Since April 3, 2026, a coordinated campaign of 260 unique IP addresses has been targeting our honeypot infrastructure with credentials algorithmically derived from the domain name "shuffle-on.com" — generating 22,553 unique password variants across 122,220 login attempts. The passwords follow systematic patterns: the domain split into components (shuffle, on, shuffleon), combined with years (2017-2028), leet-speak substitutions ($HUFF|3, 5HUFFLE), and common suffixes (!!!, !@#, @123).

Within this swarm, a single human operator stands out: IP 103.24.212.42 (PT Adau Putra Network, Indonesia) gained access on May 11 using the default credential pi:raspberry and immediately executed a 9-stage system enumeration targeting cryptocurrency wallets, SSH keys, environment secrets, and Docker configurations. Since then, this operator maintains an hourly "echo BMOK" keepalive beacon — 194 beacons over 9 days — while periodically attempting targeted passwords between beacons. The operator's SSH fingerprint (OpenSSH 10.0p2 Debian 13 Trixie) is shared by only 2 IPs worldwide in our entire database, linking to a secondary node in Germany (5.182.204.221, hostname beautirize.com, Windows RDP/WinRM server).

The Go botnet component (HASSH 16443846184eafde36765c9bab2f4397) operates 326 nodes across 10+ countries and is the same infrastructure documented in TI-2026-013 (Krane Botnet). Additionally, a libssh 0.11.2 fleet (HASSH 03a80b21afa810682a776a7d42e5e6fb) contributes high-volume password spraying — a single node (136.0.251.107) alone attempted 400 shuffle-derived passwords.

The password generation reveals service awareness: the attacker knows the target runs Portainer (container management), suggesting prior reconnaissance or infrastructure scanning. The Portainer passwords follow the same generation patterns as the shuffle ones — confirming a single tool/operator behind the dictionary generation. The presence of future years (2027, 2028) in the dictionary shows forward-planning — this tool was built to last.

The last echo BMOK was received at 2026-05-25 09:43 UTC — the operator's automated script is still running and confirming access every hour. If this were a real system, the attacker would have maintained undetected persistent access for 14 days (since initial compromise on May 11). The "BMOK" string likely means "Bot Machine OK" — a minimal output that confirms the session is alive without triggering log analysis thresholds.

The Indonesian IP also operates as a Go botnet node (HASSH 16443846184eafde36765c9bab2f4397) — the same 326-node fleet documented in TI-2026-013. This confirms the BMOK operator is part of the Krane botnet ecosystem — they contribute automated scanning capacity to the collective while conducting manual operations independently. The Indonesian server is dual-purpose: botnet node by day, crypto hunter by night.

Operational sophistication: MEDIUM-HIGH. Uses bleeding-edge OS (Debian Trixie), maintains dual infrastructure (Indonesia + Germany), operates both automated botnet scanning and manual human operations. However, leaves forensic artifacts (/home/phil/) and uses a default credential (pi:raspberry) — not an APT-level actor.

Primary motivation: 💰 CRYPTOCURRENCY THEFT. The first thing enumerated after system reconnaissance is cryptocurrency wallets (wallet.dat, keystore, mnemonic, seed files). SSH keys and environment secrets are secondary targets — likely for lateral movement to find wallets on adjacent systems.

Operational pattern: Compromise → enumerate → beacon → wait. The hourly BMOK beacon maintains access while the operator processes intelligence from the reconnaissance. They return periodically (May 13, 14, 17, 23) to try new password variants — suggesting they are working through a target list and revisit each target intermittently.

Assessment: This is a semi-automated criminal operation — a human operator managing multiple compromised systems, using them as both botnet nodes and manual intrusion points. The Indonesian server has been in threat intelligence feeds since 2019 — either the operator has controlled it for 7 years, or (more likely) it is an ISP customer server that was compromised and repurposed. The German Windows server (beautirize.com) is likely a rented VPS used as a management station.

