Family
DIICOT
SSH cryptojacking documented since 2021. Two generations landed on the decoy back to back, and between one and the other the whole programme changed.
DIICOT —also known as Mexals— is a veteran cryptojacking operation, documented since 2021 by Bitdefender and later by Akamai, Cado, Darktrace and Wiz. The name is the author’s own joke: it’s borrowed from a Romanian organised-crime agency. Its routine is textbook: brute-force in over SSH, evict the competition, install a Monero miner and hide it.
Two generations landed on the decoy, and they’re worth keeping apart.
The classic one —chapters 23 to 25— is the one documented for years. It hides the miner with a line in .bashrc that makes the top command lie, and it carries the wallet inside the binary, covered with toy encryption. Which is why with this one the money can be followed down to the last payout.
The 2026 build —chapters 26 to 28— changed programme entirely. Command stopped being client-server and became a peer-to-peer mesh that elects a leader, with the orders arriving over a Telegram chat; the binaries are obfuscated and packed; and the wallet no longer travels inside: it gets downloaded at start-up, from a server that dies when the campaign dies. The same family, with every door closed.
- 23
The command that lies
I left a password sitting on a decoy and, one Sunday, something came through it three times. I neutralised what it brought; what I didn't see until later was what it left planted — a line in .bashrc that makes «top» lie and hide the very process eating the machine. A rootkit without a rootkit. And putting two frozen disks side by side turned up the detail that changes everything: the same line, with a different number.
DIICOT
2026-09 - 24
The line nobody wrote
The previous chapter left a number unexplained: the backdoor was deleting a different process on every installation, and that can't be known in advance. I open the miner and the answer shows up — a template with the gap already reserved. Along the way out comes the wallet the money goes to, behind encryption that's frankly laughable.
DIICOT
2026-09 - 25
Twenty-odd dollars a day
The teardown left me a Monero wallet and a question the binary doesn't answer: how much has this thing earned. Monero is built so no balance can be looked up — but the pool they mine against publishes per-wallet statistics, and that's an open page. What turned up when I asked: one wallet collecting since January 2021, another already running months before it showed up in any sample, about twenty-three dollars a day, and an electricity bill paid by the victims that comes to more than the operator makes.
DIICOT
2026-09 - 26
Sixty-six seconds
The family from the previous chapter didn't stand still: there's a newer build going around, and I caught it from the first second. It brute-forces its way in over SSH, sizes the machine up, evicts the competition —its own older version included—, uploads sixteen megabytes in a single file and fires. All in a little over a minute. And then it walks straight into one line of fstab.
DIICOT
2026-09 - 27
Only the leader talks
The kit sat still on the disk, so I switched it on myself in a cage with no way out. Inside there's a bot that insists on knowing its own address before anything else, joins a mesh of up to two thousand nodes, holds an election and crowns itself leader — and only then opens a Telegram chat. The operator never logs into any machine: he sends a message to the head of the pack. And when you burn the chat, the botnet heals itself.
DIICOT
2026-09 - 28
The wallet that never travels
The two previous chapters left the kit taken apart piece by piece, and one question unanswered: who it pays. I went looking. And what I found was a design that prevents it — the mining config never travels inside the critter, it gets downloaded afterwards — and scaffolding somebody had already dismantled. This is the chase, what it does plant when you let it run, and how far what I can prove about who's behind it actually goes.
DIICOT
2026-09