On May 23, 2026, an automated actor successfully authenticated to a Cowrie SSH honeypot using weak, commonly leaked credentials. Within 22 seconds, the actor injected a malicious SSH key, changed the root password, cleared /etc/hosts.deny, and executed system reconnaissance commands. This behavior was repeated consistently across multiple sessions and IPs, indicating a scripted automated attack rather than manual exploitation. The campaign, identified as part of the ongoing 'mdrfckr' SSH scanning operation, involves coordinated scanning from multiple IPs within the same subnet and uses a broad credential wordlist including gaming server defaults. Threat intelligence sources confirm the malicious reputation of involved IPs. The attack leverages no zero-days or novel exploits but relies on weak SSH credentials and lack of rate limiting. MITRE ATT&CK techniques observed include valid account use, account manipulation, command execution, and defense impairment.

Successful authentication with weak or leaked credentials allows attackers to establish persistent backdoor access rapidly, lock out legitimate administrators by changing passwords, remove host-based access restrictions, and perform system reconnaissance. The automation and speed of the attack mean that human detection and response are unlikely to prevent compromise once authentication occurs. The campaign is widespread and persistent, targeting any internet-exposed SSH service with weak credentials, increasing the risk of unauthorized access and potential system takeover.

The vendor advisory equivalent here recommends multiple mitigations: disable SSH password authentication and require public key authentication only to prevent credential stuffing attacks; enforce strong password policies to eliminate weak credentials; implement rate limiting and account lockout mechanisms (e.g., fail2ban) to reduce brute-force success; restrict SSH access to trusted IP ranges or VPNs to limit exposure; and continuously monitor authentication logs for rapid post-login command execution patterns indicative of automated attacks. These mitigations effectively prevent or detect this automated campaign. No patch is applicable as this is an operational security issue rather than a software vulnerability.