Outlaw
Outlaw is a long-running Linux-focused cryptomining botnet and intrusion set, also referred to in the provided reporting as Dota and Shellbot. The content describes it as a Perl-based crypto-mining botnet that typically compromises systems through weak or default SSH credentials, with additional reporting tying it to brute-force activity against SSH and Telnet, PHP web shells, and exploitation of CVE-2016-8655 and Dirty COW (CVE-2016-5195). Trend Micro is cited as first identifying the group in 2018. Across the reporting, Outlaw targets Linux and Unix systems, including servers and IoT devices. Victim telemetry cited in the content places activity mainly in the United States, with additional victims in Germany, Italy, Thailand, Singapore, Taiwan, Canada, Brazil, and broader targeting in the United States and Europe. One report states researchers assessed the kits were designed to steal information from the automotive and finance industries, but the dominant activity directly described is illicit monetization through Monero mining and botnet operations. The intrusion playbook consistently includes post-compromise SSH persistence by deleting and recreating the victim’s .ssh directory and writing an attacker-controlled public key into authorized_keys. The inserted key is repeatedly associated with the comment string "mdrfckr," which multiple sources in the content link to the Outlaw/Dota family. The same authorized_keys artifact is associated with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2. Reporting also notes defensive-disarm commands such as chattr -ia .ssh and lockr -ia .ssh before overwriting SSH files, password changes on compromised hosts, and recurring reconnaissance commands such as uname and resource checks. The malware/tooling described includes shell-script downloaders, hidden working directories such as .configrc5 and /tmp/.X19-unix, persistence via cron and looping init scripts, and a Perl IRC backdoor disguised as rsync. The IRC bot connects to hardcoded IRC infrastructure over port 443, uses randomized nicknames, and supports command execution, DDoS, port scanning, file download, and HTTP upload. Mining functionality includes a UPX-packed modified XMRig 6.19.0 configured for CPU-only Monero mining, with Tor-related components and multiple mining pools. The toolkit also removes competing miners and prior infections, resets cron, kills suspicious or rival high-CPU processes, and in some reporting changes the root password to a random string. The content documents continued operational evolution. Kaspersky reported renewed activity after apparent inactivity from December 2024 through February 2025, followed by a spike in March 2025. Separate April 2026 observations tie the same Outlaw/Shellbot authorized_keys persistence playbook to a new SSH client fingerprint lineage using banner SSH-2.0-libssh_0.11.1 and hassh 03a80b21afa810682a776a7d42e5e6fb, while retaining the stable "mdrfckr" key, command sequence, credential dictionary, and cleanup behavior. Earlier reporting cited prior libssh-based fingerprints for the same campaign. Known aliases directly mentioned in the content are Dota and Shellbot. The content also references related naming such as the Outlaw Hacking Group and notes overlap with broader Linux cryptomining ecosystems, but only the aliases explicitly tied to this actor in the reporting are included here.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
31 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
4 malware families attributed to this actor across reporting.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
This time, the group explored unpatched systems vulnerable to CVE-2016-8655 and Dirty COW exploit (CVE-2016-5195) as attack vectors.
This time, the group explored unpatched systems vulnerable to CVE-2016-8655 ... as attack vectors.
Observables
21 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a rival cryptomining family/operator whose known artifacts are included in the lambsys kill list.
A long-running botnet campaign conducting opportunistic SSH compromise activity worldwide. In the observed activity, infected nodes attempted to replace .ssh directories, add the same attacker-controlled SSH public key with the comment 'mdrfckr' into authorized_keys, and establish persistent backdoor access on newly compromised hosts.
Linux-focused cryptomining botnet activity that compromises systems via weak or default SSH credentials, installs persistence through SSH authorized keys and cron, deploys an IRC-based backdoor, and runs a modified XMRig miner for Monero mining.
Long-running SSH botnet/crypto-botnet activity using the stable 'mdrfckr' authorized_keys persistence artifact, brute-force SSH logins with a fixed credential dictionary, account hijacking via chpasswd, reconnaissance, and competitor-cleanup commands. The April 2026 observation shows the same campaign updating its SSH client tooling to libssh 0.11.1 while retaining the same persistence key and playbook.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.