The Skeleton Key: One Public Key, a Hundred Hands, a Single Owner

The Skeleton Key — a deep read from the honeypot census

Classification: HIGH · Confidence: HIGH (first-party artifact measurement + well-documented public IOC)

The previous census left a question open and labelled it honestly as a bound. It had found that the most widely distributed artifact in the honeypot's entire retained corpus was not the thirty-megabyte Go toolkit that dominates by sample count, but a 389-byte fragment delivered by one hundred distinct source addresses. It could not yet say whether those hundred hands were planting one key — one operator with reach — or a hundred keys — a commodity technique in a hundred unrelated hands. It guessed the latter and flagged the guess. This letter resolves it, because resolving it required only one measurement the census had not yet made: comparing the file hashes.

They are identical. All 107 drops of the 389-byte artifact, from all 100 distinct source IPs, across the entire four-month observation window, are one SHA-256. A single byte-for-byte identical file. Which means the answer to the census's open question is neither of the two it offered. It is not a hundred keys. It is not an anonymous habit. It is one specific key, planted by a hundred hands that never coordinated — and the key already has a name the security industry has known for the better part of a decade. Its comment field reads mdrfckr.

What the artifact is

The full contents of the 389-byte file, retained verbatim by the sensor, is a single line:

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrT
OrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9
EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0
hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5z
YkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6
+i6rBLAsPKgAySVKPRK+oRw== mdrfckr

That is the whole program. There is no binary, no dropper, no persistence engine, no command-and-control channel, no obfuscation. It is an OpenSSH public key. The attack is to append it to ~/.ssh/authorized_keys — usually root's — on a machine the attacker has just gained a shell on. From that moment, anyone holding the matching private key can log in as that user, over the target's own stock sshd, with no password, indefinitely. The persistence mechanism is the operating system's own remote-access daemon, which was already installed, already running, already trusted, and already exposed to the internet. The malware, in effect, is the absence of malware. There is nothing to detect at runtime because nothing runs that the system did not ship with.

DOCUMENTED, from first-party sensor data: one SHA-256 (a8460f44…1669f8f2), 389 bytes, 107 drops, 100 distinct source IPs, first seen 2026-03-31, last seen 2026-07-23 — the full span of the observation window. The sensor's aggregate threat score for the hundred delivering addresses averages 75.3 out of 100: this is not a set of stray misconfigurations, it is a population of already-known-bad hosts.

Decoding the key's wire format yields two durable fingerprints. The modulus is 2048 bits — unremarkable. The public exponent, however, is 37 (0x25), not the standard 65537 that essentially every legitimate RSA key generator emits. A public exponent of 37 is a machine-signature: it is what you get from a specific, non-standard key-generation path, and it is stable across every copy of this key ever planted. Between the non-standard exponent and the mdrfckr comment, the key is a fixed constant that identifies itself.

The name it already has

The mdrfckr-commented SSH key is not novel and this letter does not claim to have discovered it. The opposite is the point. This exact key, this exact comment, and the surrounding toolkit — a Perl IRC "Shellbot," an XMRig miner, and an SSH brute-forcing spreader, historically packaged in a tarball named dota.tar.gz and its successors — have been documented across public vendor reporting since roughly 2019 as the hallmark of the crew variously tracked as Outlaw and Dota. It is one of the most-published SSH backdoor indicators in existence. Any mature detection stack has had a signature for the string mdrfckr for years.

And that is the first uncomfortable finding. A key that has been public, named, and signatured across the industry for the better part of a decade landed on one modest honeypot 107 times in four months, from a hundred different addresses, and was still arriving on the final day of the window. Being a known indicator did not retire it. It aged into background radiation. The Outlaw key is not a threat that was caught and closed; it is a threat that was catalogued and then simply kept working, because the population of unhardened SSH endpoints regenerates faster than any blocklist propagates, and because the crews planting it pay no cost for using a burned indicator when their victims never check.

INFERRED, high confidence, resting on well-established public reporting rather than on novel analysis: the artifact is the Outlaw/Dota SSH botnet's persistence key. The identification is carried by the key material itself — a fixed public key with a fixed comment and a fixed non-standard exponent is not a behavior that two lineages arrive at independently.

The reframe: reach with a single owner

The census offered a clean aphorism — depth is a property of an author, reach is a property of a technique — and used the 389-byte artifact as the proof that the widest-reaching thing on the wire belonged to no one in particular. The hash comparison forces a correction, and the correction is more interesting than the aphorism.

The technique is indeed commodity: appending a key to authorized_keys is the crudest post-exploitation step there is, and it appears in countless unrelated kits. But this deployment is not the technique in general. It is one specific public key. And a public key is one half of a pair. Whoever holds the private half of the mdrfckr keypair can log into every single host on which any of those hundred hands succeeded. The hands are plural and uncoordinated; the lock they all cut a copy of fits exactly one key; and that key is held by one party.

