Follow the Access · 01 — The Default Password: The Key Left in the Lock

Follow the Access — Case 01. This register follows the intruder from the login prompt to the foothold's fate, and closes each case on what the access becomes: RANSOMED · MINED · PROXIED · HARVESTED · WIPED · RESOLD.

The previous register followed money. This one follows access — the other currency of the underground economy, and the one that comes first, because before value can be stolen, a machine has to be entered. Twenty-six cases will follow the intruder through the twenty-six ways in: the phished credential, the exposed database, the unpatched appliance, the planted backdoor. But the series has to begin where the attacks actually begin, with the most common way into a machine on the internet — and it is not an exploit. It is the password the manufacturer set at the factory and the owner never changed.

This is the case about the key left in the lock. There is a honeypot beneath these words — a machine built to be broken into, logging every attempt — and it does not have to guess what the most common intrusion looks like, because it has counted. The single most-attempted credential in its entire history is admin:123456, tried 5,385 times. Not exploited, not cracked: simply typed, over and over, by programs sweeping the internet on the reasonable assumption that somewhere, on some machine, the factory default was never changed. They are usually right.

And when they are right, the foothold has a fate, drawn like every case in this register from a fixed six-word vocabulary. For the default password, the fate is MINED. The machine that answers admin:admin is rarely worth ransoming and rarely worth spying on; it is a router, a camera, a cheap server, a device no one is watching. But it has a processor, and it has an electricity supply someone else pays for, and that is all a cryptominer needs. The default-password foothold is converted, silently and directly, into mined cryptocurrency. This is the story of the internet's oldest open door and the quiet theft that walks through it.

1. The Door Left Unlocked at the Factory

Begin with what a default credential actually is, because the whole case turns on how mundane it is. When a manufacturer ships a device that needs a login — a router, an IP camera, a network video recorder, a server image, an embedded Linux board — it has to set some initial username and password so the first owner can get in and configure it. So it sets a default: admin/admin, admin/123456, root/root, or a value printed in the manual that is identical across every unit of that model. The owner is expected to change it on first setup. Very often, the owner does not.

That gap — between the credential the device shipped with and the credential it should have been given — is the vector. It is not a flaw in the software; the login is working exactly as designed. It is not a vulnerability that needs a patch; there is nothing to fix in code. It is a door that was unlocked at the factory for the convenience of setup, with a note asking the owner to lock it, and the note was ignored. The attacker does not pick the lock or break the door. He tries the handle, and it opens, because the key was left in it.

This is why the default password is catalogued not as an exploit but as a standing weakness. It has formal names — CWE-1392, Use of Default Credentials; CWE-798, Use of Hard-coded Credentials — and it sits at the top of every hardening baseline: the CIS Controls make changing vendor defaults a foundational step, NIST guidance says the same, and CISA's secure-by-design initiative now presses manufacturers to stop shipping universal default passwords at all. The weakness is so well-understood that it is embarrassing, and that is precisely the point of opening the register here. The most common way in is not clever. It is a lock the factory left open and the owner never closed, and an attacker who simply walks up and tries it.

2. What the Honeypot Counted

Now the first-party evidence, because this register has an advantage most threat writing does not: it is not describing the vector from reports, it is reading it off a sensor. The honeypot beneath these words is a machine deliberately exposed to be attacked, recording every credential tried against it. It has been counting for a long time, and the count settles the question of what the most common intrusion actually is.

The single most-attempted non-empty credential is admin:123456 — 5,385 attempts, from 53 distinct source addresses. Behind it, admin:admin, tried 887 times from 136 distinct addresses. Then the root family, the Unix administrator account paired with the laziest possible passwords: root:root, root:123456, root:12345, root:admin, root:password, root:123, root:1234 — each recurring across forty to eighty-five different attacking machines. There is no exotic credential near the top of this list. There are no stolen enterprise passwords, no clever guesses tailored to a target. There is only the short, dull inventory of factory defaults, tried again and again, because trying them costs nothing and they work often enough to be worth it.

Note the shape of those two lead numbers, because it encodes two different tactics. admin:123456 came 5,385 times from only 53 addresses — a few machines hammering one high-yield credential relentlessly. admin:admin came fewer times but from 136 addresses — a credential so universal that the whole swarm carries it. One is depth, one is breadth, and together they describe a search that is both stubborn and wide: the same tiny dictionary, pressed hard by a few and carried everywhere by many. Beneath even these sits the largest bucket of all — tens of thousands of connections that recorded no credential at all, the bare probes of scanners cataloguing what answered before deciding what to try. The credential attempts are only the visible tip of a continuous, automated census of the reachable internet.

And the payloads that follow a successful login say what the whole exercise was for. The most common malware family the honeypot captured is RedTail — an XMRig-based cryptominer — landing on thirty-two distinct source machines, alongside elf.xmrig itself and the Mirai family. RedTail arrives built for whatever answered: the honeypot logged it fetched as redtail.i686, redtail.x86_64, redtail.arm7, and redtail.arm8 — the same miner cross-compiled for Intel desktops, 64-bit servers, and two flavors of ARM. That multi-architecture spread is the tell of the entire case. The operator does not know and does not care whether the machine that opened to the default password is a home router, a security camera, a rented server, or an industrial controller. He only cares that it has a CPU. The payload was chosen before the victim was known, because with this vector the victim is interchangeable.

