threat-intel
[Guest Diary] New Malware Libraries means New Signatures, (Fri, May 15th)
Medium
Summary
This SANS Internet Storm Center diary details a new observation of the long-running mdrfckr campaign, a Shellbot associated with the Outlaw/Dota group. The key finding is the identification of a previously undocumented version of the libssh SSH client (0.11.x) being utilized by the campaign between April 14th and April 21st, 2026. This update highlights the importance of continuously monitoring and adapting detection rules to account for evolving campaign tactics and client versions.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data