detection rulehost

ed25519 marker key in authorized_keys

First seen: 2026-06-16
Last seen: 2026-06-16
Used in: 1 post

Hosted25519 marker key in authorized_keys

# Run host-side, fleet-wide
sudo find / -name authorized_keys -type f -exec \
  grep -l 'AAAAC3NzaC1lZDI1NTE5AAAAIMhfiGeykxXnvdARJXQSCouFsIHeG+H28W03yY2juP00' {} +

Posts using this rule

highSelf-Blocking Docker API Abuse Delivers the VoidLink DDoS-for-Hire Botnet
Host
Any production host's `/root/.ssh/authorized_keys` (or any user's) containing the marker key is decisive evidence of this operator. Schedule as a daily corpus scan.
2026-06-10