3. Nobody Is Typing

It matters, before going further, to correct the mental image. When you read admin:123456 attempted five thousand times, it is tempting to picture a person hunched over a keyboard, patiently guessing. That is not what is happening, and the honeypot can prove it, because it fingerprints the software on the other end of every connection.

The default-credential attempts do not come from people. They come from tooling. The honeypot's SSH-client fingerprints — a technique called HASSH that identifies the connecting library by how it negotiates the session — resolve the attackers into large clusters running automated frameworks: libssh in several versions, Go_SSH, AsyncSSH, libssh2, and a distinct cluster of the credential-brute-force tools Hydra, Medusa, and Ncrack. In total, 3,477 of the honeypot's source addresses are classified as scanners and 1,343 as botnet nodes. These are not curious individuals. They are programs, running unattended, doing one thing: connecting to every reachable address on the internet, trying the short list of default credentials, and moving on.

This changes the scale of the threat from human to industrial. A person can try a handful of passwords against a handful of machines. A scanning program tries the same handful of passwords against every machine on the internet, continuously, forever. The internet has roughly four billion IPv4 addresses; a modern scanner can sweep the entire space in hours. So the relevant question is never whether a given default-password device will be found — it will, within hours of coming online — but only what happens to it when it is. The default password is not a risk that might materialize if someone notices your device. It is a certainty that materializes the moment your device is reachable, because something is already trying, right now, against everything.

4. MINED — The Fate of a Foothold Worth Nothing and Something

So the scanner finds the device, the default password opens it, and the operator now holds a foothold. What does he do with it? Here the register writes its first disposition, and it is MINED — and the reasoning is pure economics.

Consider what kind of machine this usually is. Default-password boxes are, overwhelmingly, low-value and unattended: a consumer router, an IP camera, a DVR, a cheap virtual server, an embedded Linux device running some appliance. It holds no corporate secrets to steal. It belongs to no one wealthy enough to extort. Its owner may not even remember it is on the network. To a ransomware crew, it is worthless — there is no data to encrypt that anyone would pay to recover, and no victim to negotiate with. To an espionage actor, it is uninteresting — it sees nothing worth watching. By the measures that make a machine valuable to most attackers, this one is worth nothing.

But it is worth something in exactly one way: it has a processor, and it draws electricity that its owner pays for. Cryptojacking is the crime built precisely for that residual value. It installs a miner — RedTail, XMRig — that runs the machine's CPU flat out solving the proof-of-work for a privacy cryptocurrency, almost always Monero, and streams the results to the operator's wallet. The victim's compute and the victim's electricity are converted, continuously and silently, into coins in someone else's account. There is no ransom note, because none is needed. There is no negotiation, because nothing was taken that the victim will miss enough to bargain over. There is no contact at all — the ideal cryptojacking victim never even knows. Mining is the rational monetization of a machine that is worthless to steal from but useful to borrow, and that is why the honeypot's default-password intrusions end in miners and not ransom notes. The foothold worth nothing to ransom is worth a trickle of Monero forever, and a trickle from millions of machines is a river.

The choice of Monero is not incidental, and it draws a line straight back to the previous register. Monero is designed to be CPU-mineable — its proof-of-work deliberately favors ordinary processors over specialized hardware, which is exactly what makes a swarm of hijacked routers and cameras a viable mining rig. And Monero is a privacy coin: as the money series documented at length, its ring signatures and stealth addresses break the traceability that a public blockchain like Bitcoin would otherwise provide, so the destination wallet cannot be followed and the proceeds cannot be tallied from the outside. More developed miners like RedTail go further still, routing to private mining pools that hide even the pool address. The two registers meet here: Follow the Money ended in the dark at the privacy coin; Follow the Access begins in the light, at the open door, and the value it produces walks straight into that same darkness. The default password is where the untraceable coin is minted, one stolen CPU cycle at a time.

5. Who Pays, and How They Never Notice

Center the victim, because the ease of this crime makes it easy to call victimless, and it is not. Someone owns the mined machine, and someone bears the cost — diffusely, invisibly, but really.

The owner of a cryptojacked router or camera pays first in electricity: a device engineered to sip a few watts now runs its processor at full load around the clock, and the difference lands on a power bill no one thinks to question. They pay in hardware: sustained maximum load cooks components designed for light duty, shortening the life of the device and, in the worst cases, degrading or destroying it. They pay in performance: the camera stutters, the router slows, the appliance becomes sluggish, and the owner blames age or the internet, never suspecting that a stranger's miner is stealing the cycles. And they pay in complicity they never consented to, because — as the next case in this register will show — the same access that installed the miner usually also enlists the machine into the scanning swarm, so that the victim's own device is now attacking others, trying admin:123456 against the next range of strangers. The honeypot's 3,477 scanners and 1,343 botnet nodes are, in large part, yesterday's victims.

