The Eviction: How the Widest Net Takes a Machine by Emptying It First

The Skeleton Key — Part 2

Classification: HIGH · Confidence: HIGH (first-party command-log capture)

The first letter in this thread identified the corpus's widest-reaching artifact — a single ssh-rsa key with the comment mdrfckr, the Outlaw botnet's decade-old persistence key, planted by a hundred distinct source addresses and answering to one private key. It measured the reach and named the owner. What it could not yet show, because it was working from the retained key file alone, was the act — the exact command the hundred hands run to plant it. The command log has it now, and it changes the character of the finding. The key is not appended to the machine. The machine is emptied first, and then the key is installed as the only one left.

Here is the operation, captured verbatim, executed 107 times from 100 distinct source IPs across the full four-month window:

cd ~ && rm -rf .ssh && mkdir .ssh &&
echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4...oRw== mdrfckr" >> .ssh/authorized_keys &&
chmod -R go= ~/.ssh && cd ~

Read the sequence in order, because the order is the whole point. Before a single byte of the attacker's key is written, rm -rf .ssh removes the victim's entire SSH directory. Only then is a fresh .ssh created, the key installed as its sole contents, and the permissions locked down. This is not persistence added alongside whatever was there. It is a demolition followed by a rebuild, and what it demolishes is worth itemizing.

What rm -rf .ssh destroys

The victim's ~/.ssh directory is not empty on a real machine, and the Outlaw command deletes all of it.

It destroys the user's authorized_keys — every key that previously granted access, legitimate or otherwise. It destroys known_hosts — the record of which remote servers the victim has verified, so that after the eviction the victim's own outbound SSH no longer recognizes the hosts it habitually connects to, silently removing a layer of man-in-the-middle protection. And most consequentially, it destroys the victim's private keys — id_rsa, id_ed25519, any identity the user kept there — which are the victim's credentials to other machines. A user who authenticated to a dozen other servers by key wakes up, after this command runs, unable to reach any of them, because the keys that identified them are gone. The eviction is not only an intrusion into this machine. It is the severing of this machine's trusted relationships with every other machine it could reach.

There is a fourth thing rm -rf .ssh destroys, and it is the one that reveals the command's logic: any other attacker's backdoor key. On an unhardened, internet-exposed, repeatedly-brute-forced host — which is the only kind of host this campaign runs on — the victim is not the only intruder. A box that one credential-spraying botnet can reach, a dozen others can reach too, and several of them plant authorized_keys backdoors of their own. Appending your key to that file leaves you sharing the machine with every rival who got there first. Deleting the file and starting fresh does not.

The command is a claim of exclusivity

That is the reframing the command forces on the previous letter. The skeleton-key letter described the artifact as a lock: whoever holds the private key can return. The command shows it is a lock that also changes every other lock and throws the old keys away. The Outlaw operator does not want to be one of several keyholders on a shared machine. It wants to be the only one, and rm -rf .ssh is how it enforces that — not by out-competing rivals for access, but by evicting them from the file that grants it.

This casts the corpus's whole SSH-key economy in a sharper light. The honeypot holds more than one key-planter; later letters in this thread examine a second operator with entirely different tradecraft. They are not working in isolation. They are competing for the same finite population of weak-credentialed hosts, and the authorized_keys file is the contested ground. In that competition, the Outlaw kit's strategy is the scorched-earth one: do not negotiate the file, replace it. The widest-reaching artifact in the corpus is also the most territorial. It reaches the most machines, and on each one it insists on being alone.

And the exclusivity is enforced with a byte-level uniformity that deepens the single-operator finding from the first letter. That letter established that the key was identical across all hundred hands. The command log establishes something stronger: the entire command is byte-for-byte identical across all 107 executions — the same cd ~, the same rm -rf .ssh, the same chmod -R go=, the same trailing cd ~. A hundred unrelated operators who merely reused a public key would still type their own delivery around it. A hundred copies of one program produce one command, unchanged. The uniformity is not of the key alone; it is of the whole act, which is the signature of a single kit executing on a hundred machines, not a hundred authors converging on a habit.

The eviction war has no winner

The corpus holds a spectrum of answers to the same question — how do you own the authorized_keys file on a machine other attackers also want? — and laying the Outlaw command against the others shows that its scorched-earth strategy wins only until the next attacker runs the same play.

At the permissive end sits the plain append: add your key, leave the rest, coexist. It is the quietest and the weakest — every rival keyholder still has access, and any of them can remove your line. In the middle sits the Outlaw replace: delete everything, install one key, lock the permissions. It evicts every current rival in a single stroke. And at the aggressive end — the subject of the next letter — sits the lock: install a key and then make the file immutable, so that nothing, not even root, can alter it without first clearing an attribute most intruders never check for.

