Outlaw cybergang attacking targets worldwide
ID: a53f9ca2-f3ec-5364-a288-747b426b78fd
STIX ID: report--a53f9ca2-f3ec-5364-a288-747b426b78fd
Feed Name: Securelist by Kaspersky
Date Published: 2025-04-29
Date Updated: 2026-04-29
Author: Cristian Souza, Ashley Muñoz, Eduardo Ovalle
This report analyzes the Outlaw (Dota) Linux crypto-mining campaign that abuses weak/default SSH credentials to deploy an obfuscated Perl IRC backdoor and a customized XMRig miner, maintains persistence via SSH authorized_keys and cron, and exfiltrates compute resources across multiple countries; it includes victim telemetry, MITRE ATT&CK mappings, IOCs, and actionable SSH hardening and detection recommendations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
