The Key — One Backdoor to Own Them All

TI-2026-070C · Series: 🗺️ The Map and the Territory · TLP:WHITE · 2026-07-09

070A found persistence collapses to one technique. It goes further than that. It collapses to one key — and that key, meant to own the machine, is the thing that names its owner.

📋 The Short Version

After the appraisal (070B) clears, the intruder who decides to keep the box does exactly one thing to hold it: overwrite the SSH authorized_keys file with their own public key. That is ATT&CK T1098, and 070A showed it is the whole persistence story.

But look at the keys themselves. Across 86 backdoor installs, there are only two distinct keys — and one accounts for 85. The persistence layer is not a technique with a thousand implementations. It is, almost literally, one key, dropped by one identical command, across unrelated IPs that share nothing else.

And that key has a tell. Its signature identifies it as the Outlaw/Dota3 backdoor — the same 81-machine operator this corpus has met three times before. The mechanism the attacker uses to own the machine is the same artifact that lets us name the attacker.

Confidence: HIGH on the key/command concentration in the honeypot. MEDIUM on the claim that one operator dominates persistence globally — this is one sensor's view.

1. One Command, Eighty-Five Times

The dominant persistence action, run verbatim 85 times:

cd ~ && rm -rf .ssh && mkdir .ssh && \
echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8d..." \
     > .ssh/authorized_keys

Delete whatever keys are there. Make a fresh .ssh. Write one key. That key is the same every time. Two distinct backdoor keys exist in the entire corpus of 86 installs; the second appears exactly once. Persistence is monoculture.

2. The Key Is a Fingerprint

Look closely at how the key begins:

ssh-rsa AAAAB3NzaC1yc2EAAAABJQ...

A normal RSA SSH key encodes the standard public exponent 65537 as the segment ...AAADAQAB. This one reads ...AAABJQ — a one-byte exponent of 0x25 (37). That anomalous, tiny exponent is not a coincidence; it is the documented signature of the Outlaw / Dota3 SSH backdoor.

Which means we already know whose key this is. It is the 81-machine operator — behaviorally clustered as a single hand in The Same Hand (068D), keyed in The Key to 81 Machines (008B), and payload-matched in The Family Tree (052A), all under the credential 345gs5662d34 and the binary a8460f44.

Here is the quiet elegance of it: the backdoor is the attribution. The identical key appearing on unrelated IPs is exactly the shared secret that draws a same_operator edge (068D). The attacker's key opens the machine for them and identifies them to us in the same stroke. They cannot use it without signing it.

3. The Lock Is a War

Every key-drop travels with a second command:

cd ~; chattr -ia .ssh; lockr -ia .ssh

chattr -ia removes the immutable (i) and append-only (a) attributes; lockr is the busybox-era equivalent. Read the sequence: the operator strips locks that a previous infection set on ~/.ssh, overwrites that rival's backdoor with their own, and re-locks it.

That is not defense against the machine's owner. It is a turf war between parasites. A compromised host is contested inventory — commodity crews evict each other and bar the door behind them. The battle is fought in filesystem attributes on a stranger's server, and it is why persistence is monoculture at any given moment even as the occupant changes: whoever ran last owns the lock.

(86 chattr uses, 89 lockr — one per key-drop, and then some.)

4. The Rare Move That Points Outward

Almost everything here is local resource capture. One variant is not:

find /home /root -name "id_rsa" -o -name "id_ed25519" -o -name "id_dsa" -o -name "*.pub"

This harvests the victim's own SSH private keys (T1552.004) — to reach the machines that this machine is trusted by. It is the single credential-access, lateral-reach move in the entire corpus, and even it is commoditized to one line. The exception proves 070A's rule: commodity intrusion does not explore, except for the cheapest possible pivot, taken only occasionally.

5. Why the Key Never Changes — and Why That's a Gift

One operator's key dominates 85-to-1, unchanged across every IP that drops it. Why not rotate it, when a static key is a permanent indicator?

Because nothing forces rotation. SSH-exposed Linux servers have no endpoint protection; the backdoor is never detected-and-burned, so it is never made to evolve — the same no-predator, no-evolution logic documented for the payload in the Malware Graph (052). The operator keeps the key because the key keeps working.

And that stasis is the defender's advantage. The attacker's refusal to rotate hands us a durable IOC that outlives every IP change. The specific public key is a permanent blocklist entry. Any write to authorized_keys is an alarm. Any chattr on a user's ~/.ssh by a non-admin is malicious by construction. The most reliable detection in the whole lifecycle is the one the attacker refuses to vary.

6. Closing the Footpath

Put the series' territory findings together and the picture is stark. The commodity attacker walks a footpath across the vast ATT&CK map (070A). Half of that footpath is a single question — what is this worth? (070B). And the persistence that ends it is a single key, owned by a single operator, installed by a single command and locked with a single trick (070C).

The map imagines a boundless adversary. The territory holds one worn groove, one price check, one key. The sophistication is all in the catalog; the traffic is a script. And the script's refusal to change — the same key, the same commands, the same seven years — is not a weakness the defender must exploit cleverly. It is written on the wall in the attacker's own hand.

Investigation Metadata

Cross-references: TI-2026-070A (The Map and the Territory — persistence is one technique) · TI-2026-070B (The Appraisal — the verdict that precedes the key) · TI-2026-008B (The Key to 81 Machines — the same backdoor key) · TI-2026-068D (The Same Hand — the key as same_operator evidence) · TI-2026-052A (The Family Tree — the no-evolution logic).