DDoS-for-hire botnet recruitment: conscripts the host as an on-demand flooding zombie, not data theft. The lockdown behavior exists to keep the machine exclusively under the operator's control.

The DDoS Zombie That Won't Let Go

A device we operate, presenting as a Jenkins build server, was broken into twice through its unauthenticated Script Console. Both times the operator dropped a Mirai-derived DDoS bot that locks the machine down first: it kills SSH/Telnet, zeroes permissions on every download tool, poisons /etc/hosts against AV vendors, kills analysis tools on launch, and wipes the logs — so the box stops behaving like one you own before it ever floods a target. Full kill chain, IOCs, and defensive checks inside.