established 3 SSH sessions using credentials ak/3245gs5662d34 and ak/ak@123 via libssh 0.11.1 client ...
show moreestablished 3 SSH sessions using credentials ak/3245gs5662d34 and ak/ak@123 via libssh 0.11.1 client. Primary attack chain involved SSH key injection for persistence. First command removed existing .ssh directory, recreated it, and injected public RSA key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx...) into authorized_keys for passwordless remote access. Second command attempted to modify file attributes using chattr -ia to prevent key removal, followed by invocation of "lockr" utility (likely typo or non-standard tool attempting similar file locking). Attack demonstrates SSH persistence technique targeting root or privileged account. No malware downloads observed. No lateral movement or port forwarding commands detected. Credentials suggest automated credential stuffing or dictionary attack pattern (generic username with weak password variants).
show less
Brute force attack across 3 credential pairs using libssh 0.9.6. Successfully authenticated with at ...
show moreBrute force attack across 3 credential pairs using libssh 0.9.6. Successfully authenticated with at least one cred set. SSH key injection executed: removed .ssh dir, recreated it, implanted RSA public key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx) for persistent access. chattr -ia cmd issued on .ssh dir to prevent deletion. Lockr cmd attempted (malformed). Attack chain indicates persistence setup for unauthorized access maintenance and potential privilege escalation/lateral movement. Cred pattern (alphanumeric strings like "345gs5662d34") suggests dictionary/automated attack. Activity completed within 4 seconds across 3 sessions, typical of automated scanning. SSH key injection with immutability flags prioritized for persistence.
show less
conducted credential stuffing using libssh 0.9.6 across three login attempts, succeeding with swapna ...
show moreconducted credential stuffing using libssh 0.9.6 across three login attempts, succeeding with swapna/swapna123. Initial access resulted in SSH directory manipulation: removed ~/.ssh, recreated it, and injected RSA public key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx) for persistence via unauthorized SSH key addition. Second command attempted to lock down the .ssh directory using chattr -ia to prevent deletion and modifications, followed by an unrecognized command (lockr -ia .ssh) that may be a typo or custom utility. Attack chain demonstrates classic persistence pattern: credential compromise, authorized_keys manipulation, and filesystem attribute hardening to prevent remediation. Low sophistication but effective for maintaining persistent backdoor access. No malware downloads or lateral movement observed during session window, though SSH key injection enables future passwordless access.
show less
Credential brute force via libssh_0.11.1 targeting creds: 345gs5662d34/345gs5662d34, root/12qwaszX, ...
show moreCredential brute force via libssh_0.11.1 targeting creds: 345gs5662d34/345gs5662d34, root/12qwaszX, root/3245gs5662d34. Attack chain: removed .ssh dir, recreated it, injected RSA pub key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx) for passwordless auth. Used chattr -ia on .ssh dir to set immutable/append-only flags preventing deletion. Invoked lockr cmd with identical flags for additional protection. Goal: persistent SSH access resilient against incident response deletion attempts. Automated exploitation focused on persistence mechanisms.
show less
Reconnaissance and credential compromise activity. Attacker used libssh client to enumerate system r ...
show moreReconnaissance and credential compromise activity. Attacker used libssh client to enumerate system resources (CPU, memory, disk) via Linux inspection cmds. Password change executed: echo pipe to passwd utility, new cred w90mcS3i8SxG. SSH key injection: removed .ssh dir, created new one, injected RSA pubkey (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx...). Cmds included chmod modifications (.ssh perms hardened), crontab enum, file attr manipulation (chattr, lockr) suggesting intent to prevent cleanup of injected SSH keys. Pattern indicates post-compromise persistence: passwordless SSH access, prevent authorized_keys removal. Three sessions within ~2 min window suggest automated scanning or scripted exploit. No malware dl or lateral movement observed.
show less
Go-based SSH client attempted exploitation with three sessions over 8 minutes using weak credentials ...
show moreGo-based SSH client attempted exploitation with three sessions over 8 minutes using weak credentials: sol/123, sol/sol/1234, and ubuntu/ubuntu. All three credentials achieved successful authentication. Post-authentication reconnaissance executed: system enumeration via uname with full output flags (system, version, nodename, release, machine), GPU detection through lspci VGA filtering, and uptime query. No malware downloads, persistence mechanisms, lateral movement, or port forwarding observed. Attack pattern indicates automated reconnaissance scanning for system fingerprinting and resource profiling, likely probe activity for victim classification before staged payload delivery or exploitation. No command injection attempts or shell metacharacters detected in executed commands. Sessions terminated after reconnaissance phase without further activity.
show less
Golang SSH client, 4 sessions from single source. Weak creds attempted: sol/123, sol/321, solana/val ...
show moreGolang SSH client, 4 sessions from single source. Weak creds attempted: sol/123, sol/321, solana/validator, validator/validator. Post-auth recon only: uname, lspci, uptime for kernel/GPU/runtime details. No malware dl, no persistence, no lateral movement, no file transfers, no priv esc, no reverse shells. Activity suggests automated credential spray targeting Solana validator infra/dev envs. Resource assessment recon before potential secondary payload delivery. No interactive attacker control observed.
