Credential brute-force via SSH-2.0-Go: master/wasd and root/root attempted. Reconnaissance: uname cm ...
show moreCredential brute-force via SSH-2.0-Go: master/wasd and root/root attempted. Reconnaissance: uname cmd exec. Malware dl from hxxp://5[.]189[.]149[.]171/f/brute/m/.16_$(uname -m) via curl/wget to /dev/shm as .16. Persistence: chmod +x, exec .16 binary. Log sanitization: rm -rf /home/<user>/.16, wtmp cleared, bash history deleted (rm -rf .bash_history, history -c). Privilege escalation: echo 'root'|sudo -S and echo 'wasd'|sudo -S with hardcoded creds. Multiple fallback exec methods indicate targeting diverse Linux envs. C2 distributes arch-specific payloads (.16_x86_64, .16_i686). Pattern consistent with automated botnet campaigns exploiting weak/default creds. Attacks failed at credential validation on honeypot; no successful cmd exec observed.
show less
Credential brute-force attack on root account using 7 passwords (root1111, root123, root1234, root20 ...
show moreCredential brute-force attack on root account using 7 passwords (root1111, root123, root1234, root2024, root2222, root321, root4444) across 7 SSH sessions via Go-based client. Attack focused on system profiling/recon. Each session attempted privilege escalation via sudo to enumerate CPU cores via nproc/proc/cpuinfo parsing, grep processor counts, busybox nproc - multiple fallback methods suggesting utility restriction bypass attempts. Partial uname execution observed gathering kernel version, hostname, architecture. No persistence, lateral movement, or malware dl detected. Pattern consistent w/ automated recon scanner probing system specs to determine target suitability for botnet recruitment or crypto mining deployment. SSH-2.0-Go indicates non-standard SSH implementation, possibly Go-based scanning toolkit or botnet infrastructure. All cmd exec failed on honeypot (no valid creds accepted), but activity demonstrates active targeting and system enum methodology.
show less
Automated reconnaissance scan via Go-based SSH client. Single session using weak credential root/asd ...
show moreAutomated reconnaissance scan via Go-based SSH client. Single session using weak credential root/asdfghj12345. Attack pattern consistent with scanning infrastructure for system enumeration: OS version, CPU info, network configuration, user accounts, environment variables, process listings, disk usage, network connections, and service status. Commands targeted /etc/passwd, /proc/cpuinfo, /proc/version, network interface enumeration via ip addr, netstat output, listening ports via ss, systemd services, cron jobs, and sudo privileges. Attacker created test file in /tmp to verify write access. No malware downloads, persistence mechanisms, or lateral movement observed. No process injection or privilege escalation attempts. Behavior indicates automated vulnerability scanner or botnet reconnaissance phase probing for target suitability before potential secondary payload delivery. Go SSH client suggests custom reconnaissance tool or modified SSH implementation.
show less
Credential brute force via SSH using Go-based protocol. 7 sessions in 13-min window targeting root a ...
show moreCredential brute force via SSH using Go-based protocol. 7 sessions in 13-min window targeting root acct with passwords: password1, qwerty, r00t, root, root!@#, root#123, root0000. Sudo privilege escalation attempts paired with recon. Payloads enumerated CPU via nproc, binary exec, busybox, /proc/cpuinfo parsing. Attacker piped passwords to sudo suggesting cred validation. Secondary recon extracted kernel version, hostname, architecture via uname. Full PATH preset indicates sophisticated multi-platform framework. Pattern consistent with automated botnet recon activity. Systematic weak credential targeting + structured env setup suggests precursor activity for potential cryptominer/trojan/worm deployment. No persistence, malware dl, or lateral movement observed. Activity terminated after failed privilege escalation, indicating attacker moved to alt targets upon validation that sudo pwd auth unavailable or creds invalid across systems.
show less
conducted reconnaissance across two sessions using Go-based SSH client. Credentials attempted: root/ ...
show moreconducted reconnaissance across two sessions using Go-based SSH client. Credentials attempted: root/ASDFGHJ1234, root/Asdfghj1234. Activity focused on system enumeration: extracted passwd file, attempted shadow file access, queried CPU info, kernel version, and environment variables. Created test files in /tmp (test_1789498785, test_1789499343) to verify write access. Executed hostname, id, whoami, and command history queries. Additional commands included ps aux, netstat/ss queries, ifconfig enumeration, df disk space checks, uname system details, and bash history inspection. No malware downloads, persistence mechanisms, or lateral movement observed. No privilege escalation attempts detected. Behavior consistent with automated scanning/reconnaissance toolkit targeting system information gathering on exposed SSH services. Low sophistication; appears to be credential-stuffing attempt with standard post-auth recon payload.
