New Monero Botnet Looks Like Last Year's Outlaw Attack

A rogue botnet uses a brute force attack and Secure Shell (SSH) exploit to give the attackers remote access to victim’s systems in order to mine Monero.

AccessTimeIconJun 13, 2019 at 8:00 p.m. UTC
Updated Sep 13, 2021 at 9:18 a.m. UTC

There’s another Monero mining botnet that’s targeting China. Or maybe it’s one we’ve seen before.

Bloggers steeped in the hacker-verse recently exposed a URL spreading a botnet that looks suspiciously like one unleashed by the Outlaw hacking group last year. The Outlaw outfit -- a name coined by its discoverers at Trend Micro, who translated “the Romanian word haiduc, the hacking tool the group primarily uses” -- is infamous for its previous release of a Perl-based shellbot that infiltrates through weaknesses in the Internet of Things.

The new attack, uncovered by Trend Micro’s honeypot security systems, has been restricted to computers based in China so far. The malware is spread through a malicious URL which bundles in a Monero-mining script and a backdoor-based exploit.

Trend Micro estimates that hackers have used crypto-jacking to mine $250,000 per month in Monero.

The Outlaw botnet uses a brute force attack and Secure Shell (SSH) exploit to give the attackers remote access over victim’s systems. A more detailed report of Outlaw’s previous attack showed that once the attackers have access, the malware executes commands to download and install the cryptocurrency miner payload. Additionally, if the malware detects cryptocurrency miners already installed on the system, it will delete them to reduce competition for system resources.

The security experts also noted that the backdoor component is also capable of launching distributed denial-of-service attacks which would allow the cybercriminals to monetize their botnet not only through mining, but by offering DDoS-for-hire services.

However, because the scripts haven’t been activated, Trend Micro believes the hackers are still in the testing and development phase. They suggest the malware may be laying dormant until future editions of the botnet are released.

This comment lead TheNextWeb to speculate whether the botnet has mined any cryptocurrency or made any successful attacks yet.

Monero image via CoinDesk Archives

Read more about


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.