11 SSH sessions in 14 minutes using SSH-2.0-Go. The actor tried weak credentials: admin/1, admin/12, ...
show more11 SSH sessions in 14 minutes using SSH-2.0-Go. The actor tried weak credentials: admin/1, admin/12, admin/123, and root with 12, 123, 1234, 12345, 123456, 1234567, 123456789, 1234567890. After login they ran sudo-wrapped checks to enumerate CPU count via nproc/grep /proc/cpuinfo, then issued multiple marker strings like check_..._transport_done. No downloads, dropped files, malware, persistence, port forwarding, lateral movement, or other payload execution was observed. Activity was limited to login attempts and host recon.
show less
SSH login attempts used admin1/123 and ec2-user/123456 from an SSH-2.0-Go client. After login, the a ...
show moreSSH login attempts used admin1/123 and ec2-user/123456 from an SSH-2.0-Go client. After login, the actor executed sudo-wrapped shell commands to run /home/<user>/.16, chmod it executable, and remove it. The uploaded payload .16 was transferred twice to /home/honeypot/.16, then invoked and deleted. The session also printed check_08cf595024dc92a73e385cd7e7b36490_transport_done and check_599fb3a5738fe9b32ecdccd221969b85_transport_done. No lateral movement, port forwarding, or other persistence was observed in the provided activity.
show less
Login attempt used credentials sol/sol via SSH-2.0-Go. After access, the actor ran host-enumeration ...
show moreLogin attempt used credentials sol/sol via SSH-2.0-Go. After access, the actor ran host-enumeration commands only: uname for kernel/host details, uptime -p, nproc --all, lspci queries for VGA/3D controllers, and nvidia-smi -q checks to detect GPU presence/product name. No downloads, file writes, persistence, port forwarding, lateral movement, or malware artifacts were observed. Activity focused on system reconnaissance and hardware profiling.
show less
Single SSH login using mailadmin/mailadmin from a Go SSH client. Attacker checked CPU count and runn ...
show moreSingle SSH login using mailadmin/mailadmin from a Go SSH client. Attacker checked CPU count and running processes, then staged files in /dev/shm and attempted persistence by querying crontab and adding an @reboot entry for /dev/shm/w.sh. They created and executed astats and kstats from /dev/shm, including chmod +x and ะทะฐะฟััะบ of ./astats with arguments "ssh 2 az". They also ran process-count checks for astats and filtered ps output to confirm execution and hide common system processes. No downloads, lateral movement, or network activity were observed in the session.
show less
9 SSH sessions in 14 minutes using SSH-2.0-Go. Login attempts tried root with 123qwerty, 21, 321, 43 ...
show more9 SSH sessions in 14 minutes using SSH-2.0-Go. Login attempts tried root with 123qwerty, 21, 321, 4321, 54321, 654321, P4ssw0rd, and P4ssword. After access, the actor issued 121 unique shell commands, all echo-based checks of the form โcheck_<id>_transport_doneโ and similar. No downloads, file writes, payload execution, persistence, port forwarding, lateral movement, or artifact drops were observed. The activity was limited to credential guessing followed by command-line probing/validation output.
show less
Single SSH session used ftpuser/ftpuser, then ran system discovery and persistence setup. Commands e ...
show moreSingle SSH session used ftpuser/ftpuser, then ran system discovery and persistence setup. Commands enumerated CPU cores, kernel version, and top processes, then searched writable locations (/dev/shm, /tmp, /var/run, /mnt, /root, /) and selected /tmp. Attacker created /tmp/w.sh, made it executable, and dropped a 1.4 KB script: w.sh, sha256 bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28. They checked the crontab and attempted to add an @reboot entry for /tmp/w.sh with arguments "astats" "netai" "kstats" and "ssh 2 az" (as entered). No downloads, lateral movement, or additional payloads were observed.
show less
Login used test/123456. Attacker checked uname -a, CPU count, and top processes, then probed writabl ...
show moreLogin used test/123456. Attacker checked uname -a, CPU count, and top processes, then probed writable locations with a shell loop. In /tmp, they created and made executable w.sh and used it to set persistence by adding an @reboot crontab entry. They also checked existing crontab entries to avoid duplicates. Recovered payload: w.sh, script, 1.4 KB, sha256:bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28. No lateral movement or downloads were observed in this session.
