As cited
Copy frozen at (site build).
threat intel
22 Seconds to Compromise: How Automated SSH Actors Move From Login to Persistence Before You Can Blink [Guest Diary]
On May 23, 2026, an automated SSH attack compromised a Cowrie honeypot within 22 seconds of login, injecting a backdoor SSH key, changing the root password, and clearing access restrictions before performing reconnaissance. Over 30 days of monitoring, the honeypot captured 112,000 SSH sessions and 72,000 authentication attempts from 175 unique malicious IPs, with coordinated waves of attacks using compromised credentials from past breaches. The attack patterns reveal pre-scripted playbooks executing immediately upon successful authentication, with the same attacker returning multiple times using identical command sequences and timing.
Why it matters: Security practitioners need to detect and respond to automated post-exploitation behavior within minutes: weak credential reuse, rapid system hardening actions, and persistent backdoor installation all pose immediate risk to any internet-facing SSH service, whether the target is production systems or honeypots revealing active campaign infrastructure.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
22 Seconds to Compromise: How Automated SSH Actors Move From Login to Persistence Before You Can Blink [Guest Diary]
A Cowrie SSH honeypot detected a threat actor gaining access with compromised credentials and executing a complete automated post-exploitation sequence in 22 seconds: SSH key injection, password change, access restriction removal, and reconnaissance. Over a 30-day monitoring period from April through May 2026, the sensor captured over 112,000 SSH sessions from 175+ unique malicious IPs, with 21 successful logins on May 23, 2026 alone, indicating coordinated wave-based scanning using common compromised credentials from past breaches. The consistent timing and identical command execution across multiple reconnections confirm automated tooling rather than manual attack activity.
Why it matters: SSH administrators and defenders must implement credential rotation, SSH key management, multi-factor authentication, and network segmentation to block rapid post-exploitation automation that establishes persistence before manual detection is possible; honeypots like this reveal that attacks now operate on subsecond timescales.
- Source published
- First seen by Cybersecurity Tracker