the entire operation split among 3-5 operators): $5,000-80,000/month per operator. At peak, each operator was earning 6-100x the median salary. Even today, the minimum โ $15/day โ is $450/month, nearly matching minimum wage for zero hours of work. The incentive structure makes the criminal choice obvious. The risk structure makes it safe: no mdrfckr operator has ever been arrested.
โ What Happened to the 2018 Peak Revenue?
From 180,000 nodes earning $800-8,000/day to 1,000-3,000 nodes earning $15-100/day. What killed it?
Not law enforcement. Not security improvements. Market forces. (1) Monero introduced RandomX in November 2019, a CPU-mining algorithm that was more efficient on modern CPUs but reduced the advantage of raw node count. (2) The Monero network difficulty increased as legitimate miners deployed purpose-built hardware. (3) Cloud providers gradually hardened default security (Azure disabled SSH password auth by default in 2022). (4) Competing botnets absorbed some of the same vulnerable hosts. The decline mirrors any business in a maturing market: the easy gains are harvested first, then returns diminish.
Chapter 4: The Perfect Business Model โ 100% Gross Margin
The mdrfckr botnet has zero marginal costs. Let's compare:
| Cost Category | Legitimate Monero Miner | mdrfckr Botnet |
|---|---|---|
| Hardware | $2,000-10,000 per rig | $0 (stolen) |
| Electricity | $0.08-0.20/kWh ร 200W ร 24h = $12-30/month per rig | $0 (victim pays) |
| Internet | $50-100/month | $0 (victim pays) |
| Hosting (C2 server) | N/A | $50-100/month (FranTech/BuyVM) |
| Cooling | $50-200/month | $0 (victim pays) |
| Maintenance | 5-10 hrs/week | ~0 hrs/week (self-propagating) |
| Tax | 15-40% (if declared) | 0% |
| Total monthly cost | $200-500 per rig | $50-100 total |
The only cost the operators bear: $50-100/month for the C2/payload server at FranTech/BuyVM (198.98.56.205 in Las Vegas). Everything else โ hardware, electricity, bandwidth, cooling, maintenance โ is paid by the victims.
โ Is This the Most Efficient Criminal Business Model in History?
Drug trafficking requires supply chains, logistics, violence. Ransomware requires negotiation, payment infrastructure, customer service. The mdrfckr botnet requires: one server.
After initial development (estimated: 2-4 months of coding in 2018), the ongoing effort is near zero. The bots propagate themselves (SSH scanning + brute force). The miner configures itself (embedded pool/wallet). The IRC bot provides remote control if needed (rarely used). The competitor killer eliminates threats. This is a fully automated criminal enterprise. The operators could literally stop working and the botnet would continue earning for months until the C2 server's hosting expires. If they pre-pay hosting for a year: $600-1,200 buys a year of autonomous criminal income. The ROI is theoretically infinite.
โ Why Don't More Criminals Use This Model?
If the economics are this good, why isn't every cybercriminal running an SSH mining botnet?
Many are. Our honeypot sees 15+ distinct botnets competing for the same SSH-vulnerable servers. The mdrfckr botnet is just one of the older, more documented ones. The init0 competitor-killer exists because the criminal market is saturated. The addressable market (SSH-vulnerable servers with weak passwords) is finite and contested. This is a mature criminal market with: (1) declining unit economics (fewer vulnerable servers, higher difficulty), (2) intense competition (multiple botnets per host), (3) zero product differentiation (all use XMRig), (4) no barriers to entry (tools are freely available). It's a perfectly competitive criminal market โ which means profits are being driven toward zero.
๐ Reading Between the Lines
- FranTech/BuyVM in Las Vegas charges $3.50/month for a 1GB VPS. The entire command-and-control infrastructure for a global botnet might cost $42/year. The C2 server (198.98.56.205) has been operational for years โ meaning FranTech has been paid, consistently, and has not acted on any abuse reports. FranTech is the $42/year enabler of a multi-hundred-thousand-dollar criminal operation.
- The legitimate mining industry spends billions on hardware, electricity, and cooling. The criminal mining industry spends $50/month on hosting. The competitive advantage is not technology โ it's willingness to steal. The moat around this business model is not code โ it's ethics.
- When we say "100% gross margin," we mean something specific: every dollar of revenue is profit. There is no legitimate business on earth with this margin structure. The only reason it's possible: externalized costs. If the operators had to pay for electricity, their margin would drop to 30-40%. If they had to pay for hardware: 5-10%. The business model IS the cost externalization.
