D is for Dota — The Worm That Refused to Evolve

TI-2026-071D · Series: 🕰️ The Alphabet of Harm · Letter D · TLP:WHITE · 2026-07-09

So far the archive has led and our sensors have followed — the library gives a photograph, the wire supplies the motion. D inverts that. This is the letter where our own honeypot is the primary witness, because the thing it catches is too ordinary to have earned a nation-state report. And it is precisely that ordinary thing which turns out to be the most unkillable, and the most unchanged, harm in the whole alphabet.

📋 The Short Version

The other letters so far have been dramatic: an apex predator, an outlaw hosting empire, a surveillance-industrial complex. D is the opposite. It is a worm — a self-spreading commodity program that brute-forces SSH logins, checks how many CPU cores it just stole, drops a key so it can come back, and starts mining Monero. It is stupid, loud, and relentless, and it is the single most common thing our honeypot has ever caught.

It is called, depending on who is naming it, Outlaw, or Dota, or Shellbot. Its ancestors were the Perl IRC bots a research collective called MalwareMustDie catalogued a decade ago. And here is the fact that makes it letter D: it has not changed in eight years. A Monero-miner detection rule written in January 2018 still fires on what we catch in 2026. A binary hash, a credential, a persistence key, a reconnaissance sequence — all documented in 2018, all identical today.

Where covert collection (C) answered every exposure by mutating into a new form, the Outlaw worm answered nothing, because nothing ever asked it a question. It lives on SSH-exposed Linux servers, which run no antivirus, so it is never caught, so it never has to hide, so it never learns to. It is the purest thing in this alphabet: a harm that froze, and stayed frozen, because it could.

Verdict: CONTINUES — frozen. The Outlaw/Dota worm did not end and did not change. Unlike bulletproof hosting (B), which continues while swapping disguises, this worm continues with no mutation at all: the same binary, key, credential and commands the archive signatured in 2018. It is the alphabet's clearest stasis. Confidence: HIGH on the specimen we catch directly (binary hash, credential, key, commands) and the multi-year stasis, corroborated by two independent research teams. MEDIUM on treating "Outlaw/Dota" as a single continuous organization versus a stable toolkit reused by a stable but not necessarily singular operator set (§8).

1. The Threat Too Boring to Report

Every earlier letter had a marquee document — the Mandiant report, the Spy Files, a DOJ indictment. D does not, and its absence of a headline report is the first clue to its nature.

Nobody writes a fifty-page exposé of the Outlaw worm, for the same reason nobody writes a nature documentary about a pigeon. It is everywhere, it is unremarkable, and it does the same thing every single time. Threat-intelligence attention flows toward the novel and the frightening — the zero-day, the nation-state, the never-before-seen. A commodity SSH miner that has been doing the identical thing since 2018 generates no such excitement. It is filed, not narrated.

But it is filed. The archive remembers the boring threat in a different language than it uses for the apex predator. It remembers A in prose. It remembers D in signatures — YARA rules, Sigma rules, Metasploit modules, the terse machine-readable grammar of detection. There is no story of the Outlaw worm in the library. There is a rule set for it, and the rule set is the story, if you know how to read it. And what the rule set says, once you line up the dates, is the whole of this letter: it says the same thing in 2018 that it says today, because it never needed to be rewritten.

2. The Lineage, in Signatures

Trace the worm's family tree through the archive and every node is a detection artifact, not an article.

