One command, 3.6 seconds — and all five stages were in it

Yesterday an intruder stayed on our server for 3.6 seconds.

It was exactly one command. And inside that one line were: looking around, downloading a file, granting execute permission, running it, and planting a key. Which is to say a burglar opened the door, walked in, looked over the house, pulled out the tools, copied the back-door key, and left — in 3.6 seconds.

But this time it wasn’t Telnet

FACT Of yesterday’s top 5 sessions by completeness, 3 were SSH.

Why that stands out: on August 16, 17, and 18 — three days in a row — the completed sessions were all Telnet. On the fourth day that pattern broke.

Telnet is an old protocol. The devices that still have it open are mostly things like aging routers and IP cameras. So a shift to SSH may mean the targets the attacker is looking at have changed.

What happened in those 3.6 seconds

FACT ATK-CA5936 (130.12.x.x) logged in over SSH successfully. The session ran 3.61 seconds, with 1 command executed. Yet the observed intents numbered 5.

1. Reconnaissance — looking around the system
2. File download
3. Granting execute permission
4. Running the downloaded file
5. Persistence — planting an SSH key

That last item matters. Once an SSH key is planted, they can get back in even if you change the password. They leave behind a key that keeps working after you change the lock.

Laying yesterday’s observed completed sessions out in chronological order:

1. 00:07:51Z ~ 00:07:55Z
   FACT ATK-CA5936 SSH login succeeded. 3.61s · 1 command · 2 downloads · 5 intents
2. 00:54:44Z ~ 00:55:24Z
   FACT ATK-C146AD Telnet login succeeded. 40.80s · 16 commands · 3 downloads
3. 13:17:20Z ~ 13:18:22Z
   FACT ATK-103570 Telnet login succeeded. 61.75s · 17 commands · 0 downloads
4. 13:35:11Z ~ 13:35:15Z
   FACT ATK-CA5936 reappears. 13 hours 27 minutes later, the numbers are exactly identical to the first session

That last line catches the eye. The same alias came back 13 hours and 27 minutes later and repeated nearly the same behavior down to the second. That means a script, not a person.

How they got in — the password

FACT Yesterday there were 975 login attempts over the day. Narrowing to only the combinations observed from 3 or more distinct IPs, this is what comes out.

This one combination was tried from 19 different places. They didn’t break through some special vulnerability. They just knocked on the door. And it opened.

If the admin password on the router, IP camera, or NAS you’re using right now is still the factory default — there’s a good chance what happened on our server yesterday is happening on yours too.

What they left behind

FACT Three sessions left behind a 399-byte OpenSSH private key file. It was observed 3 times.

What’s interesting is that compared with the 389-byte “public key” observed over the previous three days, the hash is different and so is the type. Either it’s a different campaign using the same tool, or the same campaign changed tools — one of the two. INFERRED Which one it is cannot be distinguished with the data we have now.

Mapped to attack stages

Mapping the observed behavior to MITRE ATT&CK techniques gives this. All of it is [INFERRED] — what we saw is behavior, not the attacker’s intent.

• T1110.001Brute Force: Password GuessingINFERRED
• T1078Valid AccountsINFERRED
• T1059.004Command and Scripting Interpreter: Unix ShellINFERRED
• T1082System Information DiscoveryINFERRED
• T1016System Network Configuration DiscoveryINFERRED
• T1105Ingress Tool TransferINFERRED

If this looks familiar, it should

INFERRED The structure matches the Mirai botnet family that has run since 2016.

The method: get in with default credentials, then pull down per-CPU-architecture binaries from a specific path on a web server and run only the one that fits. The filename conventions observed yesterday also followed that family’s habits.

Mirai is a case with a US Department of Justice indictment on record, and there are published analysis reports from several vendors. That the same technique still works ten years later is the heart of this story.

All of yesterday

All 1,333 commands were executed after a successful login.

The 30-second version

We also made a short video of the same observation set.

What we don’t know

This blog writes with a line between what it knows and what it doesn’t. Here is what could not be confirmed from yesterday’s observations.

• Whether that one command really contained 5 actions. The intents were classified into 5 types, but the raw command text and the TTY replay are not in the brief, so we could not verify it directly. It appears to be several actions chained together, but we do not assert that.
• The attacker’s ASN, ISP, or nationality. We do not have GeoIP or ASN databases. We do not speculate.
• The source URL of the downloaded file. It was not recorded for this one.
• Whether these 3 cases are the same group. Matching fingerprints and being the same person are two different things.

This post is based on the 2026-08-19 honeypot observation set. IPs are masked, and quoted credentials include only those observed from 3 or more distinct IPs.