Default SSH Credentials Used to Deploy Suspected Gafgyt Botnet Payloads

An attacker accessed a SANS Internet Storm Center honeypot over SSH using the default username and password root/root, then deployed scripts designed to install botnet malware. The scripts retrieved architecture-specific payloads from 185.254.37.243 using multiple download methods. Analysis of the skid.x86 executable found Huawei home-router exploit strings resembling a proof of concept for CVE-2017-17215, while antivirus detections linked the payload to Gafgyt/BASHLITE and Mirai. Researchers assessed the activity as an attempt to recruit devices for DDoS attacks, not a confirmed ransomware infection despite initial Medusa-related script detections.

The attack underscores the risk of internet-exposed SSH services protected by default credentials. MITRE ATT&CK documents adversarial SSH use under T1021.004, including remote access, tool transfer, tunneling, and lateral movement; that broader mapping does not establish additional activity in this incident. Defenders should update routers and IoT devices, replace default passwords, restrict public management access, and harden SSH wherever it remains necessary. Applicable CIS Benchmarks can provide configuration baselines for those hardening efforts.