So the reach does have an owner. Not the hundred delivering IPs — they are the botnet's disposable spreading nodes, themselves mostly compromised third-party machines, which is why their own threat scores are high. The owner is whoever holds the private key. Every one of those hundred hands, whether it belongs to the original Outlaw operator or to some downstream actor who copy-pasted the crew's tooling, is — knowingly or not — installing the same lock, and handing a copy of the only key that opens it to the same person. The census said the widest net had no owner. The key material says it has exactly one.

The hundred hands

It is worth being precise about what the hundred distinct source addresses are, because the instinct is to read "100 IPs" as "100 attackers" and that instinct is wrong in the same way "20 family labels" meant "20 operators" was wrong.

The hundred hands are almost certainly not a hundred human operators. They are the botnet's spreading surface: machines that were themselves compromised — by this very key's brute-force stage or by any of a dozen other paths — and then conscripted into scanning for and infecting the next tier of victims. That is what a self-propagating SSH botnet is: each host it takes becomes a launch point for taking more, and each of those launch points appears at any given sensor as a distinct source IP. The average threat score of 75.3 across the hundred is the fingerprint of exactly this. A population of source addresses that is collectively, independently known-bad is not a hundred fresh attackers; it is a hundred previously-owned machines doing their owner's spreading. The honeypot is not being probed by a hundred adversaries. It is being probed by one adversary's hundred limbs.

Which reframes what the sensor itself is inside this system. When one of those hundred hands lands on the honeypot, brute-forces its way to a shell, and appends the mdrfckr key, it is not merely trying to persist — it is trying to recruit. In a real victim, the key grants the owner return access, and the freshly-compromised host is then expected to join the hundred and begin planting the key elsewhere itself. The botnet's growth model is baked into the single artifact: the key is simultaneously the persistence mechanism and the enlistment papers. The honeypot, by design, accepts the shell and records the key without ever becoming a limb — but every real host that does the same becomes hand one hundred and one, delivering the identical file to the next sensor down the line. The uniformity of the artifact across all hundred sources is not just an attribution convenience. It is the mechanism of the spread: one file, copied perfectly, is what lets a hundred uncoordinated machines all serve the same owner.

The supply chain of access

This is where the single-key design stops looking like laziness and starts looking like a business model.

Consider the two ways to build an SSH-key backdoor at scale. The compartmentalized way is to generate a unique keypair per victim: if one victim is cleaned or one key is leaked, the rest survive, and you know precisely which host each key opens. This is what a careful operator concerned with their own operational security would do. It is also expensive — it requires generating, storing, and mapping thousands of keypairs, which is infrastructure, which is the very thing the 389-byte artifact exists to avoid.

The Outlaw design is the opposite: one hardcoded key, baked into the spreader, planted identically everywhere. It has no key-management cost, it scales to infinity for free, and it fits in a single line. And it has a property the compartmentalized design does not: it collects access on behalf of the kit's author from everyone who runs the kit. When a downstream actor grabs the Outlaw tooling — because it works, because it is free, because it is right there — and points it at their own target list, they spread the crew's XMRig miner, yes, but they also plant the crew's key. Every host that downstream actor compromises becomes a host the original author can also log into. The kit is a franchise, and the franchise fee is paid in access. The author monetizes not only their own bots but the labor of every operator who ever reused their code without changing the key.

That is the deep asymmetry the hash comparison exposes. The toolkit examined in the preceding series achieved scale through one author's sustained engineering — depth, compounded. The mdrfckr key achieves a different and arguably larger scale through distribution of a fixed artifact — the author wrote one line, and a hundred hands carry it. The toolkit's operator has to run their own campaign. The key's owner has an army of unwitting distributors, and the price of admission to that army is that you hand the owner a copy of your keys to your victims.

BOUNDED: "one owner" is a statement about one keypair, not one human. The private key could be held by the original Outlaw author, by a buyer, or by several parties if the private material was itself shared or leaked — key reuse cuts both ways. What is certain is that the hundred deliveries converge on a single lock; who stands behind that lock is not resolvable from the honeypot, and this letter does not pretend it is.

Why known indicators do not die

The operational lesson sits uncomfortably against a decade of "block the IOC" doctrine.

Blocking this key by its string or its hash is trivial and every defender should do it. But observe what blocking does not accomplish here. The hundred source IPs are already known-bad and mostly disposable; blocking them individually is whack-a-mole against a set that regenerates. The key itself is famous; blocking its exact bytes catches this campaign and nothing else, because the next crew's key will be a different fixed constant that is not yet famous. And the victims — the machines that actually end up with the line in their authorized_keys — are not protected by any of this, because the compromise already happened at the SSH-brute-force stage and the key is the consequence, not the vector.

The detection that generalizes is not a signature at all. It is a behavior: any write to authorized_keys. The mdrfckr key is caught by its reputation; every future key that isn't yet infamous is caught only by watching the file it must be written to. A defense organized entirely around artifact reputation is structurally one campaign behind, forever, because reputation is retrospective and the file-write is not. The honeypot's widest-reaching artifact is precisely the one that a reputation-based defense handles worst: it leaves no binary to scan, its network delivery looks like an ordinary SSH session, and its persistence is indistinguishable from a legitimate administrator adding a key — unless you are watching the file and know which keys belong there.

