Cybersecurity researchers have uncovered details about “Outlaw” (also known as Dota), an auto-propagating cryptocurrency mining botnet that specifically targets SSH servers with weak credentials.

“Outlaw is a Linux malware that relies on SSH brute-force attacks, cryptocurrency mining, and worm-like propagation to infect and maintain control over systems,” according to Elastic Security Labs’ recent analysis. The Romanian-origin threat actor joins other prominent cryptojacking groups including 8220, Keksec, Kinsing, and TeamTNT.

## Attack Methodology

Active since late 2018, Outlaw employs a multi-stage infection process:

1. Brute-forces SSH servers to gain initial access
2. Maintains persistence by adding custom SSH keys to the “authorized_keys” file
3. Deploys a dropper script (“tddwrt7s.sh”) that downloads an archive (“dota3.tar.gz”)
4. Unpacks the archive to launch cryptocurrency miners
5. Removes traces of previous compromises and eliminates competing malware

## Key Components

The malware features several specialized components:

– **BLITZ**: An initial access module enabling self-propagation by scanning for vulnerable systems running SSH services
– **SHELLBOT**: A remote control tool that connects to command-and-control servers via IRC channels, allowing attackers to:
– Execute arbitrary shell commands
– Download additional payloads
– Launch DDoS attacks
– Steal credentials
– Exfiltrate sensitive information

## Technical Sophistication

The malware optimizes mining operations by determining the CPU type of infected systems and enabling hugepages across all CPU cores to increase memory access efficiency. It also employs a binary called “kswap01” to maintain persistent communication with attacker infrastructure.

Despite using relatively basic techniques like SSH brute-forcing and cron-based persistence, Outlaw remains an active threat, deploying modified XMRig miners and leveraging IRC for command and control operations.