2024 Outlaw Botnet: Cryptojacking Breach Exposes SSH Weaknesses
In early 2024, a DShield honeypot operated as part of the SANS.edu BACS program detected a sophisticated cryptojacking and botnet campaign leveraging SSH password spraying as the initial access vector. Attackers, suspected to be affiliated with the Outlaw cybercrime group, gained access to exposed Linux hosts and executed automated enumeration scripts to assess system viability for botnet or cryptomining operations. Subsequently, evidence of persistent SSH backdoors and the transfer of malware—identified as both a Trojan and a miner—was observed, suggesting the compromised servers were targeted for both resource abuse and brokering to other cybercriminals for further exploitation. This incident highlights the ongoing trend of cybercrime groups specializing in initial access brokerage and automation of lateral compromise using credential attacks and script-based post-exploitation. Organizations should remain vigilant as password-based SSH, exposed management interfaces, and unmonitored east-west traffic continue to enable rapid propagation of botnets focused on monetizing vulnerable cloud and on-prem workloads.
Kill Chain