They shipped the miner for five CPUs at once
After one successful login, five binaries arrived in the same second. Same payload, compiled for ARM, i386, ARM64, x86-64 and RISC-V, because the attacker has no idea what hardware the credentials will open.
They uploaded the same miner five times. One per CPU.
One password guessed, one login, and five files land on the machine within the same second. At first it looks like five different payloads. It is one payload, five times over.
Ask the files what they are and strip everything but the architecture. Thirty two bit ARM. Intel. ARM sixty four. x86 sixty four. And RISC five, which almost nobody runs in production yet. Nine megabytes in total, because whoever built this has no idea what the stolen credentials will open. A router, a Raspberry Pi, a cloud server, a development board.
That is the mindset to take away. The attack is not aimed at your server. It is aimed at every server, and yours simply answered.
If it has a CPU and a weak password, it is a target.
#linux#security#malware#embedded#sysadmin
❯ If it has a CPU and a weak password, it is a target.