Brute-force credential attack targeting SSH using Go-based client. 18 password combinations attempted across admin and ubuntu accounts, prioritizing weak/default credentials (admin/admin, admin/default, ubuntu/ubuntu, ubuntu/ubuntu123, etc.) alongsid ...
show moreBrute-force credential attack targeting SSH using Go-based client. 18 password combinations attempted across admin and ubuntu accounts, prioritizing weak/default credentials (admin/admin, admin/default, ubuntu/ubuntu, ubuntu/ubuntu123, etc.) alongside common variants with numeric and special character suffixes. Attack executed reconnaissance commands to profile target system: hostname, kernel version, architecture, and uptime via $HOME variable check, uname output, and /proc/uptime parsing. PATH manipulation command exported expanded environment variable including standard binary directories. No file downloads, persistence mechanisms, lateral movement, or privilege escalation observed within session window. Attack pattern consistent with automated credential scanning using standard Linux profiling techniques typical of botnet reconnaissance or mass vulnerability assessment campaigns. Go SSH client suggests scripted or automated tooling rather than manual access.
show less
Mar 8 11:02:56 garden01 sshd[1393333]: Invalid user admin from 188.166.94.149 port 46480
Mar 8 11:03:46 garden01 sshd[1393829]: Invalid user admin from 188.166.94.149 port 52696
Mar 8 11:04:36 garden01 sshd[1394356]: Invalid user admin from 188.16 ...
show moreMar 8 11:02:56 garden01 sshd[1393333]: Invalid user admin from 188.166.94.149 port 46480
Mar 8 11:03:46 garden01 sshd[1393829]: Invalid user admin from 188.166.94.149 port 52696
Mar 8 11:04:36 garden01 sshd[1394356]: Invalid user admin from 188.166.94.149 port 48884
Mar 8 11:05:26 garden01 sshd[1394968]: Invalid user admin from 188.166.94.149 port 50792
Mar 8 11:06:16 garden01 sshd[1395481]: Invalid user admin from 188.166.94.149 port 33662
...
show less
Automated SSH brute-force attack using Go-based client. Nine sessions over ~10 minutes attempting six common root credentials: 1234, 123456, admin, password, password1, root. Upon successful authentication, executed system reconnaissance commands to ...
show moreAutomated SSH brute-force attack using Go-based client. Nine sessions over ~10 minutes attempting six common root credentials: 1234, 123456, admin, password, password1, root. Upon successful authentication, executed system reconnaissance commands to enumerate OS version, hostname, architecture, and uptime via uname and /proc/uptime queries. PATH environment variable explicitly set to standard system directories. Attack pattern consistent with automated botnet reconnaissance phase preceding payload delivery or lateral movement. No file transfers, persistence mechanisms, or command execution beyond initial fingerprinting observed in captured sessions. Credentials tested suggest dictionary-based approach targeting default/weak configurations.
show less
2026-03-08T12:16:55.254820+02:00 mail sshd[1974925]: Failed password for root from 188.166.94.149 port 58702 ssh2
2026-03-08T12:18:05.851402+02:00 mail sshd[1974990]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r ...
show more2026-03-08T12:16:55.254820+02:00 mail sshd[1974925]: Failed password for root from 188.166.94.149 port 58702 ssh2
2026-03-08T12:18:05.851402+02:00 mail sshd[1974990]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.94.149 user=root
2026-03-08T12:18:07.875809+02:00 mail sshd[1974990]: Failed password for root from 188.166.94.149 port 32908 ssh2
2026-03-08T12:19:17.890779+02:00 mail sshd[1975021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.94.149 user=root
2026-03-08T12:19:19.795147+02:00 mail sshd[1975021]: Failed password for root from 188.166.94.149 port 38454 ssh2
...
show less
