NewsPublished 6 Aug 2026

22 Seconds to Compromise: How Automated SSH Actors Move From Login to Persistence Before You Can Blink [Guest Diary], (Thu, Aug 6th)

Source SANS ISC Handlers Diary

Description

[This is a Guest Diary by Daryl Jiminez, an ISC intern as part of the SANS.edu BACS program]

Impact

Successful authentication with weak or leaked credentials allows attackers to establish persistent backdoor access rapidly, lock out legitimate administrators by changing passwords, remove host-based access restrictions, and perform system reconnaissance. The automation and speed of the attack mean that human detection and response are unlikely to prevent compromise once authentication occurs. The campaign is widespread and persistent, targeting any internet-exposed SSH service with weak credentials, increasing the risk of unauthorized access and potential system takeover.

Defensive guidance

The vendor advisory equivalent here recommends multiple mitigations: disable SSH password authentication and require public key authentication only to prevent credential stuffing attacks; enforce strong password policies to eliminate weak credentials; implement rate limiting and account lockout mechanisms (e.g., fail2ban) to reduce brute-force success; restrict SSH access to trusted IP ranges or VPNs to limit exposure; and continuously monitor authentication logs for rapid post-login command execution patterns indicative of automated attacks. These mitigations effectively prevent or detect this automated campaign.

Summary

On May 23, 2026, an automated actor successfully authenticated to a Cowrie SSH honeypot using weak, commonly leaked credentials. Within 22 seconds, the actor injected a malicious SSH key, changed the root password, cleared /etc/hosts.deny, and executed system reconnaissance commands. This behavior was repeated consistently across multiple sessions and IPs, indicating a scripted automated attack rather than manual exploitation. The campaign, identified as part of the ongoing 'mdrfckr' SSH scanning operation, involves coordinated scanning from multiple IPs within the same subnet and uses a broad credential wordlist including gaming server defaults. Threat intelligence sources confirm the malicious reputation of involved IPs. The attack leverages no zero-days or novel exploits but relies on weak SSH credentials and lack of rate limiting. MITRE ATT&CK techniques observed include valid account use, account manipulation, command execution, and defense impairment.

References

isc.sans.edu/diary/rss/33220 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 6 Aug 2026, 00:26 UTC

References

Community reviews