Threat Actors Installing Linux Backdoor Accounts

The AhnLab ASEC honeypot report details ongoing campaigns targeting poorly managed Linux SSH servers using IP scanning and brute-force/dictionary logins to add backdoor accounts, change root passwords, or register attacker SSH keys for persistence. The report includes concrete command examples, lists of attacker IPs and credentials, and documents follow-on payloads such as XMRig coinminers and DDoS bots, concluding with mitigation recommendations (strong passwords, key-based auth, disable root SSH, firewalling, patching).