Security posture report - June 2026

OCNET group

The OCNET group has been active since late May, launching multiple large-scale SSH brute-force attacks. After gaining access to a host by using a weak password, the group implants a mining program and various persistence backdoors, including SSH public key backdoors and hidden backdoor files.

Compared to previous brute-force groups, OCNET is distinguished by its strong persistence capabilities. It ensures long-term control over compromised hosts by implanting SSH public key backdoors, continuously reactivating existing backdoors, and deploying new ones. The group is also notably active in DDoS attacks, frequently deploying DDoS backdoors and launching attacks.

Tactics

1. Initial Access: Uses automated tools to launch weak password brute-force attacks against public-facing SSH services to gain host login credentials.

2. Persistence: Writes an SSH public key to ~/.ssh/authorized_keys, deploys multiple hidden backdoor files, and maintains long-term control by periodically reactivating existing backdoors and deploying new ones.

3. Payload delivery: Downloads and executes a mining program and a DDoS attack backdoor, which can dynamically switch between mining and DDoS modes based on commands.

4. Lateral movement: Uses compromised hosts as pivot points to continue scanning and brute-forcing other targets in the same network segment or other networks, expanding the botnet.

Typical IOCs

ocnet@goat666.xyz
cnet.goat666.xyz
google.kasin.xyz
fa83031a6964319843f67713fdd56b80
0e94a61a1690e53cf211dbc6163c75b5
138ba58259d3c64b34a2b9c5d0b8b178
e49c610315ff35dca6729fda138553d5
72b1b3948704c886233ad5b7d43d7a6d
329de3d499fae917826818b9a86a1387

OUTLAW group

OUTLAW is another active group that primarily uses SSH brute-force attacks. In June, it continued to attack cloud tenants' hosts. This group mainly gains access through SSH weak passwords, then downloads a malicious archive, such as dota3.tar.gz, to deploy its mining payload. The attack process is relatively direct, and it also demonstrates some persistence capabilities.

Tactics

1. Initial Access: Gains host login credentials through an SSH weak password brute-force attack.

2. Payload delivery: After logging in, directly downloads a malicious archive, such as dota3.tar.gz, and executes the built-in mining program after decompression.

3. Basic persistence: Uses conventional methods, such as SSH public keys and scheduled tasks, to keep the mining process running. No advanced persistence backdoors have been found.

4. Resource Consumption: Primarily focuses on a single mining payload, continuously occupying host computing resources.

Typical IOCs

dota3.tar.gz
a803de211bbdc0dfae46c5e2af7b2591
01a3ca860b8d0dc45c339d121a8dd44a
1c8a4f64d73112bcda7018741b53e4d9
08b13458bc0ae06e5b6c6d1e791ea38a

Security recommendations

1. Harden SSH authentication: Replace all weak passwords with strong passwords that are at least 12 characters long and contain a mix of uppercase letters, lowercase letters, numbers, and special characters. Disable direct root login via SSH; use a standard user account and elevate privileges with sudo. Prioritize SSH key-pair authentication over passwords, and disable password authentication by setting PasswordAuthentication no in /etc/ssh/sshd_config.

2. Reduce the attack surface: Avoid exposing port 22 to the public internet unless necessary. If it must be exposed, configure your security group to allowlist only trusted source IP addresses, or control access through a VPN or a bastion host.

3. Remediate infected hosts: If your host has been compromised by a botnet backdoor, refer to the ECS-Exclusive Free Security Protection Benefits documentation. In Cloud Security Center, go to Protection Configuration > Virus Scan to perform a deep scan. This action will automatically remove malicious programs, backdoor files, unauthorized SSH public keys, and persistence startup items.

Tactics

Attackers primarily gain initial access through the following three paths:

• Web application vulnerability scanning: Attackers automatically scan public-facing web business systems, such as ERP, OA, and logistics platforms. They exploit known remote code execution (RCE), deserialization, or unauthorized access vulnerabilities at the HTTP/HTTPS layer to directly implant ransomware.

• RDP weak password brute-force: Attackers probe for public-facing RDP services (port 3389) and use weak password brute-force or credential stuffing to gain remote desktop control.

• Private protocol port exploitation: Attackers target non-standard TCP ports, such as 211/TCP used by enterprise management software like GuanJiaPo. They exploit unauthorized access flaws in the private binary protocol to directly execute system-level commands.

The first two methods remain the most common due to their wide attack surface and low barrier to entry. Although the third method is less common, its stealthiness and evasiveness make it an increasingly popular supplementary path for some ransomware families.

Frequently scanned applications

The following applications were among the most frequently targeted in ransomware-related scanning attacks in June. Attackers primarily exploited their historical vulnerabilities (SQL injection, arbitrary file upload, RCE), unauthorized access interfaces, or default weak passwords as entry points:

• Chanjet T+ ERP system

• TOMS logistics management system

• Yonyou NC Cloud / U+ series

• GuanJiaPo management software series

• Kingdee K/3 Cloud

Security recommendations

If you have deployed any of the applications listed above, take the following hardening measures immediately:

1. Reduce internet exposure: Avoid directly exposing management consoles, API interfaces, databases, and private protocol ports to the public internet. In security group inbound rules, avoid using 0.0.0.0/0. Instead, restrict access to trusted source IPs or use a VPN or bastion host for access control.

2. Patch application vulnerabilities or upgrade to a secure version: Immediately check for security bulletins from vendors like Chanjet, Yonyou, Kingdee, and GuanJiaPo. Prioritize patching high-risk vulnerabilities such as RCE, deserialization, and unauthorized access. For systems that cannot be upgraded immediately, follow Recommendation 1 to reduce their exposure.

Alibaba Cloud has sent security alerts to some users who may be at risk of ransomware attacks. If you have received such an alert, please follow the instructions to take immediate action. If you have any questions, submit a security ticket for assistance.

Nezha Monitoring vulnerabilities (Nezha Probe)

Nezha Monitoring (Nezha Probe) is a widely used open-source server monitoring tool. In May-June 2026, seven security vulnerabilities were disclosed that can be chained to create a complete attack path from initial access to full control. A large number of victim servers have been compromised with the gary@gary SSH backdoor public key, mining programs, and DDoS tools.

Affected versions: < v2.0.14 | Patched versions: ≥ v2.0.14

If you are using Nezha Monitoring, perform the following checks as soon as possible:

1. Upgrade to v2.0.14 or later. After upgrading, check for any unauthorized SSH keys (especially gary@gary), unknown scheduled tasks, and unexpected administrator accounts.

2. Avoid exposing the management port (usually 8008) directly to the public internet. Use a security group to restrict access to trusted IPs only.