Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective

At Elastic Security Labs, Remco Sprooten and I analyzed OUTLAW, a persistent yet unsophisticated auto-propagating coinminer package that remains active across multiple versions despite lacking advanced evasion techniques. It leverages simple but impactful tactics such as SSH brute-forcing, SSH key and cron-based persistence, and manually modified commodity miners and IRC channels.

We deployed a honeypot to observe the attackers in action, revealing both automated propagation and manual post-compromise activity—including real-time command entry and even typos from the operator. The research maps OUTLAW's full attack chain across nearly the entire MITRE ATT&CK framework, from initial access via the blitz brute-forcer through XMRIG mining, STEALTH SHELLBOT IRC backdoors, worm-like lateral movement, and comprehensive detection rules and hunting queries for each stage.

Are you interested in this research? Our full paper is available at Elastic Security Labs!