U.S. v. Maxim Senakh (Ebury Linux SSH Rootkit & Botnet)
Key Facts
- Legal Status: SENTENCED in U.S. District Court for the District of Minnesota.
- Primary Target Sector: Internet Infrastructure & Web Hosting.
- Documented Financial Loss: $10.0 million.
- 2 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Russian national arrested in Finland, extradited to the United States, and sentenced to 46 months imprisonment in federal court for operating the Ebury botnet, which infected over 25,000 Linux enterprise web servers with a stealth OpenSSH backdoor to harvest system credentials and divert web traffic.
Root Cause & Infiltration Vector
Initial access established against Internet Infrastructure & Web Hosting infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Russian national arrested in Finland, extradited to the United States, and sentenced to 46 months imprisonment in federal court for operating the Ebury botnet, which infected over 25,000 Linux enterprise web servers with a stealth OpenSSH backdoor to harvest system credentials and divert web traffic.
Operational Impact & Financial Blast Radius
Resulted in $10,000,000 in documented financial liabilities. Extensive commercial hosting disruptions and millions of dollars in fraudulent spam generation.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Ebury replaced the system OpenSSH key verification binary and shared libraries to intercept plaintext passwords and private SSH keys during legitimate user authentication.
Operated an automated keylogging routine that captured outbound and inbound SSH session credentials and exfiltrated them via custom UDP datagrams.
Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Internet Infrastructure & Web Hosting infrastructure.
Russian national arrested in Finland, extradited to the United States, and sentenced to 46 months imprisonment in federal court for operating the Ebury botnet, which infected over 25,000 Linux enterprise web servers with a stealth OpenSSH backdoor to harvest system credentials and divert web traffic.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
D. Minn. grand jury indicts Senakh under seal on wire fraud and computer crime counts.
Finnish authorities arrest Senakh at Russian border crossing pursuant to U.S. Interpol red notice.
Senakh sentenced to 46 months federal prison after pleading guilty in Minneapolis.
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1574.002 | DLL Side-Loading Persistence | "Ebury replaced the system OpenSSH key verification binary and shared libraries to intercept plaintext passwords and private SSH keys during legitimate user authentication." | Plea Agreement ¶ 4, Page 3 | reviewed |
| T1056.001 | Keylogging Credential Access | "Operated an automated keylogging routine that captured outbound and inbound SSH session credentials and exfiltrated them via custom UDP datagrams." | Plea Agreement ¶ 7, Page 5 | reviewed |