Chapter 5: The Invisible Subsidy โ Electricity Theft at Scale
Each compromised server mining at 100% CPU draws approximately 200-400 watts of additional power. This is electricity the victim pays for without knowing why.
| Region | Avg kWh Price | Additional Power (200W) | Monthly Cost | Est. Nodes | Monthly Theft |
|---|---|---|---|---|---|
| Ethiopia | $0.03 | 144 kWh | $4.32 | 16 | $69 |
| Indonesia | $0.08 | 144 kWh | $11.52 | 52 | $599 |
| South Korea | $0.12 | 144 kWh | $17.28 | 13 | $225 |
| USA (cloud) | $0.14 | 144 kWh | $20.16 | 120+ | $2,419 |
| Germany (cloud) | $0.35 | 144 kWh | $50.40 | 80+ | $4,032 |
| Brazil | $0.10 | 144 kWh | $14.40 | 40+ | $576 |
| Total estimated | ~1,000-10,000 | $8,640-$180,000 |
โ Who Actually Pays for the Stolen Electricity?
The electricity bill arrives. Someone pays. But who?
It depends on the victim type: Cloud VMs: the customer pays (billed per compute-hour at marked-up rates โ the cloud provider profits from the theft). Enterprise/ISP servers: the organization pays, absorbed into "operations" budget, never itemized as "stolen electricity." Government/state-owned: taxpayers pay โ in Ethiopia, the 120 million people served by Ethio Telecom subsidize the mining through their taxes. Consumer broadband: the homeowner pays, confused by an electricity bill $15-30 higher than expected. In every case, the cost is real but the cause is invisible.
โ The Destruction-to-Profit Ratio Is 50:1. What Does That Mean?
For every $1 the operators earn, victims lose $50 in electricity, hardware degradation, bandwidth, and opportunity costs.
It means the botnet is spectacularly wasteful. A legitimate miner converts ~30-40% of electricity cost into cryptocurrency value (the rest is heat). This botnet converts ~2% of victim cost into operator revenue (the rest is waste). It survives not because it's efficient but because the cost bearer and the revenue collector are different entities. The operators don't care about the 98% waste because they don't pay for it. This is the fundamental insight: parasitic mining is not "mining" โ it's "electricity theft with cryptocurrency as the getaway vehicle."
โ What Is the Carbon Footprint?
All those stolen watts generate COโ. How much?
At 1,000-10,000 nodes ร 200W ร 24h ร 30 days = 144,000-1,440,000 kWh/month. Using global average grid carbon intensity (450g COโ/kWh): 65-648 tonnes of COโ per month. Over 8 years: 6,240-62,208 tonnes of COโ. For context: the average car emits 4.6 tonnes/year. The mdrfckr botnet's lifetime carbon footprint equals 1,356-13,524 car-years of driving. All for a criminal enterprise earning $30-100/day. The climate cost per dollar of criminal revenue is staggering.
Chapter 6: From Hashrate to Rent Money โ The Monetization Pipeline
Monero (XMR) is "privacy by default" โ transactions are opaque. Senders, receivers, and amounts are cryptographically hidden. This is the entire reason the botnet mines Monero instead of Bitcoin.
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โ THE MONETIZATION PIPELINE โ โ โ โ Step 1: Mining pool (HashVault) credits operator's XMR wallet โ โ โ โ โ Step 2: XMR accumulates (invisible to blockchain analysis) โ โ โ โ โ Step 3: OTC/P2P exchange (LocalMonero, informal networks) โ โ โ โ โ Step 4: Fiat (EUR/RON) arrives in cash or bank account โ โ โ โ โ Step 5: Rent, food, electronics, lifestyle โ โ โ โ Traceability: โโโโโโโโโโโโโโโโโโโโโโโโโโโโโ ~10% (minimal) โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Why Monero and Not Bitcoin?
Bitcoin is traceable. Chainalysis, CipherTrace, and others can follow BTC through the blockchain. Can they follow Monero?
No. Monero uses three privacy technologies simultaneously: (1) Ring Signatures โ mix the real transaction with decoys, making the true sender unidentifiable, (2) Stealth Addresses โ generate one-time receiving addresses, making the recipient unidentifiable, (3) RingCT โ hide the transaction amount. Together: sender unknown, receiver unknown, amount unknown. Chainalysis has acknowledged that Monero tracing is "probabilistic at best" and often impossible. The botnet chose the one cryptocurrency designed to be untraceable, and it works exactly as designed.
