called Haiduc (detected by Trend Micro as Hacktool.Linux.SSHBRUTE.A), which translates
to "An Outlaw," that was not seen before. It is, however, found for download on the
website, arhivecodex[.]tk, which also hosts speed.py, the script for a performance check
related to a Monero mining rig.
Figure 6. Screenshot of the website's front page
The hacking tool was tested to scan the C&C servers while monitoring the traffic. It simply
brute forced the SSH for credentials using the given wordlist, which was also captured
from the hackers (the group which we named “Outlaw”). We tested whether this is some
trap for script kiddies, but Haiduc did only what it was supposed to do — brute force the
SSH credentials with the list of targets and wordlist. According to the content of the
"Classes" directory (discussed later in this document), the tool is ready to be used for
cyberattacks against listed companies, either to perform DDoS attacks or brute force the
SSH service credentials on the target’s server, with a randomized order of the scanned IP
addresses to make the detection more difficult.
We discussed the Haiduc kit toolset in the blog, including the ways hackers used it. Here,
we discuss its toolset with the bash wrappers, including so-called "Class files". Each class