• The Perl IRC bots (mid-2010s). The Metasploit modules for "Xdh / LinuxNet Perlbot / fBot IRC Bot" and the "Legend Perl IRC Bot" — crediting the MalwareMustDie research collective and Shellshock-era spam campaigns — preserve the ancestor: a Perl bot that brute-forces access, phones home over IRC, and runs DDoS or mining payloads. This is the grandparent of Outlaw, kept alive in the archive as a runnable exploit module.
• Xbash (2018). Palo Alto Unit 42 named the commodity model — "combines botnet, ransomware, coinmining, worm, targets Linux & Windows" — and the archive keeps it as crime_xbash.yar, a YARA rule dated September 2018. The worm-that-does-everything, remembered as a pattern-match.
• XMRig (the payload). Florian Roth's XMRIG_Monero_Miner YARA rule is dated 2018-01-04. It matches the mining strings — --cpu-affinity, the XMRig release hashes — that are the economic endpoint of the whole operation. The worm exists to run this, and this has a signature older than most production laptops.
• The behavior (2021). A Sigma rule, "Linux Crypto Mining Indicators," matches the exact command lines — --cpu-priority=, --donate-level=0, stratum+tcp:// — and tags them ATT&CK T1496, Resource Hijacking. The mining behavior itself is a fixed, catalogued signature.
• The persistence (routine). And the moves that keep it alive are documented as standard tooling: Metasploit's multi/persistence/ssh_key (write an attacker key into authorized_keys) and multi/persistence/cron. The worm's persistence is not clever enough to need a special writeup; it is in the framework's default module list.

Read the dates down that list: 2018, 2018, 2018, 2021. Now recall that our honeypot is catching the described behavior in 2026. The lineage is not a story of evolution. It is a stack of signatures that never had to be updated.

2b. The Economics of Nothing

To understand why the worm never changes, it helps to understand how little it earns \u2014 and why that is fine. The endpoint of the whole operation is Monero mining: turning a stolen server\u2019s CPU into a trickle of a privacy coin. On any single box the return is trivial, often cents per day, which is exactly why the reconnaissance step (cat /proc/cpuinfo) exists: the worm is pricing the machine, keeping the many-core hosts and discarding the weak ones, because at these margins core-count is the entire business case.

But the two inputs that make the trickle profitable are both free. The compute is stolen, so it costs the operator nothing; the electricity bill lands on the victim. And the malware is a decade-old commodity, so development costs nothing either \u2014 there is no R&D line item to amortize. When your two largest costs are zero and someone else pays your power bill, a few cents per box per day, multiplied across every unpatched SSH server on earth, is a perfectly good living. Crucially, improving the malware would add cost without adding revenue. A fancier miner does not mine meaningfully more Monero on a stolen quad-core; a stealthier implant does not matter in an environment with no one watching. The economics do not merely permit stasis \u2014 they actively punish innovation. Every hour spent modernizing the worm is an hour not spent brute-forcing the next ten thousand hosts, which is where the actual money is. The rational operator ships the 2018 binary forever, because the 2018 binary is already at the efficient frontier of a business whose only real input is other people\u2019s neglect.

3. The Living Specimen

Here is the same worm in the present tense, as our own sensors hold it — and this is where D's evidence is richer than any archive document, because we do not have a photograph of this thing. We have it alive, on the slide, striking the wire daily (dossier 052):

• One binary. SHA256 a8460f44..., deployed across 81 machines — not eighty-one variants, one binary, copied.
• One credential. The signature SSH password 345gs5662d34, the Outlaw/mdrfckr marker, typed at box after box.
• One reconnaissance. cat /proc/cpuinfo | grep name | wc -l — count the cores, price the host for mining (the appraisal of letter D's cousin, dossier 070B).
• One persistence move. The authorized_keys one-liner installing an RSA key with an anomalous 0x25 public exponent — installed in 85 of 86 backdoor drops we recorded (dossier 070C).
• One payload. XMRig, mining Monero, matched by that 2018 YARA rule.

Every one of those is a singular. Not a range, not a family, not a distribution — one value, repeated. The worm is very nearly clonal: the same fingerprint on unrelated IPs, which is exactly why behavioral clustering reconstructs its operator so cleanly (the 81-node same_operator cluster of dossier 068D). A threat that never varies is a threat you can fully characterize, and we have.

4. The Match Across Time

Now put the two together, and the letter's central proof clicks into place. It is not that the worm resembles the 2018 signatures. It is that the 2018 signatures still catch it.

Think about what that requires. A YARA rule matches specific byte strings; a Sigma rule matches specific command lines; a credential IOC matches a specific password. For an eight-year-old rule to fire on a current sample, the sample must contain the same bytes, run the same commands, and use the same credential as it did in 2018. Signatures go stale precisely because malware changes — that is the entire arms race of detection. An IOC that never goes stale is an IOC for a threat that never moved.

