Loading story…
A recent analysis of files uploaded to a Cowrie honeypot identified active exploitation attempts targeting Raspberry Pi devices using default and uncommon credentials. The attacks involved the UNIX_PIMINE.A botnet worm, which propagates via SSH, installs persistence, removes competing malware, and connects to IRC-based C2 channels. The findings highlight the ongoing risk to IoT devices with unchanged default passwords and the value of automated event correlation in honeypot environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
OSINT Team Blog published an article titled "How to use FindAnyFil3 & why," indicating public release of guidance or commentary about the FindAnyFil3 tool and its use cases. No earlier event date is provided in the reference.
The SANS Internet Storm Center published a guest diary titled "Exploring Uploads in a Dshield Honeypot Environment," describing analysis of files uploaded in a DShield honeypot setting. The reference indicates public technical discussion of honeypot upload activity by this date.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Internet Storm Center (ISC) researchers reported a **self-propagating SSH worm** observed by a DShield honeypot sensor that can compromise exposed Linux systems in roughly **four seconds** by using **credential stuffing/brute force** against weak SSH passwords, with a notable focus on *Raspberry Pi* devices left on default or common credentials (e.g., user `pi` with passwords such as `raspberry` and `raspberryraspberry993311`). The observed attack chain rapidly authenticates, uploads a compact **4.7 KB bash script** (via SCP), executes it, and establishes persistence while removing competing malware, enabling worm-like exponential spread across vulnerable internet-connected hosts. Technical analysis indicates the activity likely originated from an already-compromised *Raspberry Pi* in Germany (IP `83.135.10.12`, Versatel Deutschland), using an SSH client string consistent with Raspbian (`SSH-2.0-OpenSSH_8.4p1 Raspbian-5+b1`) and a recorded HASSH fingerprint `ae8bd7dd09970555aa4c6ed22adbbf56`. Post-compromise, the malware connects to **IRC-based command-and-control** and includes **cryptographically signed command verification**; it also automates scanning and lateral movement using tools such as **Zmap** and **sshpass**, reinforcing how default/weak SSH authentication on IoT and small-form-factor Linux systems remains a high-impact botnet entry point.
Jun 29, 2026
A DShield Cowrie SSH honeypot captured an intrusion in which a bot logged in as `root` with the weak password `123123`, gathered detailed host information, and disconnected without dropping a payload. The activity came from IP address `91.92.40.13` and included checks of the operating system, kernel, CPU architecture, core count, CPU model, uptime, recent logins, available memory, and whether an NVIDIA GPU was present. The bot also attempted to validate elevated access by reusing the password with `sudo -S`, indicating the operator wanted to confirm full control of the system before moving further. Researchers assessed the session as reconnaissance and host grading for a likely cryptomining campaign, with miner deployment apparently contingent on the victim having sufficient resources such as more than 1 GB of RAM or GPU capability. The bot identified itself with the SSH client string `SSH-2.0-Go` and the HASSH fingerprint `2ec37a7cc8daf20b10e1ad6221061ca5`, separating it from other SSH malware-loading activity previously observed on the same honeypot. The incident highlights that SSH sessions that only enumerate hardware and privileges can still be significant early-warning indicators of a tailored second-stage attack.
Jul 31, 2026
ESET reported that **Linux/Rakos** is compromising internet-exposed embedded devices and Linux servers by brute-forcing weak or default **SSH** credentials, then enrolling the systems into a botnet. The malware, written in **Go** and often packed with **UPX**, hides under names such as `.javaxxx`, `.swap`, and `kworker`, starts local and external HTTP services, sends host details and stolen credentials to command-and-control servers, retrieves target IP lists, and propagates by uploading itself to newly accessed hosts. Researchers said the operators can remotely update configuration files and upgrade the malware, while analyzed samples showed no built-in DDoS or spam module. The activity mirrors earlier Linux botnet campaigns such as **Linux/Moose**, which also spread by abusing weak default credentials on embedded Linux devices rather than exploiting software flaws. Moose primarily brute-forced **Telnet** on consumer routers and other MIPS and ARM systems, then used infected devices as whitelisted SOCKS/HTTP proxies, sniffed unencrypted traffic for social-network cookies, and supported large-scale social-media fraud from residential IP space. Both malware families lack reliable persistence after reboot, but exposed devices can be quickly reinfected if default passwords remain unchanged, including after factory resets.
Aug 14, 2026