https://burnett.sh/tags/authorized-keys-persistence/Recent content in Authorized-Keys-Persistence on Joshua's NotebookHugoenWed, 08 Jul 2026 09:00:00 -0500https://burnett.sh/posts/attack-observation-07-08-2026/Wed, 08 Jul 2026 09:00:00 -0500https://burnett.sh/posts/attack-observation-07-08-2026/Incident writeup of a RedTail cryptominer campaign against a DShield honeypot: default-credential SSH access, two-stage loader, SFTP payload delivery, MITRE ATT&CK mapping, and threat intel on the source infrastructure.