And two independent teams, on two continents, confirm it in prose. Dossier 052 records Antiy Labs (China, January 2025) and Kaspersky GERT (Brazil, March 2025) each documenting Outlaw/Dota with identical TTPs active since 2018 — the same brute-then-recon-then-key-then-mine sequence, unchanged. When a Chinese lab and a Brazilian incident-response team describe the same unmoving thing seven years apart, and a Florian Roth rule from January 2018 still tags its payload, the stasis is not an inference. It is an over-determined fact, established by detection engineering, independent research, and our own live capture, all agreeing.

Eight years. Zero evolution. The worm is a fly caught in amber that is somehow still buzzing.

5. No Predator, No Evolution

Why? Why would a piece of malware, in a field defined by relentless innovation, simply refuse to change for eight years?

Because nothing ever made it. Evolution — biological or malicious — is driven by selective pressure. A predator eats the slow gazelle, so gazelles get faster. An antivirus catches the recognizable virus, so the virus mutates to escape the signature. Change is the response to a cost. Remove the cost and you remove the reason to change.

The Outlaw worm lives in an environment with no predator. Its habitat is the SSH-exposed Linux server — a VPS, a misconfigured cloud instance, a forgotten dev box — and that habitat, overwhelmingly, runs no endpoint protection. No EDR watching the process tree, no antivirus scanning the binary, no analyst reading the logs. The worm brute-forces in, mines, and is never noticed until the owner wonders why their CPU bill tripled, if they ever do. It is never detected-and-burned. Its signature is never rendered useless. So there is no selective pressure, and with no pressure, the fittest strategy is the cheapest one: do not change anything. Rewriting the malware costs effort and risks breaking a thing that works. In an unpoliced environment, the winning move is to keep running the 2018 binary forever, because the 2018 binary still works forever.

This is the exact inverse of covert collection (C). C mutated fast — appliance to implant, state to mercenary market — precisely because it was exposed, forensically dissected, sanctioned, investigated by parliaments. Pressure drove mutation. D froze precisely because it faces none. The two letters are a matched pair, and together they state the alphabet's law of change in a single line: malware evolves in exact proportion to the pressure it is under, and the Outlaw worm proves the zero case.

5b. What \u201cFrozen\u201d Costs the Victim

It would be easy to read a harm this static and this petty as harmless \u2014 a few stolen cycles, a slightly warmer server. The series\u2019 posture is to state the cost plainly and let the reader weigh it. So: the victim of the Outlaw worm pays in three currencies. First, money \u2014 a mining payload pins the CPU at 100%, and on a metered cloud instance that is a directly inflated bill, sometimes the first sign anyone notices. Second, the machine itself \u2014 once the authorized_keys key is dropped, the box is no longer the owner\u2019s; it is a node in someone else\u2019s botnet, available to be re-tasked from mining to scanning, to DDoS, to hosting the next stage, at the operator\u2019s whim. Third, and least visible, everyone else \u2014 a compromised server does not just mine; it turns outward and brute-forces the next ten thousand hosts, which is how the worm propagates at all. Every frozen, boring, cents-per-day infection is also a launch point aimed at strangers.

That is the quiet moral weight under the amber. The worm is unspectacular and its per-victim theft is small, but it is theft, it is trespass, and it is contagious \u2014 and it persists at a scale that makes the aggregate enormous precisely because each instance is too small to be worth anyone\u2019s time to stop. \u201cFrozen\u201d does not mean harmless. It means a harm that found the exact size at which no one will bother to end it, and then stayed there, on purpose, for eight years.

6. The Caught Column

The alphabet's ledger has a "caught" column, and for D it is nearly empty — for a revealing reason.

