ogurexxx@root:~$ man botnet

Botnet bestiary

A field guide to every species met in the honeypot on this server. Dates, commands and kinship are real. The Latin names and diets are the author's joke.

species in the guide: 8 · active: 8 · in hiding: 0 · extinct: 0

Clavis importunus

SSH key implant · sshkey-3bfa · active

Habits: Adds its own SSH key to come back later without a password.
Diet: authorized_keys files
Sightings: from 28.10.2026 to 31.10.2026, up to 249 addresses, sessions: 282
Techniques: SSH Authorized Keys, Linux File and Directory Permissions Modification

How to recognise

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo <arg> && chmod -R <arg> ~/.ssh && cd ~

Speculator surdus

Scout · recon-5552 · active

Habits: Only looks around — what system, how many cores — and leaves.
Diet: system information
Sightings: from 28.10.2026 to 31.10.2026, up to 13 addresses, sessions: 15310
Techniques: System Information Discovery

How to recognise

$ uname -s -v -n -r -m

Speculator furtivus

Scout · recon-90e6 · active

Habits: Only looks around — what system, how many cores — and leaves.
Diet: system information
Sightings: from 29.10.2026 to 31.10.2026, up to 7 addresses, sessions: 345
Techniques: System Information Discovery

How to recognise

$ /bin/./uname -s -v -n -r -m

Vector tenax

Loader · loader-e884 · active

Habits: Downloads and runs a program — usually a botnet client.
Diet: open folders and executables
Sightings: from 28.10.2026 to 31.10.2026, up to 6 addresses, sessions: 85
Techniques: Unix Shell, Linux File and Directory Permissions Modification

How to recognise

$ sh -c <arg>
$ sh -c <arg>
$ sh -c <arg>
$ sh -c <arg>

Clavis domesticus

SSH key implant · sshkey-830e · active

Habits: Adds its own SSH key to come back later without a password.
Diet: authorized_keys files
Sightings: from 28.10.2026 to 30.10.2026, up to 5 addresses, sessions: 5
Techniques: System Owner/User Discovery, Cron, Process Discovery, Unix Shell, System Information Discovery, File and Directory Discovery, Account Manipulation, SSH Authorized Keys, Linux File and Directory Permissions Modification
Descendants: Clavis errabundus

How to recognise

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo <arg> && chmod -R <arg> ~/.ssh && cd ~
$ cat /proc/cpuinfo | grep name | wc -l
$ echo -e <str> | passwd | bash
$ echo <str> | passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk <str>
$ free -m | grep <arg> | awk <str>
$ ls -lh <arg> <arg>

Clavis errabundus

SSH key implant · sshkey-b6c8 · active

Habits: Adds its own SSH key to come back later without a password.
Diet: authorized_keys files
Sightings: from 29.10.2026 to 30.10.2026, up to 4 addresses, sessions: 4
Techniques: System Owner/User Discovery, Cron, Process Discovery, Unix Shell, System Information Discovery, File and Directory Discovery, Account Manipulation, SSH Authorized Keys, Linux File and Directory Permissions Modification, Service Stop
Ancestor: Clavis domesticus

How to recognise

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo <arg> && chmod -R <arg> ~/.ssh && cd ~
$ cat /proc/cpuinfo | grep name | wc -l
$ echo <str> | chpasswd | bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.
$ cat /proc/cpuinfo | grep name | head -n 1 | awk <str>
$ free -m | grep <arg> | awk <str>
$ ls -lh <arg> <arg>

Speculator furtivus

Scout · recon-0104 · active

Habits: Only looks around — what system, how many cores — and leaves.
Diet: system information
Sightings: from 28.10.2026 to 30.10.2026, up to 4 addresses, sessions: 4
Techniques: System Information Discovery

How to recognise

$ uname -s -m

Speculator importunus

Scout · recon-2726 · active

Habits: Only looks around — what system, how many cores — and leaves.
Diet: system information
Sightings: from 30.10.2026 to 30.10.2026, up to 3 addresses, sessions: 3
Techniques: File and Directory Discovery

How to recognise

$ ls <arg>