Outlaw
Outlaw is a threat actor group, tracked by Brandefense. It targets the Government and Finance sectors in 12 countries, including India and France. It uses 9 MITRE ATT&CK techniques.
- Techniques
- 9
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
9 techniques across 4 of 14 tacticsResource Development·
Initial Access3
Brute Force: Password Guessing
Exploit Public-Facing Application
Server Software Component: Web Shell
Execution2
Command and Scripting Interpreter: Unix Shell
Command and Scripting Interpreter: Python
Persistence·
Privilege Escalation·
Defense Evasion2
Masquerading: Match Legitimate Resource Name or Location
Network Denial of Service
Credential Access·
Discovery·
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- Haiducmalware
- PerlBotmalware
- Faster Than Lighttool
- pscantool
- ssh-scantool
- XMRigtool
Campaigns.
- Outlaw Crypto-Botnet April 2020 CampaignApr 2020
Indicators Of Compromise.
TLP:CLEAR3 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout Outlaw.
Outlaw is a financially motivated group that builds Linux and IoT botnets. It gains access mostly through SSH brute-forcing and command-injection flaws. Its main tool is a Perl-based IRC bot from the Shellbot family, often used together with an XMRig-based Monero miner and an SSH backdoor installed as a service for persistence. Command and control has run over IRC through hijacked servers.
Last updated Oct 22, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.