{
    "feed": "ogurexxx.ru SSH honeypot — botnet families",
    "about": "https://ogurexxx.ru/live#families",
    "updated": "2026-10-29T21:37:36Z",
    "note": "Behaviour seen from at least 3 different addresses in the last 7 days. Commands are sanitized: links, IPs, quoted strings and random file names are replaced with tags. No attacker IPs.",
    "families": [
        {
            "id": "sshkey-3bfa",
            "goal": "sshkey",
            "name": "SSH key implant",
            "summary": "Adds its own SSH key to come back later without a password.",
            "first_seen": "2026-10-28",
            "last_seen": "2026-10-29",
            "addresses": 105,
            "sessions": 110,
            "techniques": [
                {
                    "id": "T1098.004",
                    "name": "SSH Authorized Keys",
                    "url": "https://attack.mitre.org/techniques/T1098/004/"
                },
                {
                    "id": "T1222.002",
                    "name": "Linux File and Directory Permissions Modification",
                    "url": "https://attack.mitre.org/techniques/T1222/002/"
                }
            ],
            "commands": [
                "cd ~ && rm -rf .ssh && mkdir .ssh && echo <arg> && chmod -R <arg> ~/.ssh && cd ~"
            ],
            "ssh_clients": [
                "SSH-2.0-libssh_0.9.6",
                "SSH-2.0-libssh_0.11.1"
            ]
        },
        {
            "id": "recon-90e6",
            "goal": "recon",
            "name": "Scout",
            "summary": "Only looks around — what system, how many cores — and leaves.",
            "first_seen": "2026-10-29",
            "last_seen": "2026-10-30",
            "addresses": 5,
            "sessions": 202,
            "techniques": [
                {
                    "id": "T1082",
                    "name": "System Information Discovery",
                    "url": "https://attack.mitre.org/techniques/T1082/"
                }
            ],
            "commands": [
                "/bin/./uname -s -v -n -r -m"
            ],
            "ssh_clients": [
                "SSH-2.0-Go"
            ]
        },
        {
            "id": "recon-5552",
            "goal": "recon",
            "name": "Scout",
            "summary": "Only looks around — what system, how many cores — and leaves.",
            "first_seen": "2026-10-28",
            "last_seen": "2026-10-29",
            "addresses": 5,
            "sessions": 5907,
            "techniques": [
                {
                    "id": "T1082",
                    "name": "System Information Discovery",
                    "url": "https://attack.mitre.org/techniques/T1082/"
                }
            ],
            "commands": [
                "uname -s -v -n -r -m"
            ],
            "ssh_clients": [
                "SSH-2.0-Go"
            ]
        },
        {
            "id": "loader-e884",
            "goal": "loader",
            "name": "Loader",
            "summary": "Downloads and runs a program — usually a botnet client.",
            "first_seen": "2026-10-28",
            "last_seen": "2026-10-29",
            "addresses": 3,
            "sessions": 66,
            "techniques": [
                {
                    "id": "T1059.004",
                    "name": "Unix Shell",
                    "url": "https://attack.mitre.org/techniques/T1059/004/"
                },
                {
                    "id": "T1222.002",
                    "name": "Linux File and Directory Permissions Modification",
                    "url": "https://attack.mitre.org/techniques/T1222/002/"
                }
            ],
            "commands": [
                "sh -c <arg>",
                "sh -c <arg>",
                "sh -c <arg>",
                "sh -c <arg>"
            ],
            "ssh_clients": [
                "SSH-2.0-Go"
            ]
        },
        {
            "id": "sshkey-b6c8",
            "goal": "sshkey",
            "name": "SSH key implant",
            "summary": "Adds its own SSH key to come back later without a password.",
            "first_seen": "2026-10-29",
            "last_seen": "2026-10-29",
            "addresses": 3,
            "sessions": 3,
            "techniques": [
                {
                    "id": "T1033",
                    "name": "System Owner/User Discovery",
                    "url": "https://attack.mitre.org/techniques/T1033/"
                },
                {
                    "id": "T1053.003",
                    "name": "Cron",
                    "url": "https://attack.mitre.org/techniques/T1053/003/"
                },
                {
                    "id": "T1057",
                    "name": "Process Discovery",
                    "url": "https://attack.mitre.org/techniques/T1057/"
                },
                {
                    "id": "T1059.004",
                    "name": "Unix Shell",
                    "url": "https://attack.mitre.org/techniques/T1059/004/"
                },
                {
                    "id": "T1082",
                    "name": "System Information Discovery",
                    "url": "https://attack.mitre.org/techniques/T1082/"
                },
                {
                    "id": "T1083",
                    "name": "File and Directory Discovery",
                    "url": "https://attack.mitre.org/techniques/T1083/"
                },
                {
                    "id": "T1098",
                    "name": "Account Manipulation",
                    "url": "https://attack.mitre.org/techniques/T1098/"
                },
                {
                    "id": "T1098.004",
                    "name": "SSH Authorized Keys",
                    "url": "https://attack.mitre.org/techniques/T1098/004/"
                },
                {
                    "id": "T1222.002",
                    "name": "Linux File and Directory Permissions Modification",
                    "url": "https://attack.mitre.org/techniques/T1222/002/"
                },
                {
                    "id": "T1489",
                    "name": "Service Stop",
                    "url": "https://attack.mitre.org/techniques/T1489/"
                }
            ],
            "commands": [
                "cd ~ && rm -rf .ssh && mkdir .ssh && echo <arg> && chmod -R <arg> ~/.ssh && cd ~",
                "cat /proc/cpuinfo | grep name | wc -l",
                "echo <str> | chpasswd | bash",
                "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.",
                "cat /proc/cpuinfo | grep name | head -n 1 | awk <str>",
                "free -m | grep <arg> | awk <str>",
                "ls -lh <arg> <arg>"
            ],
            "ssh_clients": [
                "SSH-2.0-libssh_0.9.6",
                "SSH-2.0-libssh_0.11.1"
            ]
        }
    ]
}