A Tale of 3 Actors I pulled my honeypot download cache this week. 108 files. Most of it noise. But buried in…
PETER D. — Cybersecurity / Threat Researcher / Breaker of All Things / Discovered a 563-Node Global Botnet
A Tale of 3 Actors
I pulled my honeypot download cache this week. 108 files. Most of it noise. But buried in there were three distinct actors who had authenticated to a system that doesn't exist, run their toolkit, and left malware behind.
Each one had no idea the other two were there.
Actor 1 kicked the door in. First thing it did was evict whoever was there before it — killed a competing miner, scrubbed every crontab on the system, wiped /tmp clean. Then planted its SSH key into authorized_keys and locked it with chattr +ai so nobody could touch it. When finished, its C2 sent back one string: auth_ok.
Very professional. Very confident. Very wrong address.
Actor 2 was quieter. SFTP session. 5 minutes. One file uploaded. Named it sshd — you know, like the legitimate SSH daemon already running on every Linux system on earth.
36 out of 55 antivirus engines disagree with that naming choice.
Actor 3 nobody sent. It just showed up. Turns out it was a self-propagating worm scanning the internet for Raspberry Pis with default credentials — pi:raspberry — copying itself via sshpass/scp to every box it found and looping forever. It crawled into my honeypot the same way it crawled into everything else. Completely automated. Completely indiscriminate.
Three actors. Three motivations. One system that doesn't exist.
All three are now tracked. The SSH key from Actor 1 — rsa-key-20230629 — is burned. If you see it, same operator. If you see an sshd binary that appeared recently and wasn't installed by your package manager, look closer. And if you have a Raspberry Pi sitting somewhere with default credentials — just fix that.
IOCs — TLP:WHITE:
Trojan.Multiverze (22/55 VT) · chattr +ai SSH persistence
· C2 beacon auth_ok · SSH key rsa-key-20230629
· CoinMiner ELF disguised as sshd (36/55 VT)
· Pi worm credentials pi:raspberry / pi:raspberryraspberry993311
· zmap -p 22 mass scanner
2 reactions · 0 comments