@rnbwkat there was a great talk at CCC this year which explained that. Basically, botnets will create an account with a username like that with a defined password or ssh key. Sometimes it’s another botnet trying to hijack the botnet that created the account, sometimes it’s a way for a botnet to identify hosts it’s already infected.