Infamy is a paradoxical calling for cyber-criminals. While for some, bragging rights are a motivation for cyber-crime in and of themselves, notoriety is usually not a sensible goal for those hoping to avoid detection. This is what threat actors behind the prolific Emotet botnet learned earlier in 2021, for instance, when a coordinated effort was launched by eight national law enforcement agencies to take down their operation. There are, however, certain names which appear again and again in cyber security media and consistently avoid detection – names like Outlaw.
How Outlaw plans an ambush
Despite being active since 2018, very little is known about the hacking group Outlaw, which has staged numerous botnet and crypto-jacking attacks in China and internationally. The group is recognized by a variety of calling cards, be they repeated filenames or a tendency to illicitly mine Monero cryptocurrency, but its success ultimately lies in its tendency to adapt and evolve during months of dormancy between attacks.
Outlaw’s attacks are marked by constant changes and updates, which they work on in relative silence, before targeting security systems which are too-often defeated by the unfamiliarity of the threat.
In 2020, Outlaw gained attention when they updated their botnet toolset to find and eradicate other criminals’ crypto-jacking software, maximizing their own payout from infected devices. While it might come as no surprise that there’s no honor among cyber-thieves, this update also implemented more troubling changes which allowed Outlaw’s malware to evade traditional security defenses.
By switching disguises between each big robbery, and laying low with the loot, Outlaw ensures that traditional security systems which rely on historical attack data will never be ready for them, no matter how much notoriety is attached to their name. When organizations move beyond these systems’ rules-based approaches, however, adopting Self-Learning AI to protect their digital estates, they can begin to turn the tables on groups like Outlaw.
This blog explores how two pre-infected zombie devices in two very different parts of the world were activated by Outlaw’s botnet in the summer of 2021, and how Darktrace was able to detect the activity despite the devices being pre-infected.
Bounty hunting: First signs of attack
Figure 1: Timeline of the attack.
When a new device was added to the network of a Central American telecomms company in July, Darktrace detected a series of regular connections to two suspicious endpoints which it identified as beaconing behavior. The same behavior was noticed independently, but almost simultaneously, at a financial company in the APAC region, which was implementing Darktrace for the first time. Darktrace’s Self-Learning AI was able to identify the pre-infected devices by clustering similarly-behaving devices into peer groups within the local digital estates and therefore recognize that both were acting unusually based on a range of behaviors.
The first sign that the zombie devices had been activated by Outlaw was the initiation of cryptocurrency mining. Both devices, despite their geographical distance, were discovered to be connected to a single crypto-account, exemplifying the indiscriminate and exponential nature by which a botnet grows.
Outlaw has in the past restricted its activities to devices within China in what was assumed to be a show of caution, but recent activities like this one speak to a growing confidence.
The botnet recruitment process
The subsequent initiation of Internet Relay Chat (IRC) connections across port 443, a port more often associated with HTTPS activity, was perfectly characteristic of the Outlaw botnet’s earlier activity in 2020. IRC is a tool regularly used for communication between botmasters and zombie devices, but by using port 443 the attacker was attempting to blend into normal Internet traffic.
Soon after this exchange, the devices downloaded a shell script. Darktrace’s Cyber AI Analyst was able to intercept and recreate this shell script as it passed through the network, revealing its full function. Intriguingly, the script identified and excluded devices utilizing ARM architecture from the botnet. Due to its notably low battery consumption, ARM architecture is used primarily by portable mobile devices.
This selectivity is evidence that malicious crypto-mining remains Outlaw’s primary objective. By circumventing smaller devices which offer limited crypto-mining capabilities, this shell script focuses the botnet on the most high-powered, and therefore profitable, devices, such as desktop computers and servers. In this way, it reduces the Indicators of Compromise (IOCs) left behind by the wider botnet without greatly affecting the scale of its crypto-mining operation.
The two devices in question did not employ ARM architecture, and minutes later received a secondary payload containing a file named dota3[.]tar[.]gz, a sequel of sorts to the previous incarnation of the Outlaw botnet, ‘dota2’, which itself referenced a popular video game of the same name. With the arrival of this file, the devices appear to have been updated with the latest version of Outlaw’s world-spanning botnet.
This download was made possible in part by the attacker’s use of ‘Living off the Land’ tactics. By using only common Linux programs already present on the devices (‘curl’ and ‘Wget’ respectively), Outlaw had avoided having its activity flagged by traditional security systems. Wget, for instance, is ostensibly a reputable program used for retrieving content from web servers, and was never previously recorded as part of Outlaw’s TTPs (Tactics, Techniques, and Procedures).
