345gs5662d34 / mdrfckr — Credential stuffing + SSH key campaign

Executive summary

One password, reused across more than 9,500 machines, kept a botnet logging into our honeypots daily for six-plus weeks straight. Then, in the final days of the window covered here, that volume dropped — a real decline, though a later full-day count showed it was less severe than an initial partial-day read suggested. This report walks through how the credential-stuffing and SSH-key phases work, and what we ruled out to confirm the drop is real botnet behavior rather than a sensor artifact.

Over a 42+ day window (2026-05-21 through 2026-07-01, ongoing), sensors observed a coordinated two-phase campaign combining mass credential stuffing with SSH authorized_keys persistence. The campaign uses the credential 345gs5662d34 as both username and password, attempting 458,000+ logins across 9,500+ unique source IPs. Upon successful login, the attacker injects a single hardcoded RSA SSH key (comment: mdrfckr) into ~/.ssh/authorized_keys, establishing persistent backdoor access — observed 333,000+ times across 9,200+ IPs.

The credential stuffing and key injection are performed by the same botnet: the top IPs participate in both phases with near-identical event counts. The campaign is remarkable for its scale (9,700+ IPs), its narrow-credential approach (a primary password plus a single-digit variant, together spanning 7+ usernames), its awareness of Linux hardening (the chattr -ia pre-step to remove immutable attributes before modifying the SSH directory), and its persistence — six-plus weeks of continuous activity against the same credential family and key. Daily volume held steady at roughly 8,600-9,600 credential attempts/day through 2026-06-27, then declined to roughly 3,400-3,700 attempts/day by 2026-06-30 – 07-01 — a real drop, but to about 40% of peak, not the near-total collapse an early partial-day read of 2026-07-01 initially suggested; see Campaign Timeline for the day-by-day breakdown. The campaign's IPs were cross-checked against sensor-side collection-volume controls and none were affected, so the drop reflects real botnet behavior rather than a collection artifact — possibly a partial takedown, C2 rotation, or a shift of some nodes to a new credential/key pair not yet identified.

Threat actor profile

Phase 1 — Credential stuffing

The campaign uses the credential 345gs5662d34 as both username and password. The same botnet IPs also spray a closely-related variant password, 3245gs5662d34 (one digit longer), against a set of common system usernames. Both credentials appear programmatically generated — possibly a default password from a specific IoT firmware or a botnet credential rotation token.

Credential distribution

Top participating botnet IPs

Phase 2 — SSH key injection

Upon successful login, the attacker executes a two-command sequence to install a persistent SSH backdoor key. The attack is notable for its chattr -ia pre-step, which removes the immutable and append-only attributes that Linux hardening guides recommend setting on the ~/.ssh directory.

Attack sequence (from 102.88.137.80)

# Step 1: Remove immutable attributes (unlock .ssh directory)
cd ~; chattr -ia .ssh; lockr -ia .ssh

# Step 2: Replace authorized_keys with the mdrfckr RSA key
cd ~ && rm -rf .ssh && mkdir .ssh && echo \
  "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr" \
  >>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

The key injection was observed 333,379 times across 9,223 unique IPs — a near-1:1 match with the credential stuffing IPs, confirming this is a single coordinated campaign.

Campaign cross-reference

The same IPs perform both credential stuffing and key injection, confirming a single operation:

Other notable credentials in the same window

Several other credential pairs appeared at high volume during the same 30-day period, suggesting either parallel campaigns or additional credentials deployed by the same botnet:

MITRE ATT&CK mapping

Campaign timeline

Indicators of compromise

Credential IOC

SSH key IOC

Command pattern IOC

Network — top botnet IPs

Detection signatures

Suricata — 345gs5662d34 credential in SSH auth

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (
  msg:"cowrAI 345gs5662d34 credential stuffing campaign";
  flow:to_server,established;
  content:"345gs5662d34";
  threshold:type both, track by_src, count 5, seconds 60;
  classtype:attempted-admin; sid:9003020001; rev:1;
)

Suricata — mdrfckr SSH key injection

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (
  msg:"cowrAI mdrfckr SSH authorized_keys injection";
  flow:to_server,established;
  content:"mdrfckr";
  content:"authorized_keys"; distance:0;
  content:"chattr"; nocase;
  classtype:trojan-activity; sid:9003020002; rev:1;
)

OSSEC / Wazuh — authorized_keys replacement

<rule id="100302" level="12">
  <if_sid>530</if_sid>
  <match>rm -rf .ssh</match>
  <match>authorized_keys</match>
  <description>SSH authorized_keys replacement detected (mdrfckr campaign)</description>
</rule>

Collection methodology

Data collected by a distributed honeypot fleet running SSH/Telnet protocol lures. All login attempts and post-authentication commands were captured at the application layer and ingested into a time-series database for analysis. Credential pairs, source IP addresses, and command sequences were correlated across sensors to identify the two-phase campaign structure.