MEDIUM Threat Intel #Ransomware #Brute Force #Credential Theft

Automated SSH Actors Achieve Persistence in 22 Seconds

2026-08-06 01:59 UTC 3 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Immediate impact: threat actors use automated scripts to compromise SSH servers and achieve persistence within seconds of login.
Affected systems: Linux servers exposing SSH services with weak or default credentials, such as root / Aa123123123.
Remediation: disable password authentication entirely and enforce public key cryptography or multi-factor authentication for all SSH access.

Automated Post-Exploitation Tactics in SSH Campaigns

Recent telemetry captured by a Cowrie SSH honeypot deployed as part of an SANS Internet Storm Center internship highlights the extreme velocity of modern brute-force campaigns. According to a SANS ISC Diary, a threat actor successfully authenticated using compromised credentials and completed an entire post-exploitation and persistence routine in just 22 seconds.

The 22-Second Intrusion Timeline

When automated scanning infrastructure successfully guesses a weak password, human hesitation is absent. The observed session timeline demonstrates an instantaneous execution of pre-scripted playbooks designed to lock out administrators and secure long-term access:

T+01s: Successful authentication via weak credentials (root / Aa123123123).
T+05s: Removal and recreation of the .ssh directory to purge existing keys.
T+10s: Injection of a hardcoded SSH public key into authorized_keys.
T+15s: Modification of the root password to usurp administrative control.
T+20s: Alteration or clearing of access restrictions in /etc/hosts.deny.
T+22s: Initiation of automated system reconnaissance scripts.

This rapid execution confirms that attackers rely heavily on automated post-exploitation frameworks rather than manual shell interaction. The consistency of commands, timing, and injected key material across multiple sessions points directly to coordinated botnet operations rather than opportunistic human attackers.

Scale of the Scanning Campaign

Data gathered from the Raspberry Pi 5 sensor over a 30-day monitoring period illustrates the breadth of these automated assaults. The sensor logged over 112,000 SSH sessions and upwards of 72,000 authentication attempts originating from more than 175 unique malicious source IPs. Wordlists utilized in these attacks extend beyond standard administrative combinations, incorporating gaming server default credentials like minecraft / 12345, suggesting broad indiscriminate scanning across varied hosting environments.

Furthermore, correlation with historical tracking data identified active nodes linked to the ongoing mdrfckr SSH campaign. Coordinated subnets—such as multiple sequential IPs operating from the same /24 block—demonstrate distributed scanning infrastructure designed to maximize efficiency while evading single-IP rate-limiting defenses.

Mitigating Automated SSH Brute-Force Attacks

Defenders must assume that any exposed SSH service facing the public internet will be subjected to continuous automated credential stuffing. To protect infrastructure against rapid persistence scripts, organizations should prioritize the following hardening steps:

Disable Password Authentication: Enforce strict public key authentication in sshd_config and completely disable password-based logins to render credential stuffing ineffective.
Implement Fail2ban or Rate Limiting: Deploy automated blocking mechanisms to drop connection attempts from IP addresses exhibiting repetitive authentication failures.
Restrict Management Access: Isolate SSH management interfaces behind a virtual private network (VPN) or implement strict firewall rules and zero trust network access (ZTNA) policies to prevent direct exposure to the public internet.

#Ransomware #Brute Force #Credential Theft

X/Twitter LinkedIn Reddit HN

← Back to Articles