show less
Go-based SSH client attempted three sessions over 14 minutes using weak ubuntu credentials (ubuntu/u ...
show moreGo-based SSH client attempted three sessions over 14 minutes using weak ubuntu credentials (ubuntu/ubuntu and ubuntu/ubuntu123). Session authentication succeeded at least once, enabling command execution. Attacker enumerated system information via uname command (kernel name, version, nodename, release, machine architecture) and checked system uptime. No malware payloads, persistence mechanisms, lateral movement, port forwarding, or data exfiltration observed. Activity indicates reconnaissance phase of potential botnet infection or manual exploitation chain, consistent with early-stage scanning operations that typically precede payload delivery.
show less
used libssh 0.9.6 client to conduct SSH brute force with three credential pairs: 345gs5662d34/345gs5 ...
show moreused libssh 0.9.6 client to conduct SSH brute force with three credential pairs: 345gs5662d34/345gs5662d34, ll/3245gs5662d34, ll/ll across three sessions within 4 seconds. Two distinct command sequences were executed. First command removes existing SSH directory, recreates it, and injects a public RSA key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx) into authorized_keys, enabling passwordless key-based access for persistence. Second command attempts to modify file attributes using chattr and lockr tools to set immutable flags on .ssh directory, preventing accidental or intentional deletion and hardening persistence against remediation efforts. Attack demonstrates automated credential stuffing combined with SSH key injection for persistent backdoor access and attribute-level protection mechanisms to maintain foothold.
show less
Go-based SSH client executing automated reconnaissance targeting GPU and system information. Four fa ...
show moreGo-based SSH client executing automated reconnaissance targeting GPU and system information. Four failed authentication attempts using common credential pairs (sol/1234567, solana variants with sequential numeric passwords). Upon compromise, attacker executed 7 distinct commands across 22 total invocations focused on hardware enumeration: system specifications via uname, GPU detection via lspci filtering for 3D controllers and VGA devices, NVIDIA GPU identification via nvidia-smi product name extraction with count validation, and system uptime retrieval. Attack pattern indicates fingerprinting for cryptocurrency mining infrastructure targeting systems with GPU acceleration (NVIDIA). No persistence mechanisms, lateral movement, or payload downloads observed. Session duration approximately 13 minutes with multiple reconnection attempts using incremental password variations. No malware artifacts identified. Activity consistent with automated scanning for systems suitable for GPU-based mining operations.
show less
scanned system specifications and resource inventory using weak credentials (sol/sol, solana/solana) ...
show morescanned system specifications and resource inventory using weak credentials (sol/sol, solana/solana) across 3 sessions in 10 minutes. Go-based SSH client conducted GPU reconnaissance—queried CPU cores via nproc, enumerated NVIDIA GPUs with lspci and nvidia-smi, extracted product names and counts. Also collected kernel version, hostname, and system uptime via uname and uptime commands. No malware downloads, persistence mechanisms, or lateral movement observed. Pattern consistent with cryptocurrency miner botnet reconnaissance targeting GPU-equipped systems for resource hijacking. Credentials suggest targeting Solana ecosystem infrastructure or systems with Solana-related naming conventions. No command execution beyond recon.
show less
Credential spray attack using libssh 0.9.6 across 3 sessions. Attacker attempted credentials 345gs56 ...
show moreCredential spray attack using libssh 0.9.6 across 3 sessions. Attacker attempted credentials 345gs5662d34/345gs5662d34 and sugar/sugar123. Upon successful authentication, executed multi-stage attack: First command removed existing .ssh directory and created new one, then injected RSA public key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx) into authorized_keys for persistence via passwordless SSH access. Second command used chattr and lockr utilities to make .ssh directory immutable (-ia flags), preventing removal or modification of injected keys. Attack chain establishes persistent backdoor access with anti-forensics hardening. Attack duration approximately 96 seconds across credential enumeration and exploitation phases. Infrastructure likely part of automated SSH scanning botnet targeting weak or default credentials for establishing persistent command and control access points.
show less
conducted credential enumeration using libssh 0.9.6, attempting three user/password pairs: 345gs5662 ...
show moreconducted credential enumeration using libssh 0.9.6, attempting three user/password pairs: 345gs5662d34/345gs5662d34, fbapps/3245gs5662d34, and fbapps/fbapps123 across three sessions within 10 seconds. Executed SSH key injection attack: removed existing .ssh directory, recreated it, and injected a public RSA key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx) for persistent backdoor access. Second command attempted to lock down .ssh directory using chattr and lockr, hardening persistence against removal attempts. Attack pattern indicates automated credential cycling followed by SSH key establishment for long-term access, typical of botnet scanning and account takeover operations. Libssh 0.9.6 is outdated library commonly exploited by mass-scanning malware.
show less
Brute-ForceSSH
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.