HONEYPOT REPORT  //  2026-08-11 – 2026-08-15

2026-08-11 – 2026-08-15 — SSH, Telnet + Web Honeypot Report

SSH and telnet volume by day

The shell sensor was restored on 2026-08-11; the first day is partial.

Executive summary

Two changes landed at the start of this period. The shell sensor came back after a six-day outage, and the web panel began answering config-file probes with plausible content instead of 404s. The second change produced the period's central finding within ninety-two seconds of the first request.

That is not credential validation. It is credential monetisation: stolen model access is resold or used to run inference on someone else's account. The pipeline treats an AWS key as a product with one specific use, and it tests for that use first.

The scraper is worth as much attention as the outcome. In fifty-eight seconds it made 283 requests while rotating through ten forged user-agents, all impersonating AI companies' crawlers: OAI-SearchBot, PerplexityBot, Amazonbot, Amzn-SearchBot, Google-Extended, and Cohere. Requests for /.aws/credentials and /proc/self/environ arrived under the banner of a search indexer. The disguise is chosen to match the theft: a bot harvesting keys for model access dresses as the crawlers that would plausibly be reading the whole internet.

Twenty-seven token alerts followed over five days, from three unrelated consumers — the Go client above, a Windows Boto3 installation, and a Python aiohttp script calling ListAttachedUserPolicies. Different tooling, different platforms, staggered over days. One planted credential entered circulation and was picked up repeatedly by parties who never touched the sensor that issued it.

On the shell side, the restored sensor immediately captured what six days of silence had cost. 985 payload retrievals produced 42 unique samples spanning eleven CPU architectures. The coordinated brute-force quota pattern first seen in July persists unchanged: eight addresses at exactly 773 sessions each.

Notable sessions — web

Notable sessions — SSH and telnet

Static analysis — the sshd backdoor

This binary was uploaded fourteen times in July and never run, which left it unexplained. On 2026-08-11 it was executed for the first time, and the captured sample is a 30 MB Go 1.18 executable that is considerably more than a mining dropper.

The name is not incidental. It links libpam.so.0 and imports the full PAM authentication interface — pam_authenticate, pam_acct_mgmt, pam_chauthtok, pam_open_session. It also embeds an SSH and SFTP server implementation. It replaces the system SSH daemon with one that authenticates users normally and captures their credentials in the process.

slattery@sec:~/samples$ strings sshd | grep -oE '^main\.[a-zA-Z_]+' | sort -u

main.antikill            main.p2p                 main.spreader
main.antitaskmanager     main.p2phandleclient     main.sshtry
main.forever             main.p2phandleconnection main.startupmanager
main.healthchecker       main.protector           main.updater
main.killnbminer         main.randomIP            main.miner
main.killxmrig           main.loadpayload         main.getMyIP

The function names describe the whole design. randomIP and sshtry feeding a spreader makes it a worm. p2p with connection handlers means peer-to-peer command and control rather than a fixed C2. antikill, antitaskmanager and protector are anti-removal. killxmrig and killnbminer remove competitors' miners before installing its own.

Two things stand out in the configuration. It carries presets for both XMRig and NBMiner — pool address, user, password and algorithm for each, with a NiceHash toggle — so it mines on either CPU or GPU depending on what it lands on. And it exfiltrates through a Discord webhook, using a consumer chat platform as C2 to blend with ordinary HTTPS traffic.

A main.credential struct and an attackqueue of the same type confirm the loop: harvest credentials via PAM, queue them, spread using them.

Other captured samples

Forty-two unique samples across eleven architectures: x86-64, i386, ARM (v4 through v7 and aarch64), MIPS big- and little-endian, PowerPC, SPARC, m68k, SH4 and RISC-V. Three of note:

A 2017 worm, still running. One 4.7 KB bash script is Linux.MulDrop.14, the Raspberry Pi worm from 2017. It still hard-codes the pi user, still sets the same password hash, still adds the same author key to /root/.ssh/authorized_keys, and still blackholes bins.deutschland-zahlung.eu in /etc/hosts to lock out its own earlier versions. Nine years on, unmodified.

An eleven-architecture spray. Exodus.sh from 176.65.139.228:6677 fetches every binary in its /bins/ directory — x86, x32, mips, mipsel, arm4 through arm7, sh4, ppc, m68k — chmods all eleven, launches all eleven in the background with || true, sleeps ten seconds, deletes everything and clears history. No architecture detection at all: run them all and let ten fail.

An attacker's own private key. A 399-byte OpenSSH Ed25519 private key was uploaded to the sensor, comment dlr@sftp. Not a public key planted for persistence — a private key, presumably transferred by mistake or as part of tooling that expects to authenticate onward from the victim.

Indicators

Payload hosts

Busiest shell sources

Honeytoken consumers

Payload hashes

Hashes link to VirusTotal rather than carrying transcribed detection counts, which go stale.

MITRE ATT&CK mapping