🚩 Key Finding: 30 IPs from the same cloud provider all attacking the same target is NOT coincidence — this is either a single operator with 30 VMs or a shared botnet framework popular on Chinese underground forums. Baidu Cloud's abuse email resolves to a CNNIC address that WHOIS itself flags as "invalid."

💡 TTP Analysis: The cat /bin/echo honeypot detection test is a known technique — real systems return the binary content, most honeypots return an error. The password caching to /tmp/.opass indicates a multi-stage toolkit where stage 2 needs to re-authenticate. The 3.3MB ELF binary is consistent with: cryptominer (XMRig ~3-4MB), botnet agent (Mirai variants ~1-4MB), or rootkit.

⚠️ Notable: The russh_0.51.1 client (Rust SSH library) is extremely uncommon in botnet traffic. This suggests the operator has access to custom-compiled tools — not just off-the-shelf scripts. Combined with three different language stacks (C, Go, Rust), this is a well-resourced operation.

Threat Classification: Coordinated Cloud-Based Attack Infrastructure

Baidu Cloud is becoming the Chinese equivalent of what AWS was 5 years ago for botnet operators — cheap VMs, lax abuse response, and difficult cross-jurisdictional reporting. The CNNIC abuse contact (ipas@cnnic.cn) is flagged as "invalid" in its own WHOIS record, making formal abuse reports a dead end.

The dropper VM (120.48.83.195) is ITSELF tagged as "compromised" by Shodan — meaning the attacker likely compromised someone else's Baidu Cloud VM and is using it as a staging server. The exposed Redis 6.0.16 (EOL since 2023) and MySQL without authentication are the likely initial infection vectors. This is a common pattern: compromise a poorly-secured cloud VM, install your toolkit, use it to attack others.

The credential dictionary reveals sophisticated target profiling — passwords like nginx, docker, mysql, and apache are not random. The attacker is guessing that the root password matches the primary service running on the target. The keyboard-walk pattern !QAZxsw2 targets sysadmins who think they're being clever.

The use of three different SSH libraries (libssh/C, Go, russh/Rust) across the network suggests either a shared botnet framework with modular scanner components, or multiple operators sharing the same Baidu Cloud credential pool. The single Rust SSH connection is particularly concerning — russh is a niche library that indicates custom tooling, not commodity malware.