Outlaw Botnet Exploits Weak SSH to Hijack Linux Systems for Crypto Mining

Kaspersky observed an active Outlaw (Dota) Linux-focused botnet campaign that compromises systems via weak/default SSH credentials, deploys an obfuscated Perl IRC backdoor and a UPX-packed XMRig CPU miner, removes competing miners, persists via altered SSH keys, and hides C2 and mining traffic over Tor; infections spiked across multiple countries in March 2025 and defenders are advised to harden SSH and apply brute-force protections.