Battling Cryptojacking, Botnets, and IABs [Guest Diary], (Thu, Jan 15th)

This guest diary analyzes DShield honeypot traffic showing a common attack chain: SSH password-spray -> automated system enumeration -> SSH persistence setup -> transfer and execution of a Go-based trojan/miner linked to botnet/cryptojacking operations. The author provides observed IPs and a malware hash, maps the attacker TTPs (attribution to an ‘Outlaw’ runbook is used as a threat model), and recommends mitigations including disabling password SSH auth, enforcing MFA, file integrity monitoring, log centralization, and proactive threat hunting.