Security2 hOctober 2, 2026, 00:40

Outlaw/Dota botnet changes its SSH fingerprint again

A honeypot recorded a new generation of the mdrfckr botnet from the Outlaw (Dota) group between September 25 and 30, with a modified SSH client configuration. The botnet spreads via SSH brute-force, injects keys into authorized_keys and removes rival botnets' artifacts.

DEV Community

Open source

Outlaw/Dota botnet changes its SSH fingerprint again

Three sessions from IP 36.134.69.15 (AS56044) averaging about 4.6 seconds
The mdrfckr campaign has been documented since 2018; in 2022 it spanned 12,913 IPs from 152 countries
Gen-3 uses libssh_0.11.1 with hassh 03a80b21afa810682a776a7d42e5e6fb, first described in April 2026
The bot changes the root password, injects its own SSH key and cleans up rival artifacts

#Outlaw#Dota#Mdrfckr

MikroTik patches three RouterOS flaws, including SSH auth bypass

Security

Exposed Router Management: 8.09 Million RouterOS Assets and the 9,560 That Still Answer on SSH

Security

Patching Guide: Closing the CVE-2026-67276 SSH Authentication Bypass on MikroTik Routers

Security

Outlaw/Dota botnet changes its SSH fingerprint again

MikroTik patches three RouterOS flaws, including SSH auth bypass

Exposed Router Management: 8.09 Million RouterOS Assets and the 9,560 That Still Answer on SSH

Patching Guide: Closing the CVE-2026-67276 SSH Authentication Bypass on MikroTik Routers

Human attacker exploits Marimo RCE, reaches SSH bastion in eight seconds