The DDoS Zombie That Won't Let Go
A device we operate, presenting as a Jenkins build server, was broken into twice through its unauthenticated Script Console. Both times the operator dropped a Mirai-derived DDoS bot that locks the machine down first: it kills SSH/Telnet, zeroes permissions on every download tool, poisons /etc/hosts against AV vendors, kills analysis tools on launch, and wipes the logs — so the box stops behaving like one you own before it ever floods a target. Full kill chain, IOCs, and defensive checks inside.