New Monero Botnet Looks Like Last Year's Outlaw Attack

A rogue botnet uses a brute force attack and Secure Shell (SSH) exploit to give the attackers remote access to victim’s systems in order to mine Monero.

AccessTimeIconJun 13, 2019 at 8:00 p.m. UTC
Updated Sep 13, 2021 at 9:18 a.m. UTC

There’s another Monero mining botnet that’s targeting China. Or maybe it’s one we’ve seen before.

Bloggers steeped in the hacker-verse recently exposed a URL spreading a botnet that looks suspiciously like one unleashed by the Outlaw hacking group last year. The Outlaw outfit -- a name coined by its discoverers at Trend Micro, who translated “the Romanian word haiduc, the hacking tool the group primarily uses” -- is infamous for its previous release of a Perl-based shellbot that infiltrates through weaknesses in the Internet of Things.

The new attack, uncovered by Trend Micro’s honeypot security systems, has been restricted to computers based in China so far. The malware is spread through a malicious URL which bundles in a Monero-mining script and a backdoor-based exploit.

Trend Micro estimates that hackers have used crypto-jacking to mine $250,000 per month in Monero.

The Outlaw botnet uses a brute force attack and Secure Shell (SSH) exploit to give the attackers remote access over victim’s systems. A more detailed report of Outlaw’s previous attack showed that once the attackers have access, the malware executes commands to download and install the cryptocurrency miner payload. Additionally, if the malware detects cryptocurrency miners already installed on the system, it will delete them to reduce competition for system resources.

The security experts also noted that the backdoor component is also capable of launching distributed denial-of-service attacks which would allow the cybercriminals to monetize their botnet not only through mining, but by offering DDoS-for-hire services.

However, because the scripts haven’t been activated, Trend Micro believes the hackers are still in the testing and development phase. They suggest the malware may be laying dormant until future editions of the botnet are released.

This comment lead TheNextWeb to speculate whether the botnet has mined any cryptocurrency or made any successful attacks yet.

Monero image via CoinDesk Archives


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Read more about