{
  "id": "case-senakh-ebury-linux-botnet",
  "slug": "us-v-senakh-ebury-linux-botnet",
  "title": "U.S. v. Maxim Senakh (Ebury Linux SSH Rootkit & Botnet)",
  "summary": "Russian national arrested in Finland, extradited to the United States, and sentenced to 46 months imprisonment in federal court for operating the Ebury botnet, which infected over 25,000 Linux enterprise web servers with a stealth OpenSSH backdoor to harvest system credentials and divert web traffic.",
  "case_number": "0:15-cr-00023",
  "court": "U.S. District Court for the District of Minnesota",
  "district": "D. Minn.",
  "country": "United States",
  "opened_at": "2015-01-13",
  "status": "sentenced",
  "victim_sector": "Internet Infrastructure & Web Hosting",
  "victim_country": "United States",
  "loss_amount_usd": 10000000,
  "loss_amount_note": "Extensive commercial hosting disruptions and millions of dollars in fraudulent spam generation.",
  "first_seen_at": "2011-02-01T00:00:00Z",
  "last_updated_at": "2026-10-18T10:00:00Z",
  "actor_slug": "evil-corp",
  "defendant_slugs": [],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1574.002",
      "evidence_excerpt": "Ebury replaced the system OpenSSH key verification binary and shared libraries to intercept plaintext passwords and private SSH keys during legitimate user authentication.",
      "evidence_locator": "Plea Agreement \u00b6 4, Page 3",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Plea Agreement: U.S. v. Maxim Senakh",
      "source_url": "https://www.justice.gov",
      "technique_name": "DLL Side-Loading",
      "tactic": "Persistence"
    },
    {
      "technique_id": "T1056.001",
      "evidence_excerpt": "Operated an automated keylogging routine that captured outbound and inbound SSH session credentials and exfiltrated them via custom UDP datagrams.",
      "evidence_locator": "Plea Agreement \u00b6 7, Page 5",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Plea Agreement: U.S. v. Maxim Senakh",
      "source_url": "https://www.justice.gov",
      "technique_name": "Keylogging",
      "tactic": "Credential Access"
    }
  ],
  "events": [
    {
      "event_type": "indictment",
      "event_date": "2015-01-13",
      "description": "D. Minn. grand jury indicts Senakh under seal on wire fraud and computer crime counts."
    },
    {
      "event_type": "arrest",
      "event_date": "2015-08-08",
      "description": "Finnish authorities arrest Senakh at Russian border crossing pursuant to U.S. Interpol red notice."
    },
    {
      "event_type": "sentencing",
      "event_date": "2017-08-03",
      "description": "Senakh sentenced to 46 months federal prison after pleading guilty in Minneapolis."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Initial access established against Internet Infrastructure & Web Hosting infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Russian national arrested in Finland, extradited to the United States, and sentenced to 46 months imprisonment in federal court for operating the Ebury botnet, which infected over 25,000 Linux enterprise web servers with a stealth OpenSSH backdoor to harvest system credentials and divert web traffic.",
    "blast_radius": "Resulted in $10,000,000 in documented financial liabilities. Extensive commercial hosting disruptions and millions of dollars in fraudulent spam generation.",
    "kill_chain": [
      {
        "phase": "Phase 1: Persistence",
        "title": "Persistent Foothold Establishment",
        "description": "Ebury replaced the system OpenSSH key verification binary and shared libraries to intercept plaintext passwords and private SSH keys during legitimate user authentication.",
        "technical_artifacts": [
          "T1574.002",
          "DLL Side-Loading"
        ],
        "mitre_technique_id": "T1574.002"
      },
      {
        "phase": "Phase 2: Credential Access",
        "title": "Credential Harvesting & Memory Dumping",
        "description": "Operated an automated keylogging routine that captured outbound and inbound SSH session credentials and exfiltrated them via custom UDP datagrams.",
        "technical_artifacts": [
          "T1056.001",
          "Keylogging"
        ],
        "mitre_technique_id": "T1056.001"
      },
      {
        "phase": "Phase 3: Expansion",
        "title": "Internal Traversal & Privilege Escalation",
        "description": "Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Internet Infrastructure & Web Hosting infrastructure.",
        "technical_artifacts": [
          "Internal administrative sessions",
          "Network telemetry"
        ],
        "mitre_technique_id": "T1021.002"
      },
      {
        "phase": "Phase 4: Impact",
        "title": "Operational Disruption & Incident Resolution",
        "description": "Russian national arrested in Finland, extradited to the United States, and sentenced to 46 months imprisonment in federal court for operating the Ebury botnet, which infected over 25,000 Linux enterprise web servers with a stealth OpenSSH backdoor to harvest system credentials and divert web traffic.",
        "technical_artifacts": [
          "Incident response logs",
          "Forensic timeline"
        ],
        "mitre_technique_id": "T1078"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across 100% of external and administrative access portals.",
      "Implement network microsegmentation to restrict lateral movement between user workstations and core enclaves.",
      "Maintain immutable, isolated offline backups of mission-critical databases and directory services.",
      "Conduct regular tabletop simulations and verify incident response escalation procedures with legal counsel."
    ]
  }
}