Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective
OUTLAW is a persistent Linux malware that uses basic techniques like SSH brute-forcing, SSH key manipulation, and cron-based persistence to maintain a long-lasting botnet. Despite its lack of sophistication, it remains active by leveraging simple but impactful tactics. The malware deploys modified XMRig miners, uses IRC for command and control, and includes publicly available scripts for persistence and defense evasion. OUTLAW's infection chain spans nearly the entire MITRE ATT&CK framework, offering many detection opportunities. It propagates in a worm-like manner, using compromised hosts to launch further SSH brute-force attacks on local subnets, rapidly expanding the botnet.
Pulse ID: 67ef069f9224aa64d79e6a8e
Pulse Link: https://otx.alienvault.com/pulse/67ef069f9224aa64d79e6a8e
Pulse Author: AlienVault
Created: 2025-04-03 22:07:27
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
hxxp[:]//auth-ledger-start-ccdn[.]webflow[.]io/
Analysis at: 
Cyber Infrastructure Engineer
Darktrace
Tokyo, Japan
Apply now: 
200M X (Twitter) user records leaked in a 34GB free-for-all—again.
The kicker? ThinkingOne believes this might’ve required internal access, or an attack of unprecedented sophistication.