โ How Do the Operators Convert XMR to Cash?
Monero doesn't pay rent. At some point, XMR must become euros or Romanian lei.
Several paths, all low-risk: (1) OTC brokers โ individuals who buy XMR for cash, no KYC. Common in Telegram channels. (2) P2P exchanges โ platforms like now-defunct LocalMonero, or successor services. (3) XMR โ BTC atomic swaps โ convert to Bitcoin, then use Bitcoin ATMs (Romania has ~250). (4) Direct spending โ some services accept XMR directly (VPN, hosting, gaming). The key: at no point does the operator need to interact with a regulated financial institution. The entire pipeline from CPU cycle to dinner plate bypasses every AML/KYC checkpoint that exists.
โ Could Law Enforcement Follow the Money?
In ransomware cases, the FBI has traced and recovered Bitcoin payments. Could they do the same here?
Almost certainly not. The FBI's Colonial Pipeline recovery exploited a specific BTC wallet on a US-jurisdiction exchange. Monero provides no equivalent handle. To follow the money, law enforcement would need to: (1) identify the mining pool wallet (requires HashVault's cooperation or a warrant in HashVault's jurisdiction โ wherever that is), (2) trace XMR transactions from the wallet (technically impossible with current tools), (3) identify the OTC broker (no records kept), (4) connect fiat to a person (no banking trail). The only realistic path to the money is human intelligence โ an informant, a mistake, a physical surveillance operation. The technology provides no leads.
๐ Reading Between the Lines
- Romania has 250+ Bitcoin ATMs โ one of the highest densities in Europe. An operator could swap XMR โ BTC via atomic swap, then cash out at an ATM, under the โฌ1,000 KYC threshold, daily. โฌ900/day ร 30 days = โฌ27,000/month in clean cash. The physical infrastructure for laundering exists and is legal.
- The IRS offered a $625,000 bounty for anyone who could crack Monero tracing (2020). Chainalysis and Integra FEC won the contracts. Results: probabilistic, not deterministic. The world's most motivated organization, with the world's best-funded contractors, still cannot reliably trace Monero. The botnet operators chose their currency wisely.
- Every conversation about "regulating crypto" focuses on Bitcoin. Every criminal who knows what they're doing uses Monero. The regulatory attention is on the wrong currency โ because the traceable currency is the one that generates regulation-justifying headlines.
Sources: Monero Project Documentation ยท Chainalysis 2025 Report ยท IRS Monero Tracing RFP (2020)
Chapter 7: The $42/Year Enabler โ FranTech/BuyVM as Critical Infrastructure
Every mdrfckr infection downloads its payload from 198.98.56.205 โ an IP belonging to FranTech Solutions (BuyVM), hosted in their Las Vegas datacenter. This single server is the chokepoint of the entire operation.
๐๏ธ The Single Point of Failure That Nobody Disrupts
If 198.98.56.205 goes offline, every new infection fails. Existing bots continue mining but cannot propagate. The botnet's growth stops. The payload URL is hardcoded in the scanning script (tddwrt7s.sh). No fallback. No DGA. No resilient hosting. One takedown request to FranTech would cripple the entire operation.
โ Has Anyone Asked FranTech to Take Down 198.98.56.205?
The IP has been documented in Kaspersky reports, AbuseIPDB (99% confidence), multiple threat intelligence feeds. Its role is public knowledge.
FranTech/BuyVM is known in the hosting industry as a provider with an extremely permissive abuse policy. Their Terms of Service emphasize freedom of speech and minimal content restrictions. Abuse reports against their customers typically receive no response or a boilerplate reply citing the need for a court order. Francisco Dias (founder) has publicly defended hosting controversial content. The business model is differential tolerance: hosting things other providers won't. This is why bulletproof hosting exists โ not because providers are criminal, but because the space between "legal" and "acceptable" is profitable.
โ How Much Does FranTech Earn From the mdrfckr Botnet?
A single VPS at BuyVM costs $3.50-7/month.
$42-84/year. That's what it costs to host the command-and-control infrastructure for a botnet that generates $500K-$1.8M in lifetime criminal revenue and causes $10-50M in victim damages. FranTech's share: 0.002-0.008% of the operation's revenue. They are not complicit in the financial sense โ the revenue they earn is trivial. They are complicit in the structural sense โ without their tolerance, the botnet cannot exist in its current form.
