Loading story…
The long-running Outlaw (also known as Dota3) Linux botnet is compromising internet-exposed systems through opportunistic SSH brute-force attacks, then spreading laterally across reachable subnets. Its payload installs a modified XMRig Monero miner, an IRC-based STEALTH SHELLBOT command-and-control component, and the BLITZ brute-forcer to locate and compromise additional Linux and potentially IoT devices.
Outlaw maintains access through cron jobs and attacker-controlled SSH authorized_keys, hides files in locations such as ~/.configrc6, obfuscates scripts, sets file immutability, and terminates competing mining malware. Honeypot observations also identified manual operator activity for reconnaissance and payload reinstallation; defenders should investigate anomalous SSH authentication attempts, unauthorized cron or SSH-key modifications, hidden or encoded scripts, socat usage, suspicious kernel tuning, mining processes, and lateral SSH brute-force traffic.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
After BLITZ brute-forced a honeypot and changed its password, an operator logged in from 212.234.225[.]29, ran w and ps reconnaissance commands, and downloaded and executed a fresh dota3.tar.gz payload using wget. The activity indicated that the otherwise automated campaign could be manually maintained after compromise.
The tddwrt7s.sh dropper downloads dota3.tar.gz, whose components establish hidden installation paths, cron-based persistence, attacker-controlled SSH keys, and a modified XMRig miner. The package also deploys STEALTH SHELLBOT for IRC command-and-control and uses socat forwarding infrastructure.
The BLITZ (also known as kthreadadd) component performs high-volume SSH scanning and password guessing, allowing newly compromised hosts to attack further SSH-accessible systems, including local-subnet targets. BLITZ can copy dota3.tar.gz directly from an infecting host to compromised systems.
OUTLAW was observed as a persistent Linux coinmining package in multiple versions over several years. It uses opportunistic SSH brute-force attempts against weak or default credentials for access.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos reported a previously unreported Linux botnet dubbed **Xanthe** that targets internet-exposed systems for **Monero** mining, including hosts reachable through SSH and exposed Docker APIs on TCP port `2375`. The malware is modular and deploys **XMRig**, spreading primarily by harvesting client-side SSH keys and known-host data, while also abusing misconfigured Docker environments to gain execution on containerized infrastructure. Once installed, Xanthe uses multiple defense-evasion and persistence techniques to retain control and maximize mining time. Talos said the malware deploys a `libprocesshider` shared object to conceal miner activity, disables security tools, removes competing miners, weakens SSH settings, creates privileged users, installs attacker SSH keys, modifies firewall rules, and persists through cron jobs and `rc.local` changes—behavior consistent with the **Impair Defenses** technique tracked in MITRE ATT&CK as `T1562.001`.
Aug 14, 2026
**XOR.DDoS** has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch **SYN flood, ACK flood, and DNS amplification** attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, **Groundhog**, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign. The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a **loadable kernel module rootkit** to hide processes and TCP ports, and survive reboots through files and scripts placed in `/boot`, `/etc/init.d`, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the **Tsunami** backdoor and **XMRig** miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Aug 15, 2026
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026