show less
Single SSH login using ubuntu/@7Ni_ewyF-Q3lEL. The session checked system info with uname -a, enumer ...
show moreSingle SSH login using ubuntu/@7Ni_ewyF-Q3lEL. The session checked system info with uname -a, enumerated CPU count via /proc/cpuinfo, listed top CPU processes, and searched writable locations (/dev/shm, /tmp, /var/run, /mnt, /root, /). It then changed to /tmp, created and made executable w.sh, and attempted to add persistence through crontab with an @reboot entry for /tmp/w.sh "astats" "netai" "kstats" "ssh 2 az". Artifact recovered: w.sh, script, 1.4 KB, sha256:bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28. No downloads, lateral movement, or additional payloads were observed.
show less
Brute-force login with root/root over SSH. After access, the actor checked CPU count and running pro ...
show moreBrute-force login with root/root over SSH. After access, the actor checked CPU count and running processes, then wrote files in writable directories and attempted to stage execution from /tmp. Observed file drop: w.sh, script, 1.4 KB, sha256:bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28. The actor used w.sh to create executable files named astats and kstats, chmod +x on them, and ran ./astats ssh 2 az and ./kstats. They also queried crontab and attempted persistence by adding an @reboot entry for /tmp/w.sh with quoted arguments. No downloads, lateral movement, or additional malware artifacts were observed.
show less
Single SSH session used ftpuser/pC+6Ki@Tn8++7_L, then ran host-enum and setup steps: uname -a, cat / ...
show moreSingle SSH session used ftpuser/pC+6Ki@Tn8++7_L, then ran host-enum and setup steps: uname -a, cat /proc/cpuinfo | grep processor | wc -l, ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10, and a directory check over /dev/shm, /tmp, /var/run, /mnt, /root, /. It then created /tmp/w.sh, made it executable, and checked/added a crontab @reboot entry to run /tmp/w.sh with arguments "astats" "netai" "kstats" "ssh 2 az". Dropped artifact: w.sh, script, 1.4 KB, sha256:bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28. No downloads, lateral movement, or other persistence observed beyond the crontab entry.
show less
Observed SSH login with admin/123456 followed by upload and execution of a bash script and two helpe ...
show moreObserved SSH login with admin/123456 followed by upload and execution of a bash script and two helper binaries. The session created /tmp/w.sh, made it executable, and added an @reboot crontab entry to run it with arguments "astats" "netai" "kstats". The attacker then wrote astats and kstats to disk, chmod +x, and executed ./astats ssh 2 az and ./kstats. Commands also enumerated CPU cores and top processes, and counted running astats instances. No lateral movement was observed. Artifact recovered: w.sh, script, 1.4 KB, sha256 bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28
show less
Single SSH login attempt used ubuntu/ef@+tj-YUbvcQr- over one session. After entry, the actor checke ...
show moreSingle SSH login attempt used ubuntu/ef@+tj-YUbvcQr- over one session. After entry, the actor checked the working directory and host details with sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd "$d" 2>/dev/null && pwd && break; done', uname -a, cat /proc/cpuinfo | grep processor | wc -l, and ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10. They then created /tmp/w.sh, made it executable, and wrote a crontab persistence entry for @reboot to run /tmp/w.sh with arguments "astats" "netai" "kstats" "ssh 2 az". Artifact recovered: w.sh, script, 1.4 KB, sha256 bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28. No download command or lateral movement was observed in this session.
show less
Single SSH login using ftpuser/ftpuser via SSH-2.0-Go. After login, the actor ran host and process r ...
show moreSingle SSH login using ftpuser/ftpuser via SSH-2.0-Go. After login, the actor ran host and process recon: uname -a, cat /proc/cpuinfo | grep processor | wc -l, ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10, and a directory probe across /dev/shm, /tmp, /var/run, /mnt, /root, /. The actor then switched to /tmp, checked for /tmp/w.sh, and created it with cat > "w.sh" followed by chmod +x. Persistence was attempted with crontab manipulation: CRON="$(crontab -l 2>/dev/null || true)" and a grep/printf chain to add an @reboot entry referencing /tmp/w.sh with arguments "astats" "netai" "kstats" and "ssh 2 az". No downloads, file transfers, lateral movement, or other payload execution were observed during this session.
