Summary

  • APNIC recorded 2,621 source IPs running the same SSH command after a honeynet login. It removed the existing .ssh directory and installed one attacker key in authorized_keys.
  • The report publishes that key’s SHA-256 fingerprint. APNIC says a server carrying it in authorized_keys is compromised.

A password gets someone through the door. The interesting bit in APNIC’s report is what they changed before leaving.

APNIC rebuilt much of its honeynet this year: it upgraded the collection backend, refreshed Cowrie and Dionaea, added OpenCanary and Webpot, and began imitating a Fortinet SSL-VPN portal and an Android device with its debug port exposed. Captured malware now goes to a Linux sandbox. From 21 to 27 September, the rebuilt sensors logged 98,958 distinct source IPs and 173 million events.

APNIC separates IP addresses from event volume for a reason. One bot can fill millions of log lines; another source connects once. Cowrie, the SSH and Telnet sensor, saw 72,256 distinct IPs and 121.1 million events. OpenCanary saw 14,393 IPs but 34.5 million events—about 2,400 events per observed IP, against Cowrie’s roughly 1,700. An event count is a very noisy way to ask how many systems showed up.

The report counted 9,669 IPs attempting SSH. Many tried a small set of predictable usernames and passwords, the sort of list an automated tool can carry in its pocket. After a successful login, 2,621 IPs ran the same one-liner: remove the old ~/.ssh directory, write a single attacker-controlled key into authorized_keys, then lock down permissions. The command replaces the account’s key inventory in one session.

The comment attached to the key ends in mdrfckr. APNIC publishes its fingerprint as SHA256:MkYY9qiVsFGBC5WkjoClCkwEFW5iSjcGQF7m4n4H7Cw and gives operators a plain rule: if that key appears in a server’s authorized_keys, the server is compromised. A password reset leaves the file-based grant in place until someone removes the key.

The week’s file measurements use other denominators. Cowrie received 7,635 unique download URLs from 6,493 IPs; 4,224 URLs returned a file. Across the sensors, 8,797 IPs left files, producing 506 distinct files, including files written directly into a session such as the SSH key. APNIC does not publish how many of those file-dropping IPs belong to the 2,621-command group.

For operators, start with the fingerprint and the file it lives in. Search authorized-key files across the estate, compare them with a trusted key inventory, inspect unexpected changes under ~/.ssh, and trace the session that wrote them. Remove an unauthorized key, restore legitimate access from a known record, then rotate exposed passwords. The password opened the session; authorized_keys decides who can come back.

Source: APNIC’s one-week honeynet report.