Campaign comparison

The Backdoor Key That Puts Itself Back vs Skynet Lost the War in 2013. Its Malware Still Doesn't Know It.

2026-09-02  ·  2026-08-29

Link signals

Analytic Same stage(s) reached by different techniques: initial-access, credential-access, defense-evasion — same objective, different method
Commodity Shared ATT&CK technique(s): T1496 — commodity, many actors share these

Actor & objective

Actor unattributed vs unattributed different
Objective credential harvesting (Jenkins secrets, cloud credentials, SSH keys), banked for later use or resale rather than used immediately, plus opportunistic cryptomining once the initial access is established vs financial: banking credential theft (ZeuS core) and cryptocurrency mining, with a persistent per-victim Tor backdoor for remote access different

Kill chain

= same stage & technique   ≠ same stage, different technique   • unique to one campaign

The Backdoor Key That Puts Itself Back

  1. divergent step: 1. initial-access · T1190
    unauthenticated Jenkins Script Console reachable from the internet; Groovy code execution as the Jenkins user, no exploit required
  2. unique step: 2. discovery · T1082
    host profiling (id, nproc, uname, free) before any deployment decision
  3. unique step: 3. discovery · T1083
    checked for aws/kubectl tooling to gauge cloud and Kubernetes access before deploying anything
  4. divergent step: 4. credential-access · T1555
    in a three-second window, read credentials.xml plus both keys that decrypt it (secrets/master.key, secrets/hudson.util.Secret), the complete set needed to decrypt the whole store offline
  5. divergent step: 5. credential-access · T1552.004
    read /root/.ssh/id_rsa and id_ed25519 (private key material); neither key was ever presented back to any sensor afterward
  6. divergent step: 6. credential-access · T1552.001
    read /root/.aws/credentials
  7. unique step: 7. persistence · T1098.004
    SSH public key spliced into the middle of authorized_keys (not appended), execute bit set as a side effect
  8. unique step: 8. persistence · T1053.006
    systemd timer re-checks and re-adds the key every 5 minutes, 2 minutes after every reboot
  9. divergent step: 9. defense-evasion · T1036.005
    backdoor script disguised as an apt update checker; genuinely runs apt-get -s upgrade so the disguise produces real, plausible log output
  10. divergent step: 10. credential-access · T1550.001
    used the stolen AWS keys to call sts get-caller-identity and request a federation token, escalating from programmatic keys toward console access
  11. shared step: 11. impact · T1496
    XMRig cryptominer, CPU-throttled to the exact core count profiled earlier, pool connection pinned into /etc/hosts to survive DNS-based blocking
  12. divergent step: 12. defense-evasion · T1562.001
    kills seven competing cryptojacking families on arrival

Skynet Lost the War in 2013. Its Malware Still Doesn't Know It.

  1. divergent step: 1. initial-access · T1204.002
    fake lossless-audio release on Usenet; unpacks to an executable and a 58MB random-filler blob, no media content
  2. divergent step: 2. defense-evasion · T1027.002
    3.7MB code section, 13% real code, 87% random filler/zero padding, 1,684 opaque predicates
  3. divergent step: 3. defense-evasion · T1027.007
    import table declares only C-runtime housekeeping; functions resolved at runtime by manually walking the PEB and parsing export tables
  4. divergent step: 4. defense-evasion · T1497.003
    ~483 billion computed instructions (3-8 min CPU-saturated stall) before any file/registry/network activity, outlasting default sandbox timeouts
  5. unique step: 5. execution · T1055.012
    svchost.exe started suspended, written to, resumed: manually mapped image with no OS record of the module
  6. divergent step: 6. credential-access · T1056.004
    ntdll.dll remapped writable in every injected process; read as ZeuS installing its own form-grabbing hooks, not anti-EDR unhooking
  7. unique step: 7. command-and-control · T1090.003
    IRC C2 over Tor v2 hidden services; per-victim inbound hidden service on non-standard port 55080
  8. shared step: 8. impact · T1496
    CGMiner GPU mining, idle-gated (starts after 2 minutes without user input, stops on touch)

Side by side

green = shared by both campaigns.

Attribute-by-attribute comparison of The Backdoor Key That Puts Itself Back and Skynet Lost the War in 2013. Its Malware Still Doesn't Know It.. Values labelled "shared" appear in both campaigns.
The Backdoor Key That Puts Itself Back Skynet Lost the War in 2013. Its Malware Still Doesn't Know It.
Procedures
competing-miner-killcredential-store-full-decrypt-key-theftdns-containment-evasion-etc-hostsmasquerade-as-update-checkermid-file-key-insertionsystemd-timer-self-healmanual-PEB-walk-api-resolutionntdll-writable-form-grab-hooksopaque-predicate-bloatprocess-hollowing:svchost.exesandbox-timer-stall
Toolmarks
HUNTER_JK_OK_ / HUNTER_VERIFY_ tool markersWO<n>_RCE_OK / WO<n>_VERIFY_OK job markershost-monitor@main SSH key commentnet-maint-keepalive cron markerupdate-check.* masquerading unit names1,684 opaque predicates over 87% paddingPEB-walk API resolution instead of import tablentdll.dll made writable for form-grabbing hookssvchost.exe process hollowing~483B-instruction sandbox-timer stall
C2 protocol
none: all commands arrived inbound as POST requests to the unauthenticated Jenkins Script Console, 855 of them; no outbound C2 channel was ever establishedIRC over Tor v2 hidden services (30 addresses); per-victim inbound Tor hidden service on port 55080. All defunct since Tor removed v2 in October 2021
Tooling
groovy-script-console-abusesystemd-timer-persistencexmrigcgminertorzeus
Capabilities
XMRig cryptomining with CPU throttling and DNS-block evasioncloud credential harvesting and AWS API escalation attemptsfull Jenkins credential-store decryption key theftself-healing SSH backdoor (systemd timer re-adds a planted key every 5 minutes)GPU cryptocurrency mining (CGMiner)SOCKS4/SOCKS5 proxying and denial of service, driven over IRCbanking credential theft (ZeuS core, form grabbing via ntdll hooking)per-victim Tor hidden service for inbound remote access
C2
163.192.1.64 (second address, fetches tooling from the staging server)213.171.5.66 (staging server, serves /cdn/ payloads)28 additional Tor v2 addresses, full list published in the briefqdzjxwujdtxrjkrz.onion (ZeuS configuration server, port 80)uy5t7cus7dptkchs.onion (primary IRC C2, port 16667)
ASNs
AS31898 (Oracle Cloud, second address)AS9123 (Timeweb, staging server)—
Domains
gulf.moneroocean[.]stream (mining pool, pinned into /etc/hosts to survive DNS-based blocking)—
Products
Jenkins—
Sectors
—consumer

← Compare a different pair