show less
Probed system with 7 cred variants via Go-based SSH client over 13 min. Creds attempted: root/1q2w3e ...
show moreProbed system with 7 cred variants via Go-based SSH client over 13 min. Creds attempted: root/1q2w3e, root/1q2w3e4r, root/1qaz2wsx, root/321, root/654321, root/P@ssw0rd, root/P@ssword. All follow keyboard-walk or simple numeric patterns. After each login attempt, executed recon cmds: CPU enumeration (nproc, /proc/cpuinfo, busybox) piped via sudo -S for passwordless sudo/cached cred probing. Second phase: uname enumeration for kernel, hostname, architecture. PATH explicitly set for cross-config compatibility. No lateral movement, persistence, dl, or malware observed. Activity limited to CPU/OS fingerprinting typical of botnet recruitment or vuln assessment targeting multi-arch infrastructure. Systematic cred rotation + hardware enumeration indicates automated scanning for vulnerable systems matching specific criteria.
show less
Reconnaissance across 2 sessions using Go-based SSH client. Attempted auth with root/ASDFGHJ123#@! a ...
show moreReconnaissance across 2 sessions using Go-based SSH client. Attempted auth with root/ASDFGHJ123#@! and root/asdfghj1234. Executed 35 cmds for system enumeration: passwd/shadow headers, CPU model, kernel version, env vars, cmd history, hostname, user context. Created test files in /tmp (test_1789497691, test_1789498233) with sequential timestamps indicating automated probing. No malware dl, persistence mechanisms, or lateral movement observed. Pattern consistent with automated reconnaissance scanning, likely distributed credential brute-force campaign. Go SSH client suggests non-standard tooling—custom scanner or botnet component. ~10min dwell time across both sessions indicates opportunistic assessment. No privilege escalation or post-compromise activity. Moderate threat: reconnaissance with weak creds targeting root account.
show less
SSH reconnaissance via Go-based client. Creds attempted: root/ASDFGHJ123!@# and root/asdfghj123#@!. ...
show moreSSH reconnaissance via Go-based client. Creds attempted: root/ASDFGHJ123!@# and root/asdfghj123#@!. Commands: /etc/passwd, /etc/shadow head, /proc/cpuinfo, /proc/version, env vars, command history, hostname, id. Created test files in /tmp (test_1789496075, test_1789496611) to verify write perms. 35 unique commands across 70 invocations. Duration: 9m 55s. No malware, persistence, lateral movement, dl, or shell escapes. OS fingerprinting and resource baseline gathering. Pattern consistent with automated reconnaissance scanner or credential-stuffing bot targeting root access.
show less
Cred enum attack on root acct with weak passwords (111111, 123, 123123, 123321, 1234, 12345). Go-bas ...
show moreCred enum attack on root acct with weak passwords (111111, 123, 123123, 123321, 1234, 12345). Go-based SSH client executed 28 cmds across 6 sessions attempting priv escalation via sudo with piped passwords. Attack chain: brute force root/password access, system recon. Primary objective: CPU core enum—executed nproc via fallback methods (direct binary, /usr/bin/nproc, busybox nproc, /proc/cpuinfo grep), all piped to sudo -S stdin. Secondary phase queried uname (kernel version, hostname, arch) using similar fallback patterns. Final cmd set PATH variable for payload exec. No persistence, lateral movement, or malware dl observed. No successful cmd exec confirmed—all targeted info gathering on target specs. Pattern consistent with pre-infection recon for botnet deployment or cryptomining infra assessment. Go SSH client indicates custom scanner or Go-based botnet framework. Low password complexity suggests opportunistic scanning. All 6 sessions maintained consistent cmd sequence indicating scripted methodology.
show less
Automated credential brute-force attack using Go SSH client. 15 total sessions conducted over 2 minu ...
show moreAutomated credential brute-force attack using Go SSH client. 15 total sessions conducted over 2 minutes. Attacker attempted 10 distinct passwords against root account: 12, 123, 123321, 1234, 12345, 123456, 12345678, 87654321, 987654321, and 1. Credentials follow common sequential numbering patterns typical of dictionary-based attacks. Single command executed across 11 successful sessions: id -u && echo '---SEP---' && cat /etc/hostname. This reconnaissance command queries user ID and retrieves system hostname for target identification and environment mapping. No payload delivery, persistence mechanisms, lateral movement attempts, or malware deployment observed. Attack pattern consistent with mass-scanning reconnaissance operations targeting SSH services. No data exfiltration or system modification detected in honeypot capture. Attack originates from single source with minimal operational complexity, suggesting automated scanning infrastructure rather than targeted intrusion.
show less
Single session via Go SSH client attempting credential root/ASDFGHJ123. Attacker executed 33 reconna ...
