> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # 22 Seconds to Compromise: How Automated SSH Actors Move From Login to Persistence Before You Can Blink - URL: https://f4n6.co.uk/security-feed/22-seconds-to-compromise-how-automated-ssh-actors-move-from-login-to-persistence-before-you-can-blink/ - Published: 2026-08-06T12:24:03.000Z - Updated: 2026-08-06T12:24:03.000Z - Author: Jeff Davies - Tags: #security-feed, mdrfckr ## 1\. Executive summary A sustained, automated SSH credential-stuffing campaign — correlated with the "mdrfckr" SSH campaign — continues to target internet-exposed Linux systems globally. Honeypot telemetry documents a fully automated post-exploitation playbook that achieves persistent backdoor access in approximately 22 seconds from successful authentication: injecting an SSH key, changing the root password, clearing `/etc/hosts.deny`, and running reconnaissance. The actor "mdrfckr" has no MITRE ATT&CK profile in the verified reference data; attribution to this campaign is unconfirmed and rests on single-sourced honeypot correlation. EMEA financial services with internet-facing SSH on port 22 using password authentication are immediately exposed; the attack requires no zero-day or sophisticated exploit, only weak credentials. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The underlying threat — opportunistic SSH brute-force against weak credentials — is a general security hygiene issue that does not trigger a distinctive obligation under the articles in scope (DORA Arts. 17–30, NIS2 Arts. 21/23, UK NIS 2018) beyond what any routine hardening mandate already covers. ## 3\. Technical analysis & attack chain The following attack chain is reconstructed from a single honeypot operator's Cowrie v2.3.0 logs (Raspberry Pi 5, port 2222 forwarded from external port 22). All technical claims below are single-sourced from this one sensor; verify before enforcement. 1. **Initial access (T1078 — Valid Accounts):** At 01:06:43 UTC on May 23, 2026, source IP 163.7.8.79 (Byteplus, AS150436) initiated an SSH connection. One second later, authentication succeeded using credentials `root` / `Aa123123123` — a weak password consistent with breach-leaked credential lists. 2. **Defense impairment (T1562 — Impair Defenses):** The actor removed the existing `.ssh` directory and recreated it, eliminating any pre-existing authorised keys to ensure exclusive backdoor access. The actor cleared `/etc/hosts.deny` to remove host-based access restrictions that could block future connections. 3. **Persistence (T1098 — Account Manipulation):** A backdoor SSH key was injected into `authorized_keys`. The SSH key was captured by Cowrie with hash `a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2`. The root password was changed immediately after key injection, locking out legitimate administrators. 4. **Discovery (T1059 — Command Execution):** Automated system reconnaissance commands were executed as part of the pre-scripted playbook. The entire sequence from login to persistence completed in 22 seconds. The command order, timing, and SSH key material were identical across multiple return sessions from the same IP throughout the day, confirming automation rather than human operator activity. **Campaign scope:** Over a 30-day monitoring period, the sensor captured 112,000+ SSH sessions and 72,000+ authentication attempts from 175+ unique malicious source IPs. On May 23 alone, 21 successful logins from 21 different source IPs were recorded, clustered between 01:00 and 02:30 UTC — indicating coordinated wave-based scanning. Credential wordlists included gaming server defaults (e.g., `minecraft` / `12345`), indicating active targeting of Minecraft and similar game server installations alongside generic Linux systems. **Coordinated infrastructure:** Three IPs from the same /24 subnet — 80.94.92.184, 80.94.92.186, 80.94.92.171 — exhibited high-volume simultaneous connections, consistent with distributed scanning infrastructure or a botnet. **Attribution caveat:** The source cross-referenced observed IPs against a compiled list associated with the "mdrffckr" SSH campaign and reports 93 overlapping IPs still active weeks after initial documentation. However, "mdrfckr" has no MITRE ATT&CK profile in the verified reference data. This attribution is unconfirmed and single-sourced; treat the campaign name as a tracking label, not a confirmed threat actor identity. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **Disable SSH password authentication.** Set `PasswordAuthentication no` in `/etc/ssh/sshd_config` and require public key authentication only (`PubkeyAuthentication yes`). Restart `sshd`. This single change renders the entire credential-stuffing attack class ineffective regardless of wordlist quality. - **Restrict SSH access** to trusted IP ranges or VPN-only connections using firewall rules (e.g., `iptables -A INPUT -p tcp --dport 22 -s -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP`) or security group rules. Remove internet exposure for SSH where possible. - **Audit all internet-exposed Linux systems** for weak root credentials. Specifically check for `Aa123123123` and similar pattern-based passwords. Force-reset any matching accounts. ### P2 — Within 72 hours - **Deploy rate-limiting and automated blocking:** Install and configure `fail2ban` with aggressive SSH jail settings to block IPs after repeated authentication failures. Recommended: `maxretry = 3`, `bantime = 3600` (or longer). - **Review `authorized_keys` on all critical servers** for unauthorised SSH key entries. Remove any keys that cannot be attributed to a known administrator. Check for signs of `.ssh` directory recreation. - **Verify `/etc/hosts.deny`** has not been tampered with on exposed systems. - **Block known campaign infrastructure** at perimeter firewall: 163.7.8.79, 80.94.92.184, 80.94.92.186, 80.94.92.171, and the 93 IPs correlated with the mdrfckr campaign list (single-sourced — validate against your own telemetry before bulk-blocking). ### P3 — Within 7 days - **Implement continuous SSH authentication log monitoring** with alerting on the behavioural pattern: rapid command execution within seconds of successful login. Alert on any `passwd` command execution or `authorized_keys` modification within 60 seconds of an SSH session start. - **Enforce password policies** that eliminate predictable patterns (common word + repeating numbers + capital letter). Implement minimum length (16+ characters) and ban common breach passwords. - **Hunt for prior compromise:** Search historical auth logs for successful root authentications from the IPs and credential patterns documented above. Check for unauthorised SSH keys persisted in all users' `~/.ssh/authorized_keys`. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | ---------- | ---------------------------------------------------------------- | ---------- | -------------- | | ipv4 | 163.7.8.79 | High | ISC SANS Diary | | ipv4 | 80.94.92.184 | Medium | ISC SANS Diary | | ipv4 | 80.94.92.186 | Medium | ISC SANS Diary | | ipv4 | 80.94.92.171 | Medium | ISC SANS Diary | | sha256 | a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 | High | ISC SANS Diary | | credential | root / Aa123123123 | High | ISC SANS Diary | | credential | minecraft / 12345 | Medium | ISC SANS Diary | | asn | AS150436 (Byteplus) | High | ISC SANS Diary | ```iocs ipv4 163.7.8.79 ipv4 80.94.92.184 ipv4 80.94.92.186 ipv4 80.94.92.171 sha256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 credential root / Aa123123123 credential minecraft / 12345 asn AS150436 ``` ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------- | ------------------------------------------------ | ---------- | | Successful SSH auth followed by rm -rf \~/.ssh and mkdir \~/.ssh within seconds | SSH session logs, auditd, EDR process telemetry | High | | passwd command execution within 30 seconds of SSH login | auth.log, auditd, EDR | High | | Modification of \~/.ssh/authorized\_keys within 60 seconds of session start | file integrity monitoring, auditd watch on .ssh/ | High | | Clearing of /etc/hosts.deny post-authentication | file integrity monitoring, auditd | High | | 20+ successful SSH logins from 20+ unique IPs within a 90-minute window | SIEM, auth log aggregation | Medium | | Identical command sequence and timing across multiple sessions from same IP | SSH session logging, Cowrie-style telemetry | High | ## 6\. Detection ```yara rule Automated_SSH_Backdoor_Key_Inject { meta: author = "Adverse Trace" date = "2026-08-06" reference = "https://isc.sans.edu/diary/rss/33220" description = "Detects SSH backdoor key material observed in automated post-exploitation playbook" strings: $key_hash = "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2" condition: $key_hash } ``` ```yaml title: SSH Login Followed By Rapid Password Change And Authorized_keys Modification id: 7a3c1f2e-8b4d-4e6a-9c5f-1d2e3f4a5b6c status: experimental description: Detects automated SSH post-exploitation pattern where passwd and authorized_keys modification occur within 60 seconds of successful SSH authentication author: Adverse Trace date: 2026/08/06 references: - https://isc.sans.edu/diary/rss/33220 logsource: product: linux category: authentication detection: selection_ssh_login: type: sshd event: Accepted selection_passwd: type: exec comm: passwd selection_authorized_keys: type: file_write path|contains: "authorized_keys" selection_hosts_deny: type: file_write path|contains: "/etc/hosts.deny" timeframe: 60s condition: selection_ssh_login and (selection_passwd or selection_authorized_keys or selection_hosts_deny) falsepositives: - Legitimate administrator changing password immediately after first login - Automated configuration management tools modifying authorized_keys level: high ``` ```yaml title: Coordinated SSH Brute-Force From Multiple IPs In Short Window id: 8b4d2c3f-9e5a-4f7b-8d6c-2e3f4a5b6c7d status: experimental description: Detects 20+ successful SSH authentications from 20+ unique source IPs within 90 minutes, consistent with coordinated wave-based scanning author: Adverse Trace date: 2026/08/06 references: - https://isc.sans.edu/diary/rss/33220 logsource: product: linux category: authentication detection: selection: type: sshd event: Accepted timeframe: 90m condition: selection | count(source_ip) > 20 falsepositives: - Load-balanced authentication from a legitimate fleet - Jump host with many users connecting simultaneously level: medium ``` ## 7\. Sources - ISC SANS / Daryl Jiminez (SANS.edu BACS intern) — "22 Seconds to Compromise: How Automated SSH Actors Move From Login to Persistence Before You Can Blink" — https://isc.sans.edu/diary/rss/33220 — 2026-08-06 ## 8\. Adverse Trace position This is a low-sophistication, high-volume opportunistic threat — no CVE, no zero-day, no novel malware. The risk to EMEA financial services is entirely contingent on whether internet-exposed SSH with password authentication remains in production. Firms that have already disabled `PasswordAuthentication` and restricted SSH to VPN/trusted-IP ranges are effectively invisible to this campaign. Firms that have not are being scanned now. The 22-second automation window means human response after authentication is too slow; prevention must be configured before the attack arrives. The "mdrfckr" campaign attribution is unconfirmed (no MITRE profile, single-sourced honeypot correlation) — we will monitor for corroborating reporting from additional honeypot operators and threat-intelligence vendors before treating the campaign label as confirmed. We assess the documented IOCs as reliable for immediate blocking but recommend validating the broader 93-IP mdrfckr list against internal telemetry before bulk enforcement. --- [Read the original source →](https://isc.sans.edu/diary/rss/33220?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*