This is the same conclusion the census reached from the aggregate, now sharpened by the specific artifact. You cannot blocklist a habit. You can only watch the file the habit writes to — and know your own keys well enough to notice a hundred-and-eighth.

What the key does not carry

There is a revealing contrast with the honeypot's other single-artifact operator — the 4,745-byte RSA-signed IRC worm that the census counted as its second-largest presence. Both are, at bottom, one fixed file copied perfectly across many drops. Both achieve their reach through uniformity rather than through per-victim customization. But what each file carries is opposite, and the difference is the whole distance between two philosophies of intrusion.

The worm's 4,745 bytes carry the entire operation: the propagation logic, the IRC command channel, the credential dictionary, the mining payload's fetch. It is self-contained and therefore loud — it runs, it connects out to a command server, it consumes CPU, it announces itself in a dozen ways to anyone watching the host. It brings everything with it because it trusts nothing already present.

The mdrfckr key's 389 bytes carry nothing — no logic, no channel, no payload. It carries only a claim: this key belongs here. Everything it needs to function was already on the victim, shipped by the operating system vendor, running as a trusted service. The worm is a tenant that moves in with all its own furniture and makes noise; the key is a tenant that changes the lock and leaves, silent, and comes back only when it chooses. The worm you catch by watching what runs. The key you catch only by watching what was written, because after the writing, nothing runs at all until a login that will look, on every axis a monitor can measure, exactly like the administrator coming home.

That contrast is why the key outranks the worm on reach despite carrying a fraction of the capability. Capability is weight, and weight is friction. The key shed everything that could be detected or could fail, kept only the one line that grants return access, and bought maximal distribution with minimal surface. It is the logical endpoint of the minimalism the census named — the operator who realized that the most durable malware is the malware that isn't there.

Minimalism as a strategy, not a shortcut

The preceding census sorted the honeypot's operators onto three axes: depth, breadth, and minimalism. The mdrfckr key is minimalism's purest exemplar, and seeing it in full makes clear that minimalism is a deliberate strategy with real advantages, not merely the crude end of a sophistication scale.

The toolkit is deep: one architecture, compiled, modular, quietly persistent, maintained across months by an author with genuine software discipline. RedTail is broad: the same payload compiled for every CPU family from x86 to RISC-V, fired in dated waves to cover whatever the victim happens to run. The mdrfckr key is minimal: it assumes the victim's own software is the malware, and simply adds its owner to that software's trust store. Zero binary, zero infrastructure, zero runtime footprint, 389 bytes — and, by distinct-IP reach, the most prevalent artifact of the three.

There is a lesson in that ranking that cuts against the reflex to equate sophistication with threat. The most technically impressive operator at the sensor is not the most prevalent. The most prevalent is the one that wrote the least code and reused a key so old it predates most of the honeypots now recording it. Sophistication buys depth and stealth; minimalism buys reach and durability; and the two are not merely different points on one scale, they are different scales entirely. An analyst who ranks threats by how much engineering went into them will rank the Outlaw key last and be exactly wrong about what is most likely to be in a given victim's authorized_keys right now.

Bounds and limits

DOCUMENTED, first-party: the single SHA-256 across all 107 drops; the 389-byte size; the 100 distinct source IPs; the 2026-03-31 to 2026-07-23 span; the average source-IP threat score of 75.3; the full key material; and the decoded public exponent of 37 and 2048-bit modulus.

INFERRED, high confidence: that the artifact is the Outlaw/Dota botnet's persistence key. This rests on the well-documented, years-old public association of the mdrfckr comment and this key format with that crew, reinforced by the non-standard exponent, not on any novel attribution performed here.

BOUNDED: the individual identities and network locations (ASNs, geographies) of the hundred delivering IPs were not enumerated in this analysis — they are characterized only in aggregate, by count and by average threat score. "One owner" denotes one keypair, not necessarily one person or one crew; key and even private-key reuse across actors is exactly the phenomenon that makes a single fixed key so far-reaching, and it means the private half could be held by one party or several. This is one sensor's retained corpus, so "widest reach" is widest at this sensor — though a decade of corroborating public reporting makes it very likely the pattern generalizes. Finally, a delivered key is a compromise consequence; the honeypot observes the key being planted, not the brute-force or exploitation that earned the shell in which it was planted.

None of these bounds soften the core result. The most widely distributed thing the honeypot has ever retained is a single, named, decade-old public key with a non-standard exponent and an obscene comment, planted a hundred different ways by a hundred different hands, every one of which fits the same lock — a lock held by whoever first cut the key. The census called the widest net a habit. The evidence calls it a skeleton key: 389 bytes, one owner, every door.

This letter follows from the full-corpus operator census (The Toolkit, Part Four), which identified this artifact as the corpus's widest-reaching by distinct source IP and left its ownership as an open bound. Resolving that bound required one measurement — the file hash — and the answer named a decade-old adversary the industry has catalogued and never closed.