And the cruelty, if it can be called that, is how gentle it all is. A good cryptojacker does not want to be noticed; noticing leads to cleaning, and cleaning ends the trickle. So the miner is often throttled to stay below suspicion, the device keeps working well enough, and the theft continues for months or years, bounded only by the life of the hardware. The harm is real — measured across millions of devices it is an enormous, quiet diversion of electricity and compute into criminal wallets — but it is spread so thin across so many unknowing owners that no single victim feels enough to act. That diffusion is not a side effect. It is the business model. Cryptojacking survives precisely because it costs each victim a little and no victim enough, which is the same reason the vector that enables it will not close.

6. The counter-narrative, steelmanned

The strongest objection to this case is that it is beneath the register's attention — that default-password cryptojacking is background noise, not a threat worth the first letter of a series, and it deserves a fair hearing.

The argument runs like this. Nobody serious is compromised by admin:123456; the machines that fall to it are junk devices whose owners are, frankly, negligent, and the loss is a few cents of electricity that no one even notices. Real intrusions — the ones that matter — involve skilled adversaries, novel exploits, and targeted operations against valuable targets, and a register on access should be documenting those, not the automated background hum of the internet mining pennies off forgotten routers. Worse, the objection continues, dwelling on the default password blames the victim: telling people to change their passwords is the oldest and most useless advice in security, endlessly repeated and endlessly ignored, and repeating it in a dossier adds nothing. The honest conclusion, on this view, is that this case is a triviality dressed up as an opening statement.

The register grants the small point and rejects the large one. Yes, each individual default-password box is low-value, and yes, the per-victim loss is trivial — the case says so plainly in Section 5; that triviality is the mechanism, not a reason to look away. But the claim that it does not matter collapses under its own scale. The honeypot did not log admin:123456 five thousand times because it is rare; it logged it because it is the single most common thing that happens, the baseline reality of what being connected to the internet means. A vector that compromises machines within hours of exposure, that has run continuously for the decade since Mirai industrialized it, and that quietly conscripts an unknowable population of devices into mining and attacking — that is not noise beneath the signal; at this scale it is the signal. And it is not victim-blaming to name a structural failure: the deeper fault, as the next section argues, lies less with the owner who never changed a password than with an industry that shipped universal defaults for decades knowing exactly what would happen. The register opens here not because the default password is impressive, but because it is true — it is where the attacks actually begin, and a series about access that skipped it to chase the exotic would be describing the internet it wished existed rather than the one the sensor records.

7. Disposition — MINED

Case 01 followed the most common intrusion on the internet — the unchanged factory credential — from the login prompt to the foothold's fate. It is not an exploit but a door left unlocked at the factory: admin:123456, admin:admin, root:root, tried not by people but by automated scanners sweeping every reachable address, 5,385 times for the top pair alone on a single honeypot. When the default opens, the machine is usually a low-value, unattended device — a router, a camera, a cheap server — worth nothing to ransom and nothing to spy on, but holding a processor and an electricity supply someone else pays for.

The disposition — the foothold's fate — is MINED. The default-password box is conscripted to run a cryptominer, RedTail or XMRig, delivered as multi-architecture binaries by an operator who does not care what kind of machine answered, only that it can compute. It mines Monero silently and continuously, converting the victim's stolen compute and electricity directly into coins in a stranger's wallet, with no ransom note, no negotiation, and no contact — the ideal victim never knows. The harm is real and enormous in aggregate and trivial per victim, which is exactly why it survives: cryptojacking costs each owner a little and no owner enough.

The fix is the most trivial in this entire register — change the default credential, and the vector is defeated, at zero cost. That it persists anyway is the case's lasting lesson: the failure is not really the owner's forgetfulness but the structure around it. Manufacturers shipped universal default passwords for decades knowing they would not be changed; devices are unattended by design and never reconfigured; and the population of vulnerable machines is replenished by new shipments faster than the old ones are ever cleaned. A per-device fix that is free does not scale against a structural problem, and so the oldest open door on the internet stays open. The honeypot beneath these words will log admin:123456 again before this sentence is finished, from an address that was itself a victim yesterday. The vectors do not lie: the key was left in the lock, a program tried the handle, the door opened, and the machine began to mine for someone it will never meet. We do not judge. We record. We let people judge — and then, if they are wise, change the password.

Follow the Access begins. Case 01 disposition: MINED. Confidence: HIGH — the credential counts, HASSH tool fingerprints, scanner/botnet classification, and multi-architecture RedTail capture are direct first-party honeypot evidence; the RedTail (XMRig-based Monero miner) and Mirai families and the default-credential weakness (CWE-1392, CWE-798) are corroborated by public reporting and by CIS/NIST/CISA hardening guidance. The economic reasoning for MINED over ransom or espionage follows the payload distribution the sensor recorded. The self-propagation claim — victims becoming scanners — is drawn from the honeypot's scanner/botnet classification and entity graph and is developed as Case 02. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the owner who never changed it, and the industry that shipped it that way.