The commodity worm does not get takedowns. There is no dramatic McColo-style disconnection, no six-officer indictment, because there is little to grab: the operators run from disposable hyperscaler IPs, the C2 is cheap and replaceable, and no single high-value target justifies a coordinated law-enforcement operation. Occasionally a mining pool bans a wallet or a botnet gets a sinkhole; mostly, nothing happens. The mdrfckr/Outlaw operator behind the 81-node cluster has, as far as the record shows, never been arrested. The worm is beneath the threshold of consequence — too small, too diffuse, too boring to prosecute.

But the empty "caught" column has a defender's silver lining, and it is the practical payoff of the whole letter. A frozen threat is a solved detection problem. Because nothing varies, every IOC is permanent. The credential 345gs5662d34, the 0x25-exponent key, the binary hash, the cpuinfo command — none of these will ever change, so a detection built on any of them will work indefinitely. The worm's refusal to evolve, which is what makes it unkillable at scale, is also what makes any single instance trivially catchable by anyone who bothers to look. It cannot be eradicated — the habitat is too vast and unpoliced — but it can be seen perfectly, forever, for free. The archive's 2018 signatures are still a working defense in 2026, which is a gift almost no other letter offers.

7. The Verdict

Set the 2018 signature beside the 2026 capture and there is nothing to reconcile, because they are the same object.

• Did it end? No. It is the most common thing our honeypot catches.
• Was anyone caught? Essentially no one — it is beneath the threshold of prosecution.
• What did it become? Exactly what it was. Same binary, same key, same credential, same commands, same mining payload, for eight years.

Verdict: CONTINUES — frozen. D refines the pattern B introduced. Bulletproof hosting CONTINUES by regenerating — new names, new shells, a mutating disguise over a constant function. The Outlaw worm CONTINUES by doing absolutely nothing new — no disguise, no regeneration, no change, because its environment never forces one. B is a market that reprices; D is a fossil that keeps hunting. Both persist, but D is the purer, stranger case: a harm that achieved permanence not by adapting but by refusing to.

And it leaves the alphabet with a quietly unsettling lesson, the mirror image of A's. Letter A warned that the apex predator's tools diffused downward until they were ambient. Letter D shows what waits for them at the bottom: an environment so devoid of consequence that the tools never need to improve again. The scariest thing about the Outlaw worm is not that it is sophisticated — it is aggressively not. The scariest thing is that it does not have to be, and it has known that for eight years, and it has been right the whole time. It is a standing measurement of how little pressure the vast, unpoliced floor of the internet actually applies to the things that prey on it: so little that a 2018 miner, brute-forcing root:345gs5662d34, is still a perfectly good business in 2026.

8. Method Note — The Honest Limit

Two limits, held as carefully as the rest.

First, "Outlaw/Dota" is a family label, not a proven single organization. What our systems establish with HIGH confidence is a stable, near-clonal toolkit — one binary hash, one credential, one key, one command sequence — recurring across many IPs and years. That the same operator has run it continuously since 2018, versus a stable toolkit passed between or shared by a stable set of operators, is a weaker claim held at MEDIUM. The 81-node same_operator cluster (068D) is solid within its window; extending it to "one continuous crew for eight years" leans on the toolkit's stasis, not on direct evidence of the same hands.

Second, "zero evolution" is a claim about the observed fingerprint, not a proof of total inactivity. The binary, credential, key and recon we catch are unchanged; that is measured. It remains possible the operators run other, varying tooling we do not see, or update peripheral infrastructure invisibly. The strong, well-supported claim is narrow and exact: the specific, signatured Outlaw fingerprint has not changed in eight years, and 2018 detections still fire on it. That is enough to carry the verdict, and it is all the verdict claims. The vectors do not lie about the fingerprint on our wire; they are simply silent about whatever the operator might be doing where we cannot watch.

Investigation Metadata

Cross-references: TI-2026-071C (C is for Covert Collection — the inverse: exposure drove mutation) · TI-2026-071A (A is for APT — the tools that diffused down to this floor) · TI-2026-052A (The Family Tree — the specimen and the seven-year stasis) · TI-2026-070C (The Key — the persistence fingerprint) · TI-2026-068D (The Same Hand — the operator cluster) · TI-2026-008B (The Key to 81 Machines).