๐ Reading Between the Lines
- FranTech hosts the C2 for the mdrfckr botnet, various abuse-associated services, and a significant concentration of threat activity (see TI-2026-025B for full infrastructure analysis). Their Las Vegas location puts them under US jurisdiction โ the FBI, ICE, and Secret Service all have cybercrime authority. Yet the server persists. The simplest explanation: nobody has asked with sufficient legal authority. A grand jury subpoena would work. An AbuseIPDB report does not.
- The "bulletproof hosting" ecosystem has a well-documented genealogy: McColo (shut down 2008, email spam dropped 75% overnight), Russian Business Network (relocated), CyberBunker (raided 2019). FranTech is the American version โ operating in plain sight, within US law, because "hosting malware distribution" isn't explicitly illegal if the host claims ignorance. The law hasn't caught up to the business model.
- If FranTech charged even 10x more ($35/month), the economics would still work for the operators. The hosting cost is so trivially small relative to the revenue that no pricing change could deter the botnet. Only a takedown works. And nobody executes it.
Sources: LSN Intel (IP dossier 198.98.56.205) ยท Kaspersky (payload URL docs) ยท FranTech Solutions / BuyVM public records
Chapter 8: How mdrfckr Compares โ The Criminal Revenue Spectrum
| Criminal Enterprise | Revenue/Month | Operating Cost | Risk Level | Skill Required | Victim Awareness |
|---|---|---|---|---|---|
| Ransomware (RaaS) | $50K-$5M | $5K-50K | HIGH (FBI priority) | HIGH | 100% (demand note) |
| BEC (email fraud) | $10K-$500K | $100-$1K | MEDIUM | MEDIUM | 100% (money missing) |
| Credential stuffing | $5K-$100K | $500-$5K | MEDIUM | MEDIUM | Variable |
| SSH mining botnet (mdrfckr) | $1K-$100K | $50-100 | NEAR ZERO | LOW | ~0% (invisible) |
| DDoS-for-hire | $1K-$20K | $200-$2K | LOW-MEDIUM | LOW | 100% (service down) |
| Ad fraud botnet | $10K-$500K | $1K-$10K | LOW | MEDIUM | ~0% (platforms absorb) |
โ Why Does the Lowest-Revenue Criminal Enterprise Survive the Longest?
mdrfckr has operated for 8 years. Most ransomware gangs last 2-3. What's the survival advantage?
Invisibility. The three factors that destroy criminal enterprises are: (1) victim reporting (triggers investigation), (2) law enforcement priority (allocates resources), (3) operational mistakes (creates leads). The mdrfckr botnet scores near zero on all three. Victims don't report because they don't know. Law enforcement doesn't prioritize because no victims report. Operational mistakes don't matter because nobody is investigating. The botnet survives not despite being low-revenue but BECAUSE it is low-revenue. The revenue is too small to trigger anyone's attention threshold. It sits permanently below the radar.
โ What Would Make This Botnet Worth Investigating for Law Enforcement?
A thought experiment: what would change the priority calculation?
One of three things: (1) A high-profile victim โ if the botnet compromised a hospital and a patient died because the server was mining instead of serving. Currently there's no documented case, but statistically it's likely. (2) Cross-referencing with another crime โ if the operators also ran ransomware, sold access, or committed fraud that IS investigated, the mining botnet might be discovered incidentally. (3) Political pressure โ if a legislator's constituent is affected, or a nation-state victim (Ethio Telecom, Viettel) escalates diplomatically. None of these require the botnet to change; they require the context to change. The botnet will be investigated when it's convenient, not when it's warranted.
Chapter 9: Who Profits From the Problem โ The Security Industry's Perverse Incentives
The mdrfckr botnet has generated significant revenue โ not for its operators, but for the security industry that studies it:
| Security Vendor | Product Sold | Price Range | Protects Against mdrfckr? | Available to mdrfckr Victims? |
|---|---|---|---|---|
| CrowdStrike | Falcon XDR | $8-15/endpoint/month | Yes | No (can't afford) |
| SentinelOne | Singularity | $6-12/endpoint/month | Yes | No (can't afford) |
| Kaspersky | Endpoint Security | $4-10/endpoint/month | Yes | No (can't afford) |
| Free tools (fail2ban, etc.) | N/A | $0 | Partially | Yes (but no expertise to deploy) |
โ Does the Security Industry Benefit From the Botnet's Existence?