The Outlaw command sits in the middle, and the middle has a fatal symmetry. rm -rf .ssh evicts whoever came before — but it installs nothing that stops whoever comes after from running rm -rf .ssh in turn. The Outlaw key's exclusivity is soft: it is the current occupant, not the permanent one. The very command that makes it the sole keyholder is available, unchanged, to every competitor, and on a contested host the file's ownership therefore churns — Outlaw evicts a rival, a rival evicts Outlaw, Outlaw returns and evicts again. The command's uniformity across a hundred hands is also its vulnerability: because everyone can run the identical eviction, no one's tenancy is secure, and the authorized_keys file on a heavily-contested box is less a lock than a turnstile. This is exactly the gap the immutable-lock operator of the next letter closes, and closing it is the whole reason that operator's tradecraft exists. The Outlaw kit, for all its scorched-earth confidence, left the back door it walked through standing open behind it.

chmod -R go= is not decoration — it is knowledge

The command ends with chmod -R go= ~/.ssh, which strips all group and other permissions from the new directory and its key. It is easy to read as reflexive tidiness. It is not. It is the mark of an author who understands the mechanism they are abusing.

OpenSSH enforces a policy called StrictModes, on by default, which causes sshd to refuse a user's authorized_keys file if that file — or the .ssh directory, or the home directory — is writable by group or other. The safety rationale is sound: a world-writable authorized_keys could be tampered with by any local user, so the daemon declines to trust it. For the attacker, that policy is a trap. A backdoor key installed into a loosely-permissioned .ssh directory simply will not work; sshd will ignore it and the return access will silently fail. The chmod -R go= exists to defeat exactly that failure mode: it guarantees the permissions are tight enough for sshd to honor the planted key. The command is not merely planting a key; it is planting a key and satisfying the daemon's conditions for using it, which requires knowing what those conditions are.

That is a small tell with a large implication. The Outlaw kit is old, famous, and mechanically correct. Its author did not copy a key and hope; they wrote a command that accounts for StrictModes, for pre-existing directories, for stale permissions, and for competitors — and then froze it, so that a decade later a hundred hands run the identical, correct, exclusive one-liner. The competence is in the details that never had to change because they were right the first time.

The cost of the strategy: it is loud to the human

Exclusivity has a price, and the command pays it in stealth. An authorized_keys append is quiet — a single extra line in a file the user rarely inspects, easily overlooked for months. The Outlaw command is not an append. It is a deletion of the entire .ssh directory and everything the user kept there, and that is loud to the one observer automated defenses do not model: the legitimate human.

A sysadmin who finds their known_hosts reset and their id_rsa missing has an unignorable symptom — their own key-based access to other systems has broken — and a broken workflow gets investigated in a way a quietly-appended line never does. The Outlaw kit trades stealth-against-humans for exclusivity-against-rivals: it accepts a higher chance that a real operator notices the intrusion, in exchange for the certainty that no other intruder shares the box. That is a coherent bet for a mass-mining botnet whose economics depend on sole use of a machine's CPU — a miner does not want to split a stolen host's cycles with three other miners — but it is the opposite of the "silent, borrow the daemon, leave no trace" character the artifact's small size first suggested. The 389 bytes are silent to a scanner. The command that installs them is a demolition the machine's owner can feel.

A hundred hands, one script, four months

The temporal shape of the capture — 107 executions from 100 distinct IPs, spread across the entire four-month window and still arriving on the final day — is worth reading as an operation rather than a statistic, because it describes a machine that is not taken once but taken continuously.

That the execution count (107) barely exceeds the IP count (100) tells you the command is a first-contact action: nearly every hand runs it once, on a freshly-brute-forced shell, and moves on. This is not one operator revisiting; it is the botnet's spreading edge, each newly-conscripted node planting the key on the next victim it cracks. And because the eviction is soft, the same victim can be re-taken: a box the campaign owned in April, lost to a rival in May, and re-cracked in June receives the identical rm -rf .ssh again, evicting whatever displaced it. Over four months, on the internet's population of permanently-weak hosts, this produces a steady-state churn — the key is not planted once and left, it is re-planted across the fleet indefinitely, which is exactly why a decade-old, universally-signatured key was still arriving on the last day the sensor recorded.

It also reframes the eviction's destructiveness at scale. Each execution destroys one victim's known_hosts and private keys, and the command has run at least 107 times against this single sensor's worth of exposure. Multiplied across the real internet, the Outlaw campaign is not only a mass-persistence operation; it is a slow, distributed shredder of ordinary users' SSH identities — deleting, one cracked box at a time, the private keys and trusted-host records of everyone whose credentials were weak enough to lose. The reach measured in the first letter was a reach of access. The command shows it is also a reach of erasure: a hundred hands, one script, four months, and a trail of emptied ~/.ssh directories behind every one of them.