By evolving and adapting its approach, Outlaw is continually able to outsmart and outrun rules-based security. Darktrace’s Self-Learning AI, however, kept pace, immediately identifying this Wget connection as suspicious and advising further investigation.
Figure 2: Cyber AI Analyst identifies Wget use on the morning of July 15 as suspicious and begins investigating potentially related HTTP connections made on the morning of July 14. In this way, it builds a complete picture of the attack.
The botnet unchained
In the following 36 hours, Darktrace detected over 6 million TCP and SSH connections directed to rare external IP addresses using ports often associated with SSH, such as 22, 2222, and 2022.
Exactly what the botnet was undertaking with these connections can only be speculated on. The devices may have been made part of a DDoS (Distributed Denial of Service) attack, bruteforce attempts on targeted SSH accounts, or simply have taken up the task of seeking and infecting new targets, further expanding the botnet. Darktrace recognized that neither device had made SSH connections prior to this event and, had Antigena been in active mode, would have enacted measures to stop them.
Figure 3: The behavior on the device before and after the bot was activated on July 14, 2021. The large spike in model breaches shows clear deviation from the established ‘pattern of life’.
Thankfully, the owners of both devices responded to Darktrace’s detection alerts soon enough to prevent any serious damage to their own digital estates. Had these devices remained under the influence of the botnet, the ramifications may have been far graver.
The use of SSH protocol would have allowed Outlaw to pivot into any number of activities, potentially compromising each device’s network further and causing data or monetary loss to their respective organizations.
Call the sheriff: Self-Learning AI
Rules-based security solutions operate much like the ‘wanted’ posters of the old west, looking out for the criminals who came through town last week without preparing for those riding over the hill today. When black hats and outlaws are adopting new looks and employing new techniques with every attack, a new way of responding to threats is needed.
Darktrace doesn’t need to know the name ‘Outlaw’, or the group’s history of evolving attacks, in order to stop them. With its fundamental self-learning approach, Darktrace learns its surroundings from the ground up, and identifies subtle deviations indicative of a cyber-threat. And with Autonomous Response, it will even take targeted action to neutralize the threat at machine speed, without the need for human intervention.
Thanks to Darktrace analyst Jun Qi Wong for his insights on the above threat find.
Learn more about how Cyber AI Analyst sheds light on complex attacks
Technical details
Darktrace model detections
- Compliance / Crypto Currency Mining Activity
- Compromise / High Priority Crypto Currency Mining [Enhanced Monitoring]
- Anomalous Connection / New User Agent to IP Without Hostname
- Anomalous File / Zip or Gzip from Rare External Location
- Anomalous Connection / Application Protocol on Uncommon Port
- Device / Increased External Connectivity
- Unusual Activity / Unusual External Activity
- Compromise / SSH Beacon
- Compromise / High Frequency SSH Beacon
- Anomalous Connection / Multiple Connections to New External TCP Port
![Model alert in Darktrace / NETWORK showing the repeated SSL connections to a rare external Self-Signed endpoint, 185.49.126[.]50.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823ad5f8454ff831da3182a_Screenshot%202025-05-13%20at%201.35.56%E2%80%AFPM.avif)
![Darktrace’s detection of repeated connections to the suspicious IP address 185.49.126[.]50 over port 6606, indicative of beaconing behavior.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823adc5ac5c997938babf30_Screenshot%202025-05-13%20at%201.38.15%E2%80%AFPM.avif)
![Darktrace's Autonomous Response actions blocking the suspicious IP address,185.49.126[.]50.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6825268603a7a2b1459c9fea_Figure%204.avif)
![Darktrace’s detection of connections to the suspicious endpoint 195.26.255[.]81, where the default ports (6606, 7707, and 8808) for AsyncRAT were observed.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823ae6e325a742b23ef6e6d_Screenshot%202025-05-13%20at%201.41.09%E2%80%AFPM.avif)
![Darktrace's detection of a connection to the suspicious IP address 195.26.255[.]81 and the domain name identified under the common name (CN) of a certificate as AsyncRAT Server](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823aea233fc6374c1432604_Screenshot%202025-05-13%20at%201.42.00%E2%80%AFPM.avif)
![Darktrace’s Autonomous Response applied a total of nine actions against the IP address 191.96.207[.]246 and the domain 'kashuub[.]com', successfully blocking the connections.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823af1b3cbc7734f47fc15b_Screenshot%202025-05-13%20at%201.43.56%E2%80%AFPM.avif)
