The 4-step history wipe (HISTFILE + HISTSAVE × export + unset) is overkill by design — it covers bash, sh, dash, and custom shell variants. This is a mature worm that has been refined through testing against multiple shell environments.

The honeypot detection is clever: type export checks if export is a real shell builtin. Older Cowrie versions didn't implement it. Our Cowrie did — the worm ran the detection but Cowrie passed the test. The worm likely aborted due to other behavioral checks further in the pipeline that we didn't trigger (the honeypot detection is step 1 of a multi-stage verification).

The initial /home/localtest string sent as SSH version identifier is a connection probe — it checks if the SSH service is real before deploying the actual client. The SSH client string SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u6 reveals the worm toolkit was compiled on Debian 9 "Stretch" (EOL June 2022).

The 1-minute spacing between the NL → US → SE attacks indicates C2-directed sequential targeting, not independent propagation. The worm detected our honeypot but couldn't confirm — it ran the detection, Cowrie passed, but the payload never arrived. This suggests additional verification steps beyond what we captured.

• Netprotect's abuse contact is abuse@strongtechnology.net — not their own domain
• RIPE admin for Netprotect: "Strong Technology IP Admin" (role: STIA1-RIPE)
• Same RIPE maintainer: NETPROTECT-MNT manages both companies' IP space
• Two Manhattan virtual office addresses, 1 mile apart
• TENET (185.228.105.149, Ukraine) appears to be another downstream customer or partner

Threat Classification: Coordinated Worm Campaign with Corporate Shell Infrastructure

Family 1 (Anti-Forensics) targets residential embedded devices with ancient firmware — NAS boxes, old routers, and IoT devices running OpenSSH 6.7p2 (2015). The worm's OPSEC is sophisticated: 4-layer history wipe, honeypot detection via shell builtin testing, and connection probing before deploying the real SSH client. These compromised residential devices provide clean IP reputation for further attacks.

Family 2 (GUID History Stealer) operates through commercial proxy/anonymization infrastructure disguised as two separate companies. The corporate structure is deliberately opaque: Netprotect Inc. and Strong Technology LLC share abuse contacts, RIPE maintainers, admin roles, and operate from virtual offices 1 mile apart in Manhattan. This is proxy-as-a-service infrastructure — whether the companies knowingly facilitate malware operations or are themselves compromised is an open question.

The history-stealing operation is unusual — most worms disable history, this one reads it. Stolen bash history can reveal: internal hostnames, database connection strings, API keys accidentally typed, SSH destinations, system administration patterns, and more. Combined with the GUID tag for C2 correlation, this is targeted intelligence collection.

The human operator evidence (Windows list command, apt isntal typo) suggests a Windows-native developer who is less fluent in Linux — possibly someone who develops the worm toolkit on Windows and deploys it on compromised Linux infrastructure. The 3:06-minute polling interval is suspiciously precise — likely a hardcoded sleep(186) or a cron job with custom scheduling.