Why a miner wants a key at all

It is worth asking why the operation plants an SSH key in the first place, because the answer explains the eviction's aggression. By the time this command runs, the attacker already has a shell — the key is planted after a successful brute-force login, so the access it grants is access the operator already possesses. Installing a key is not how the Outlaw kit gets in. It is how it converts a perishable win into a durable asset.

A brute-forced password is a fragile foothold: the owner can change it, a fail2ban rule can lock the source out, a reboot can drop the session. A planted key is none of those things. It survives a password change, because key authentication does not consult the password. It survives the loss of the original source IP, because any of the botnet's hundred hands can return through the same key. And it survives, in principle, the attention of a careless cleanup that resets the password but never inspects authorized_keys. The key transforms a one-time credential-spray success into permanent, portable re-entry — cheaper to keep than the brute-force was to win, and re-usable by the whole botnet and by whoever the private key is ever sold to.

That durability is exactly what makes the eviction rational. If the key is the operation's long-term asset — the thing that outlives the password, the session, and the source IP — then sharing the authorized_keys file with a rival is sharing the long-term asset, and a rival's rm -rf .ssh would destroy it. The Outlaw kit protects the value of its own persistence by denying persistence to everyone else on the box. The eviction is not gratuitous destruction; it is an asset-holder clearing title. The miner wants sole use of the CPU, and sole use begins with sole ownership of the one file that decides who can come back.

Defense: the eviction is a gift to detection

The destructiveness that makes the command costly to the attacker's stealth makes it valuable to the defender's detection, because it is behavior no legitimate administrator produces.

No one manages a fleet by running rm -rf ~/.ssh and immediately rewriting authorized_keys with a single key. The deletion-then-single-key-rewrite of a user's SSH directory is a control-flow shape with essentially no benign counterpart, which makes it an almost false-positive-free tripwire: a file-integrity monitor or an audit rule that fires on the removal of ~/.ssh (not merely writes to authorized_keys) catches this campaign at the instant of the eviction, and catches it specifically because the eviction is the unusual part. Watching for additions to authorized_keys is the common advice; watching for the deletion of the directory catches the operator who does not append at all.

There is also a recovery lesson that outlives detection. A host cleaned of the Outlaw key is not a host restored. The command destroyed the victim's known_hosts and private keys, and no amount of removing the attacker's key brings those back. Incident response on an Outlaw-compromised machine has to assume the victim's own SSH identity was collateral damage — that any key the user kept in ~/.ssh is both gone and, because the machine was hostile while it was readable, potentially compromised before deletion — and must regenerate and re-trust those credentials rather than assume a clean directory means a clean state. The eviction's damage is not undone by eviction of the attacker.

Bounds and limits

DOCUMENTED, first-party: the exact planting command, byte-identical across 107 executions from 100 distinct source IPs, spanning 2026-03-31 to 2026-07-23; its sequence of rm -rf .ssh, directory recreation, single-key install, and chmod -R go=; and the identity of the key as the Outlaw/mdrfckr artifact established in the previous letter.

INFERRED, high confidence: that chmod -R go= exists to satisfy OpenSSH StrictModes (its effect is exactly that, and no other purpose fits); that the byte-identical command across all executions indicates one kit rather than a hundred independent authors. INFERRED, moderate confidence: that the eviction of prior keys is, in effect, competitive — rm -rf .ssh demonstrably deletes any rival backdoor, though whether the author's intent was competition or merely clean-slate hygiene is not recoverable from the command; the competitive effect holds regardless of intent on contested hosts.

BOUNDED: the impact of destroying the victim's private keys and known_hosts depends on whether the victim used key-based authentication at all — on a host that never held private keys, the eviction destroys less, though it still removes any competitor's authorized_keys. This is one sensor's capture of the command; the command's effect on a real production host is reconstructed from what the command does, not observed on a victim. And "loud to the human" assumes a human who inspects the machine — an unattended, forgotten box may never register the damage at all, which is precisely the kind of box the campaign prefers.

None of these bounds soften the core correction. The corpus's widest-reaching artifact does not join a machine's authorized_keys file. It deletes the file, the victim's other keys, their record of trusted hosts, and any rival's backdoor, and then writes itself in as the sole survivor — correctly permissioned so the daemon will honor it. The skeleton key opens every door; the command shows that on each machine, its first act is to change the locks and throw away everyone else's keys.

This is Part Two of The Skeleton Key. Part One measured the reach and named the owner; this part read the command and found the reach is taken by eviction, not addition. Part Three turns to a rival key-planter with the opposite instinct — not to delete what came before, but to make what it installs impossible to remove.