show moreSingle session via Go SSH client attempting credential root/ASDFGHJ123. Attacker executed 33 reconnaissance commands spanning system enumeration: OS version (/proc/version), CPU details (/proc/cpuinfo), user account enumeration (cat /etc/passwd, /etc/shadow), network interface discovery (ip addr show), process listing (ps aux, top), disk usage (df -h, du -sh), file system inspection (ls -la /home, /root, /tmp), shell environment inspection (env, history), and system identification (hostname, uname -a, whoami). Test file created in /tmp (test_1789494450). No persistence mechanisms, lateral movement attempts, downloads, or secondary payloads observed. Attack pattern consistent with initial access reconnaissance to profile target system capabilities, resource allocation, and existing user artifacts before potential follow-up exploitation. Credentials root/ASDFGHJ123 were accepted by honeypot.
show less
Brute-force SSH login mailadmin/mailadmin on port 22 via Go-based client. Attack chain: tested sudo ...
show moreBrute-force SSH login mailadmin/mailadmin on port 22 via Go-based client. Attack chain: tested sudo privileges, deleted artifacts (astats, s.lock, kstats) from /dev/shm, /tmp, /var/run, /mnt, /root, /. Terminated processes matching astats/kstats patterns while filtering SSH, shells, and process mgmt tools. Indicators suggest botnet operator removing competing malware/miners to monopolize resources or sanitize prior compromise evidence. Methodical artifact deletion and process termination indicate reconnaissance of already-compromised host or payload deployment prep. No new downloads or persistence mechanisms installed, but cleanup ops confirm prior malicious activity on affected systems.
show less
Brute-force SSH attack using Go/paramiko clients with creds admin/letmein, ec2-user/123456. Download ...
show moreBrute-force SSH attack using Go/paramiko clients with creds admin/letmein, ec2-user/123456. Download-execute payload chain: curl/wget dl malware .16 from hxxp://5[.]189[.]149[.]171/f/brute/m/ to /dev/shm with retry logic. Arch-specific variants staged. Privilege escalation via sudo with plaintext pwd pipes. Exec via chmod +x, shell metacharacters, output redirection. Anti-forensics: deleted /var/log/wtmp, .bash_history, shell history, PATH manipulation. Hidden persistence via .16 file in home dir. Multi-stage automated toolkit with credential stuffing, weak pwd targeting, post-compromise cleanup. Sophisticated campaign with platform-specific binaries across diverse architectures. Infrastructure hosting malware delivery.
show less
Brute-force SSH (root/1234567890) via Go SSH client. Two sessions in 2min. Reconnaissance: CPU enume ...
show moreBrute-force SSH (root/1234567890) via Go SSH client. Two sessions in 2min. Reconnaissance: CPU enumeration (nproc, /proc/cpuinfo, busybox), OS fingerprinting (uname variants for kernel/hostname/arch). Sudo bypass attempts via echo piping pwd. PATH manipulation suggests prep for cmd injection/malware exec. No persistence/lateral movement/dl observed. Pattern consistent w/ automated botnet scanning (Mirai-like). Attacker probed sudo privs, tested cmd exec. Depth of recon & bypass techniques indicate active exploitation vs random scan. Targets poorly secured systems via mass campaigns. Go SSH client suggests IoT botnet component. Creds simple, immediate recon execution typical of mass targeting infrastructure.
show less
Authenticated ftpuser/ftpuser via SSH using Go client. Attempted privilege escalation (sudo -n true) ...
show moreAuthenticated ftpuser/ftpuser via SSH using Go client. Attempted privilege escalation (sudo -n true) then systematically searched /dev/shm, /tmp, /var/run, /mnt, /root for astats, s.lock, kstats artifacts (cryptominer/botnet indicators). Forcibly killed matching processes while filtering legitimate procs (ssh, sshd, bash, sh, pkill, pgrep) to avoid detection. Cleanup pattern suggests attacker eliminating competing malware before deploying payload. No secondary payloads, dl, or persistence observed in 8-sec session. Weak creds typical of automated scanning. Go SSH client indicates scripted reconnaissance/botnet activity, not manual ops. Attack sequence—rapid auth, priv check, targeted termination—consistent with malware campaigns prioritizing host lockdown against rival threats before staging further compromise.
show less
Automated reconnaissance via Go-based SSH client. Two sessions over 9 minutes using weak creds (ASDF ...
