OUTLAW LINUX MALWARE: PERSISTENT, UNSOPHISTICATED, AND SURPRISINGLY EFFECTIVE

Summary from the TLDR InfoSec newsletter

Outlaw infects systems through SSH brute-force attacks, establishes persistence via cron jobs and SSH key manipulation, and deploys a three-part payload consisting of XMRIG for cryptocurrency mining, STEALTH SHELLBOT for remote control, and BLITZ for further propagation. Despite its unsophisticated nature, Outlaw remains effective because it leverages stolen system resources for mining profit while simultaneously expanding its botnet through continuous SSH brute-forcing of nearby systems.