Loading story…
U.S. military investigators raided the home of a Kansas resident while probing a compromise of U.S. Air Force Office of Special Investigations servers tied to the Outlaw cryptomining botnet. The intrusion was discovered in November 2020 after a cryptominer consumed server resources and disrupted legitimate processing, and investigators traced repeated SSH brute-force activity to an IP address associated with a Google Fiber account and Raspberry Pi devices at the residence. Authorities seized multiple computers, an iPhone, and five Raspberry Pi systems, but no charges were filed and investigators had not determined whether the resident operated the botnet or was an infected intermediary.
Separate research indicates Outlaw remained active years later and evolved into a renewed campaign targeting European organizations, underscoring the botnet’s persistence beyond the earlier Defense Department incident. The case highlighted how resource-hijacking malware can affect sensitive government infrastructure, following another known cryptomining botnet incident involving Department of Defense systems and reinforcing the ongoing risk from SSH brute-force attacks and opportunistic Linux server compromise.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Law enforcement agents raided the Olathe, Kansas residence tied to the traced IP address and seized multiple computers, an iPhone, and five Raspberry Pi devices. The action was part of the investigation into the November 2020 compromise of OSI servers.
During routine maintenance, an engineer at the US Air Force Office of Special Investigations found a cryptominer running at full capacity on one of the agency's servers. The malware was identified as a version of the Outlaw botnet and was preventing the server from processing legitimate requests.
After identifying 38 SSH brute-force connection attempts against the compromised OSI server, Air Force investigators used a subpoena to trace the relevant IP address to a Raspberry Pi device on a Google Fiber account at a residence in Olathe, Kansas. Investigators had not determined whether the resident operated the botnet or was himself using an infected intermediary device.
A bug hunter reported through the Department of Defense bug bounty program that a cryptominer botnet had used a misconfigured Jenkins automation server to plant malicious scripts on Amazon web servers managed by the DOD. The article describes this as a prior known cryptomining botnet case affecting DOD infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The long-running **Outlaw** (also known as **Dota3**) Linux botnet is compromising internet-exposed systems through opportunistic SSH brute-force attacks, then spreading laterally across reachable subnets. Its payload installs a modified XMRig Monero miner, an IRC-based `STEALTH SHELLBOT` command-and-control component, and the `BLITZ` brute-forcer to locate and compromise additional Linux and potentially IoT devices. Outlaw maintains access through cron jobs and attacker-controlled SSH `authorized_keys`, hides files in locations such as `~/.configrc6`, obfuscates scripts, sets file immutability, and terminates competing mining malware. Honeypot observations also identified manual operator activity for reconnaissance and payload reinstallation; defenders should investigate anomalous SSH authentication attempts, unauthorized cron or SSH-key modifications, hidden or encoded scripts, `socat` usage, suspicious kernel tuning, mining processes, and lateral SSH brute-force traffic.
Sep 9, 2026
Researchers linked multiple Linux intrusions to a Romanian-speaking threat cluster that brute-forced weak SSH credentials, compromised servers and network devices at scale, and deployed a Perl-based **Shellbot** with IRC command-and-control. Trend Micro found infrastructure capable of generating target lists covering roughly **80 million IP addresses**, logs indicating more than **65,000 potentially compromised hosts**, and tooling including the **Haiduc** SSH brute-forcer, process-masquerading utility **Faker**, privilege-escalation exploits such as `CVE-2017-16995` and Dirty Cow variants, and high-availability C2 built with CARP. Bitdefender separately tied a likely Romanian group to Linux-focused scanning, SHC-obfuscated loaders, Discord webhook reporting, a customized Perl IRC bot, and a Golang SSH bruteforcer offered in a SaaS-like model, with monetization centered on **Monero** mining via customized **XMRig** payloads. Additional reporting showed the campaign’s tradecraft remained active across traditional servers and cloud-native environments. JPCERT/CC documented attackers using stolen SSH access to move laterally, install **XMRig**, hide mining with **XHide**, tamper with logs, and continue scanning for new SSH targets, while Sysdig observed Shellbot compromise a Tomcat container through brute-forced default credentials, download multi-architecture payloads, establish persistence, erase traces, and receive commands for file transfer, port scanning, data exfiltration, and **DDoS** attacks. Together, the reports describe a long-running Linux-focused operation that blends brute-force access, worm-like propagation, cryptojacking, and botnet functionality across exposed infrastructure.
Aug 15, 2026
Security researchers reported several distinct but related findings showing how attackers are abusing **Linux-based infrastructure** for botnets, cryptomining, and post-compromise operations. Eclypsium identified a new **CondiBot** variant labeled `QTXBOT` and a previously undocumented **Monaco** cryptominer targeting network devices and exposed SSH services, with Monaco using brute-force access and exfiltrating stolen credentials to a command-and-control server hosted on Alibaba Cloud Singapore. Separately, Hunt.io exposed an Iranian-operated relay and botnet environment through an open directory, revealing a **15-node** tunnel network, SSH-based mass deployment tooling, on-host compilation of DDoS malware, and active command-and-control infrastructure. Flare also documented how threat actors repeatedly use the legitimate open-source script **Bench.sh** after initial access to profile compromised systems, including JupyterLab, Jupyter Notebook, SSH, Apache Tomcat, and PHP-based environments, in order to assess CPU, memory, disk, and bandwidth for follow-on abuse such as cryptomining, proxying, or DDoS. The reporting does **not** describe a single shared intrusion campaign: the CondiBot/Monaco discovery, the Iranian botnet infrastructure exposure, and Bench.sh abuse are separate research items connected by the broader theme of attackers operationalizing compromised Linux and network infrastructure. A separate report on **FancyBear/APT28** email theft and a general weekly security recap are different topics and should be excluded.
Jun 29, 2026