show less
Repeated SSH logins attempted with admin/letmein, admin1/123, ec2-user/123456, and master/ from SSH- ...
show moreRepeated SSH logins attempted with admin/letmein, admin1/123, ec2-user/123456, and master/ from SSH-2.0-Go and SSH-2.0-paramiko_4.0.0 clients. After access, the session uploaded a file named .16 twice to /home/honeypot/.16, made it executable with chmod +x, and attempted to run it via sudo and direct execution. The actor then tried to delete the file and wipe traces with rm -rf /home/honeypot/.16, echo -n '' > /var/log/wtmp, rm -rf .bash_history, and history -c. Commands also probed sudo execution with the submitted passwords and printed transport check markers such as check_8e4938185b181a4084f1e7ba51e3652f_transport_done and check_a3482f8bab0964b909293c2157adbe62_transport_done. No lateral movement or port forwarding was observed.
show less
4 SSH sessions using root/1, root/12, and root/123 over SSH-2.0-Go. Activity was reconnaissance and ...
show more4 SSH sessions using root/1, root/12, and root/123 over SSH-2.0-Go. Activity was reconnaissance and environment checks only. Commands ran sudo with each password to probe nproc/cpu count, exported PATH, ran uname for OS/kernel/host/arch info, and printed multiple transport_done check strings. No file downloads, no dropped files, no persistence, no lateral movement, and no port forwarding observed. Total: 49 unique commands/59 total.
show less
Single SSH login using test/123456 from SSH-2.0-Go. After login, the host was profiled with uname -a ...
show moreSingle SSH login using test/123456 from SSH-2.0-Go. After login, the host was profiled with uname -a, cpu count from /proc/cpuinfo, and ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10. The session then checked writable locations with sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd "$d" 2>/dev/null && pwd && break; done'. Persistence was attempted by creating /tmp/w.sh and adding an @reboot crontab entry referencing /tmp/w.sh with arguments "astats" "netai" "kstats" and "ssh 2 az". No files were reported dropped beyond the attempted /tmp/w.sh creation, and no downloads, port forwards, lateral movement, or additional credentials were observed.
show less
Single SSH session using Go client with credentials mailadmin/MhS+xYL#-OpmE0@. Attacker created /dev ...
show moreSingle SSH session using Go client with credentials mailadmin/MhS+xYL#-OpmE0@. Attacker created /dev/shm/w.sh, wrote and executed astats and kstats in /dev/shm, then ran astats with args "ssh 2 az". Commands checked CPU count, listed top CPU processes, and counted astats processes while filtering out system daemons. Persistence was added via crontab: an @reboot entry invoking /dev/shm/w.sh with arguments including "astats", "netai", "kstats", and "ssh 2 az". No downloads, outbound URLs, lateral movement, or dropped-file hashes were observed.
show less
Single SSH session from SSH-2.0-Go used username ubuntu and password @7Ni_ewyF-Q3lEL. After login, t ...
show moreSingle SSH session from SSH-2.0-Go used username ubuntu and password @7Ni_ewyF-Q3lEL. After login, the actor checked system info with uname -a, CPU count via /proc/cpuinfo, and running processes with ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10. They probed writable locations with a loop over /dev/shm, /tmp, /var/run, /mnt, /root, / and then worked in /tmp. They attempted to create /tmp/w.sh, made it executable, and checked for an existing cron entry containing /tmp/w.sh and the strings "astats" "netai" "kstats" "ssh 2 az". They then tried to add an @reboot crontab entry to run /tmp/w.sh at startup. No downloads, dropped files, port forwards, lateral movement, or other payload execution were observed beyond the persistence setup attempt.
show less
SSH login with root/root from an SSH-2.0-Go client. Attacker checked CPU count and running processes ...
show moreSSH login with root/root from an SSH-2.0-Go client. Attacker checked CPU count and running processes, then attempted to stage and persist binaries in writable locations. Commands created/used /tmp/w.sh, astats, and kstats, with execution of ./astats ssh 2 az and ./kstats after chmod +x. A cron persistence entry was prepared for @reboot to run /tmp/w.sh with arguments "astats" "netai" "kstats" and "ssh 2 az". Additional process checks looked for astats and high-CPU tasks via ps. No dropped-file artifacts or hashes were provided. Actions observed: credential attempt, file staging, execution, and persistence setup.