show moreAutomated reconnaissance via Go-based SSH client. Two sessions over 9 minutes using weak creds (ASDFGHJ1 variants) against root. Executed 35 cmds across 33 payloads for system enumeration: uname -a, /proc/version, /proc/cpuinfo, ip addr show, ifconfig, netstat, /etc/passwd, ps aux, top, /proc/meminfo, df -h, docker ps, arp -a. Tested /tmp write perms, queried bash history and env vars. Probed privilege escalation vectors: sudo -l, SUID binaries. No persistence, downloads, or lateral movement observed. Pattern consistent with automated scanning for vulnerable systems and initial access recon. Go SSH implementation suggests programmatic attack framework or botnet component. Systematic host profiling rather than opportunistic intrusion.
show less
Conducted 4 SSH sessions using Go SSH client attempting credential stuffing with weak passwords agai ...
show moreConducted 4 SSH sessions using Go SSH client attempting credential stuffing with weak passwords against root account: !root, 111111, 123123, 123321. Attacker executed CPU enumeration probes using multiple fallback methods (nproc, /proc/cpuinfo, busybox) suggesting reconnaissance for botnet victim profiling. Each nproc command piped password via echo with sudo -S, indicating attempted privilege escalation. Secondary commands collected system information via uname utility with multiple path resolution attempts (typical of cross-platform malware deployment). Attack pattern consistent with automated botnet scanner or worm propagation targeting Linux systems. No persistence mechanisms, downloads, or lateral movement detected within session window. Weak password selection suggests generic credential attack rather than targeted compromise. Commands indicate victim resource assessment phase preceding potential payload delivery.
show less
Brute force SSH attack using Go-based client with weak creds (admin/letmein, master/wasd). Multi-sta ...
show moreBrute force SSH attack using Go-based client with weak creds (admin/letmein, master/wasd). Multi-stage malware deployment to /dev/shm. Cmds attempted exec hidden binary .16 via sudo with password piping. Subsequent cmds dl .16 payload from hxxp://5[.]189[.]149[.]171/f/brute/m/ with arch-specific variant via uname -m, using curl (3 retries, 3s delay) and wget fallback. Payload made executable and executed with both creds. Cover tracks: rm -rf /home/<user>/.16, truncated /var/log/wtmp, cleared .bash_history, history -c. System fingerprinting cmds (uname -s -v -n -m) across multiple paths. Infrastructure 5[.]189[.]149[.]171 hosts malware. Attack pattern indicates automated botnet recruitment via credential stuffing on SSH, likely Mirai variant given arch detection and persistence erasure tactics.
show less
Credential stuffing attack against 3 accounts using libssh 0.9.6. Successfully obtained shell access ...
show moreCredential stuffing attack against 3 accounts using libssh 0.9.6. Successfully obtained shell access with creds 345gs5662d34/345gs5662d34 and root/12345678900987654321. Attacker removed .ssh dir and injected RSA public key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx...) for persistence. Secondary cmd attempted chattr -ia and lockr -ia to harden key against removal. Attack pattern consistent with botnet reconnaissance. libssh 0.9.6 is outdated and known in credential harvesting tools. Multiple sequential attempts suggest dictionary attack using password list. Focus on credential compromise and SSH key installation for long-term access maintenance. No malware downloads observed.
show less
Attacked system using libssh 0.11.1 SSH client. Attempted three credential pairs: 345gs5662d34/345gs ...
show moreAttacked system using libssh 0.11.1 SSH client. Attempted three credential pairs: 345gs5662d34/345gs5662d34, root/123.qwe, root/3245gs5662d34. Executed SSH key persistence mechanism by removing existing .ssh directory, creating new one, and installing RSA public key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx). Second session attempted to protect persistence by removing immutable file attributes from .ssh directory using chattr command and then executing lockr utility to re-apply immutable attributes. Attack pattern indicates automated SSH key installation for long-term access with anti-forensic attribute manipulation. Three sessions completed within 8-second window suggesting credential enumeration and subsequent persistence establishment. No malware downloads observed. No lateral movement commands detected.
show less
established 3 SSH sessions using libssh 0.9.6 client, attempting credential pairs: 345gs5662d34/345g ...
show moreestablished 3 SSH sessions using libssh 0.9.6 client, attempting credential pairs: 345gs5662d34/345gs5662d34, chaos/3245gs5662d34, chaos/chaos. After gaining access, attacker executed SSH key persistence mechanism: removed existing .ssh directory, recreated it, and injected RSA public key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx) for future unauthorized access without password authentication. Attacker then attempted to remove immutable file attributes from .ssh directory using chattr -ia command followed by lockr -ia command, indicating effort to prevent removal or modification of implanted SSH keys by legitimate administrators or security tools. Credentials suggest either brute-force attack or credentials from prior breach. Behavior consistent with establishing persistent SSH backdoor access. libssh 0.9.6 client indicates possible automated attack tool or botnet activity rather than manual intrusion.
show less
Brute-ForceSSH
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.