Automated SSH Attackers Achieve Persistence in 22 Seconds
A honeypot analysis reveals a sophisticated automated campaign rapidly compromising SSH servers within seconds of initial login, injecting backdoors and establishing persistence.
A recent analysis of a self-managed Cowrie SSH honeypot has uncovered a highly efficient automated attack campaign that compromises systems in a mere 22 seconds from the initial login. The intrusion, observed on May 23, 2026, involved a threat actor successfully authenticating with compromised credentials and immediately executing a pre-scripted playbook. This playbook included injecting a backdoor SSH key, altering the root password, attempting to remove host-based access restrictions, and conducting automated system reconnaissance.
The honeypot, running on a Raspberry Pi 5 and continuously monitored since April 2026, captured over 112,000 SSH sessions and 72,000 authentication attempts from more than 175 unique malicious IP addresses during the analyzed period. The speed and identical nature of the commands executed across multiple sessions strongly indicate the use of automated tools rather than human operators. The attacker's actions, such as removing the existing .ssh directory before injecting a new key and immediately changing the root password, were designed to ensure exclusive backdoor access and lock out legitimate administrators.
Further investigation revealed that the same source IP, 163.7.8.79, repeatedly connected to the honeypot throughout the day, executing the same rapid sequence of commands. This consistency across sessions, including the identical SSH key material, confirms the automated nature of the attack. The analysis of successful logins on May 23 showed 21 successful authentications from different source IPs within a single 24-hour period, heavily clustered between 01:00 and 02:30 UTC, suggesting coordinated, wave-based scanning.
The credentials used in these attacks also provided insight into the attackers' methods, with a notable inclusion of 'minecraft / 12345', suggesting a wordlist specifically compiled to target gaming server default credentials. This indicates a broader scanning effort beyond generic Linux systems, actively seeking out vulnerable game servers.
Cross-referencing the observed IP addresses with known threat intelligence, particularly the 'mdrfckr' SSH campaign, revealed a significant overlap. Ninety-three IPs associated with the mdrfckr campaign were still actively targeting the honeypot weeks after their initial documentation. This indicates that the campaign is ongoing and persistent, not a historical event.
The analysis also identified coordinated scanning infrastructure, with three high-volume connecting IPs originating from the same /24 subnet. This suggests the use of a botnet or a distributed scanning platform operating multiple nodes from a single network block to maximize coverage and distribute the load.
Threat intelligence platforms confirmed the malicious reputation of the primary actor IP, 163.7.8.79, with a 100% confidence of abuse reported on AbuseIPDB, citing over 5,700 incidents primarily related to SSH brute-force attacks. VirusTotal also classified the IP as malicious or suspicious, and GreyNoise identified it as part of internet-wide SSH brute-force and reconnaissance scanning activity.
This rapid, automated approach to post-exploitation highlights the evolving threat landscape, where attackers can achieve deep system compromise and persistence before defenders can even detect the initial breach. The findings underscore the critical need for robust SSH security, including strong password policies, key-based authentication, and continuous monitoring for anomalous activity.