Every Kaspersky blog post about "Outlaw" drives traffic. Every vendor demo uses cryptojacking as a threat example. Every conference talk references SSH botnets.
The security industry's revenue model requires threats to exist. Solved threats don't sell products. The mdrfckr botnet is the perfect marketing tool: scary enough to justify purchase, but not scary enough to demand systemic change. If every Linux distro disabled SSH password auth by default, the botnet would die โ and so would a category of security product sales. The industry is incentivized to manage the threat, not eliminate it. Kaspersky publishes the analysis (free marketing), sells the endpoint product (paid protection), to customers who can afford it (not the actual victims). The victims remain unprotected. The threat remains. The cycle continues.
๐ Reading Between the Lines
- Kaspersky's March 2025 analysis of the Outlaw botnet is excellent โ thorough, well-sourced, technically accurate. It was read by security professionals, not by the Ethiopian IT administrator whose server is compromised. The knowledge exists but does not flow to where it's needed. This is not a failure of research โ it's a failure of distribution.
- The combined revenue of the top 10 cybersecurity vendors: ~$50 billion/year. The total damage of all SSH mining botnets: ~$1 billion/year. The industry's response to a $1B problem generates $50B in revenue. The economic incentive is to maintain a manageable threat level โ enough to justify budgets, not enough to demand fundamental infrastructure change.
- The simplest fix โ SSH key-only auth by default โ would eliminate this entire category of threat. It would also eliminate the need for the products that protect against it. The fix is free. The products are not. Guess which one gets implemented.
Chapter 10: The Final Accounting โ Eight Years of Parasitic Revenue
๐ The Complete P&L โ mdrfckr Botnet (2018-2026)
Revenue: 3,422-11,304 XMR โ $500,000-$1,800,000
Operating costs: $4,800-$9,600 (8 years ร $50-100/month hosting)
Net profit: $495,200-$1,790,400
Operating margin: 99.0-99.5%
Operator income (3-5 people): $99,040-$597,000 each over 8 years ($12,380-$74,625/year)
Victim cost (total): $10,000,000-$50,000,000 (estimated)
Destruction-to-profit ratio: 20:1 to 50:1
Arrests: 0
Prosecutions: 0
Victim notifications: 0
Infrastructure takedowns: 0
โ If You Could Send One Message to the Operators, What Would It Be?
Not a threat. Not a plea. What's the economically rational message?
Nothing. There is no message that changes their incentive structure. The rational economic calculation says: continue operating. The risk of arrest is near zero. The revenue exceeds Romanian median income. The effort is near zero. The moral cost is abstract (they never see their victims). The only thing that would change their behavior: altering the equation โ either increasing risk (actual enforcement), reducing revenue (killing the mining pool connection), or eliminating the vulnerability (SSH key-only). Words accomplish nothing. The operators read the same security blogs we do. They know exactly what they're doing. They've calculated that it's worth it. They're right.
๐ Reading Between the Lines
- $500K-$1.8M over 8 years for 3-5 operators is not "getting rich." It's "making a living." The operators are not criminal masterminds living in luxury โ they're young men (almost certainly men) in Romania earning a comfortable but not extraordinary income from a crime that requires almost no effort. The banality is the point. Evil doesn't require grandeur โ it only requires an incentive structure where doing nothing is more profitable than doing the right thing.
- Zero arrests, zero prosecutions, zero takedowns in 8 years. The enforcement system's response to $10-50M in cumulative victim damage: nothing. Not because law enforcement is corrupt or incompetent โ because the crime falls below every threshold: per-victim damage is too small for investigation, the criminal jurisdiction is too complex for prosecution, the political value of pursuing it is zero. The perfect crime is not undetectable โ it's unimportant.
- This dossier calculates the economics of a crime that nobody will prosecute, for victims who don't know they exist, using evidence that law enforcement will never request. It is an academic exercise in accounting for damage that society has collectively decided not to count. The numbers are precise. Their impact will be zero. That, too, is part of the economics.
๐ Series Navigation โ The SSH Parasite
TI-2026-025A โ The Anatomy ยท TI-2026-025B โ The Infrastructure ยท TI-2026-025C โ The Operator ยท TI-2026-025D โ The Victims ยท โธ TI-2026-025E โ The Economics (this page) ยท TI-2026-025F โ The Evolution
Related: TI-2026-026O โ The Convergence (botnet revenue models) ยท TI-2026-024A โ Offshore Bulletproof Hosting