Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
4 malware familiesExploits CVEs in the wild

Outlaw

Also known asoutlaw

Outlaw is a long-running Linux-focused cryptomining botnet and intrusion set, also referred to in the provided reporting as Dota and Shellbot. The content describes it as a Perl-based crypto-mining botnet that typically compromises systems through weak or default SSH credentials, with additional reporting tying it to brute-force activity against SSH and Telnet, PHP web shells, and exploitation of CVE-2016-8655 and Dirty COW (CVE-2016-5195). Trend Micro is cited as first identifying the group in 2018. Across the reporting, Outlaw targets Linux and Unix systems, including servers and IoT devices. Victim telemetry cited in the content places activity mainly in the United States, with additional victims in Germany, Italy, Thailand, Singapore, Taiwan, Canada, Brazil, and broader targeting in the United States and Europe. One report states researchers assessed the kits were designed to steal information from the automotive and finance industries, but the dominant activity directly described is illicit monetization through Monero mining and botnet operations. The intrusion playbook consistently includes post-compromise SSH persistence by deleting and recreating the victim’s .ssh directory and writing an attacker-controlled public key into authorized_keys. The inserted key is repeatedly associated with the comment string "mdrfckr," which multiple sources in the content link to the Outlaw/Dota family. The same authorized_keys artifact is associated with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2. Reporting also notes defensive-disarm commands such as chattr -ia .ssh and lockr -ia .ssh before overwriting SSH files, password changes on compromised hosts, and recurring reconnaissance commands such as uname and resource checks. The malware/tooling described includes shell-script downloaders, hidden working directories such as .configrc5 and /tmp/.X19-unix, persistence via cron and looping init scripts, and a Perl IRC backdoor disguised as rsync. The IRC bot connects to hardcoded IRC infrastructure over port 443, uses randomized nicknames, and supports command execution, DDoS, port scanning, file download, and HTTP upload. Mining functionality includes a UPX-packed modified XMRig 6.19.0 configured for CPU-only Monero mining, with Tor-related components and multiple mining pools. The toolkit also removes competing miners and prior infections, resets cron, kills suspicious or rival high-CPU processes, and in some reporting changes the root password to a random string. The content documents continued operational evolution. Kaspersky reported renewed activity after apparent inactivity from December 2024 through February 2025, followed by a spike in March 2025. Separate April 2026 observations tie the same Outlaw/Shellbot authorized_keys persistence playbook to a new SSH client fingerprint lineage using banner SSH-2.0-libssh_0.11.1 and hassh 03a80b21afa810682a776a7d42e5e6fb, while retaining the stable "mdrfckr" key, command sequence, credential dictionary, and cleanup behavior. Earlier reporting cited prior libssh-based fingerprints for the same campaign. Known aliases directly mentioned in the content are Dota and Shellbot. The content also references related naming such as the Outlaw Hacking Group and notes overlap with broader Linux cryptomining ecosystems, but only the aliases explicitly tied to this actor in the reporting are included here.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

MITRE ATT&CK

Tradecraft

31 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

13 of 15 tactics45 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0001
Initial Access
1 technique
T1078
Valid Accounts
TA0002
Execution
2 techniques
T1053
Scheduled Task/Job
T1053.003×2
Cron
T1059
Command and Scripting Interpreter
T1059.004×2
Unix Shell
T1059.006
Python
TA0003
Persistence
4 techniques
T1053
Scheduled Task/Job
T1053.003×2
Cron
T1078
Valid Accounts
T1098×2
Account Manipulation
T1098.004×3
SSH Authorized Keys
T1505
Server Software Component
T1505.003
Web Shell
TA0004
Privilege Escalation
4 techniques
T1053
Scheduled Task/Job
T1053.003×2
Cron
T1068
Exploitation for Privilege Escalation
T1078
Valid Accounts
T1098×2
Account Manipulation
T1098.004×3
SSH Authorized Keys
TA0005
Stealth
5 techniques
T1027×2
Obfuscated Files or Information
T1027.002
Software Packing
T1036
Masquerading
T1070×2
Indicator Removal
T1070.004
File Deletion
T1078
Valid Accounts
T1564
Hide Artifacts
T1564.001
Hidden Files and Directories
TA0112
Defense Impairment
1 technique
T1222×3
File and Directory Permissions Modification
TA0006
Credential Access
1 technique
T1110×4
Brute Force
TA0007
Discovery
6 techniques
T1033×2
System Owner/User Discovery
T1046
Network Service Discovery
T1049
System Network Connections Discovery
T1057
Process Discovery
T1082×2
System Information Discovery
T1087
Account Discovery
TA0008
Lateral Movement
2 techniques
T1021
Remote Services
T1021.004
SSH
T1210
Exploitation of Remote Services
TA0009
Collection
1 technique
T1005
Data from Local System
TA0011
Command and Control
3 techniques
T1071×2
Application Layer Protocol
T1105×3
Ingress Tool Transfer
T1219
Remote Access Tools
TA0010
Exfiltration
1 technique
T1048
Exfiltration Over Alternative Protocol
TA0040
Impact
2 techniques
T1489
Service Stop
T1496×2
Resource Hijacking
IOCS

Observables

21 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

trend micro researchNews
Jun 23, 2026
From Langflow to Monero: Inside CVE-2026-33017 Cryptominer | Trend Micro (US)

Referenced as a rival cryptomining family/operator whose known artifacts are included in the lambsys kill list.

Read more
codebyNews
Jun 4, 2026
Поднял SSH-ловушку и поймал живой ботнет

A long-running botnet campaign conducting opportunistic SSH compromise activity worldwide. In the observed activity, infected nodes attempted to replace .ssh directories, add the same attacker-controlled SSH public key with the comment 'mdrfckr' into authorized_keys, and establish persistent backdoor access on newly compromised hosts.

Read more
securelistNews
May 21, 2026
Outlaw botnet detected in an incident contained by Kaspersky | Securelist

Linux-focused cryptomining botnet activity that compromises systems via weak or default SSH credentials, installs persistence through SSH authorized keys and cron, deploys an IRC-based backdoor, and runs a modified XMRig miner for Monero mining.

Read more
handlers diary fullNews
May 15, 2026
[Guest Diary] New Malware Libraries means New Signatures

Long-running SSH botnet/crypto-botnet activity using the stable 'mdrfckr' authorized_keys persistence artifact, brute-force SSH logins with a fixed credential dictionary, account hijacking via chpasswd, reconnaissance, and competitor-cleanup commands. The April 2026 observation shows the same campaign updating its SSH client tooling to libssh 0.11.1 while retaining the same persistence key and playbook.

Read more
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping31

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal4

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs2

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables21

Domains, IPs, and hashes tied to this actor, refreshed continuously.