show less
Single SSH session using ubuntu/Test1234 from SSH-2.0-Go. Attacker checked CPU count and running pro ...
show moreSingle SSH session using ubuntu/Test1234 from SSH-2.0-Go. Attacker checked CPU count and running processes, then created and executed files in /dev/shm: w.sh, astats, and kstats. astats was run with arguments "ssh 2 az". They attempted to make astats persistent by reading crontab and adding an @reboot entry pointing to /dev/shm/w.sh with arguments "astats" "netai" "kstats" "ssh 2 az". They repeatedly searched for astats processes while excluding system services. The activity shows payload staging/execution in a writable temp directory and persistence via cron. No lateral movement, downloads, or hashes were observed.
show less
Two SSH sessions from SSH-2.0-Go used credentials master/wasd and root/root. The attacker uploaded / ...
show moreTwo SSH sessions from SSH-2.0-Go used credentials master/wasd and root/root. The attacker uploaded /home/honeypot/.16 twice, then tried to execute it directly and via sudo, made it executable with chmod +x, and repeatedly removed it with rm -rf. One cleanup chain also attempted to clear traces by truncating /var/log/wtmp, deleting .bash_history, and running history -c. Multiple sudo -S attempts were made with both passwords. Additional commands only show transport markers such as check_09df8e64bb61f76eb6334a7d627fc95b_transport_done and check_325804957b1371bc1e622fba3e9aa097_transport_done. No successful payload execution, downloads, port forwarding, or lateral movement were observed.
show less
Single SSH session from SSH-2.0-Go using credentials ftpuser/pC+6Ki@Tn8++7_L. Activity focused on ho ...
show moreSingle SSH session from SSH-2.0-Go using credentials ftpuser/pC+6Ki@Tn8++7_L. Activity focused on host discovery and persistence setup. Commands checked OS/kernel (uname -a), CPU count via /proc/cpuinfo, and top processes with ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10. The actor searched writable locations (/dev/shm, /tmp, /var/run, /mnt, /root, /) and switched to /tmp. They created /tmp/w.sh with a heredoc and chmod +x. Persistence was added by querying crontab and appending an @reboot entry pointing to /tmp/w.sh with arguments "astats" "netai" "kstats" and "ssh 2 az" if not already present. No downloads, lateral movement, or additional payload execution were observed in this session.
show less
Single SSH session used default-like credential ubuntu/ubuntu123 with SSH-2.0-Go. After login, attac ...
show moreSingle SSH session used default-like credential ubuntu/ubuntu123 with SSH-2.0-Go. After login, attacker checked system info (uname -a), CPU core count via /proc/cpuinfo, and probed writable locations by iterating through /dev/shm, /tmp, /var/run, /mnt, /root, and /. They switched to /dev/shm and created an executable file w.sh, then checked the crontab and attempted to add persistence with an @reboot entry pointing to /dev/shm/w.sh and arguments "astats" "netai" "kstats" "ssh 2 az". No downloads, lateral movement, or dropped artifact hashes were observed in this session.
show less
Single SSH session from SSH-2.0-Go using root/ubuntu. After login, attacker uploaded a file named ./ ...
show moreSingle SSH session from SSH-2.0-Go using root/ubuntu. After login, attacker uploaded a file named ./.3832919932643654817/sshd and executed it with chmod +x then nohup ./.3832919932643654817/sshd & to run it in the background. No other commands, downloads, persistence steps, port forwards, or lateral movement were observed. The activity shows malware placement and execution of a binary named sshd.
show less
SSH login with admin/123456 from an SSH-2.0-Go client. The actor ran host reconnaissance (CPU count, ...
show moreSSH login with admin/123456 from an SSH-2.0-Go client. The actor ran host reconnaissance (CPU count, process listing, searches for astats) and checked for existing activity. They created and executed /tmp/w.sh, dropped and ran astats and kstats from /tmp,/dev/shm,/var/run,/mnt,/root fallbacks, then invoked astats with arguments "ssh 2 az". They attempted persistence by adding an @reboot cron entry to run /tmp/w.sh with the same arguments and checked crontab for that entry. No downloads, lateral movement, or additional credentials were observed in this session.
show less
Brute-ForceSSH
By clicking โAccept allโ, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.