┌─────────────────────────────────────────────────────────────────────────────┐
│                  THE HYDRA — INTERCONNECTED THREAT ACTORS                    │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│                        ┌──────────────────────┐                             │
│                        │  CREDENTIAL MARKET    │                             │
│                        │  (Underground Forums) │                             │
│                        └──────┬───────┬───────┘                             │
│                               │       │                                     │
│                    ┌──────────┘       └──────────┐                          │
│                    ▼                              ▼                          │
│  ┌─────────────────────────┐    ┌──────────────────────────────┐           │
│  │  GO BOTNET (TI-013/015) │    │  MEVSPACE OPERATOR (TI-011)  │           │
│  │  326 nodes · HASSH 1644 │    │  195.3.220.7 + .88 (Poland)  │           │
│  │  Krane scanner fleet     │    │  Infostealer logs + derivation│           │
│  │  shuffle-on password gen │    │  Personal credentials ONLY    │           │
│  └────────┬────────────────┘    └──────────────────────────────┘           │
│           │                                                                 │
│           ├── BMOK Operator (103.24.212.42 🇮🇩)                             │
│           │   └── Human crypto hunter with persistent access                │
│           │   └── Also runs Go botnet node                                  │
│           │                                                                 │
│           ├── libssh Fleet (136.0.251.107 + others)                         │
│           │   └── Scaleway-hosted scanner nodes (TI-013)                    │
│           │   └── Highest volume (400 variants per IP)                      │
│           │                                                                 │
│  ┌────────┴────────────────┐    ┌──────────────────────────────┐           │
│  │  PHASE LAYER (TI-014)   │    │  PARAMIKO CLUSTER (TI-011)   │           │
│  │  Private Layer / Pfcloud │    │  Bangladesh + Thailand        │           │
│  │  IAB credential harvest  │    │  Unique HASSH worldwide       │           │
│  │  2,775 burst / 0 commands│    │  Personal passwords only      │           │
│  └─────────────────────────┘    └──────────────────────────────┘           │
│                                                                             │
│  TARGET: shuffle-on.com ──────────────────────────────────────────────      │
│  Attacked by: ALL of the above — simultaneously and independently           │
│  Combined: 260+ IPs · 122,220+ attempts · 53 days continuous                │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

AlienVault OTX (103.24.212.42): 8 pulses spanning 2019-2026 — "SSH Brute-Force Honeypot Live" (2019), "RaspiNAS Honeypot Feed" (Apr 2026), multiple Fail2Ban feeds (May 2026), "Malware Filter - Botnet List" (May 2026), "TSEC Honeypot: Brute Force" (May 2026).

AlienVault OTX (136.0.251.107): 11 pulses — "SSH Brute-Force Honeypot Live" (2021), continuous Fail2Ban and honeypot feeds throughout 2026. Known malicious infrastructure for 5+ years.

Shodan tags: Indonesian node tagged with "self-signed" certificate; German node exposed via RDP+WinRM (remote administration). Both represent rented or compromised infrastructure, not end-user devices.

1. Domain-targeted credential generation is a real attack vector. An adversary who knows only your domain name can generate 22,000+ plausible passwords algorithmically. Default credentials, combined with service-aware guessing (Portainer, Bitcoin), significantly increase the probability of access.
2. The Go botnet (Krane) is a general-purpose criminal platform. It distributes generated password dictionaries to hundreds of nodes. Individual operators (like the BMOK actor) can piggyback on the botnet infrastructure while conducting their own manual operations. It's a franchise model for cybercrime.
3. Persistent access via default credentials is trivial. The pi:raspberry credential — unchanged on millions of Raspberry Pi devices — gave instant root access and the operator has maintained it for 14 days with an hourly beacon that generates minimal log noise.
4. The same infrastructure targets multiple victims simultaneously. This dossier documents attacks on our honeypot, but OTX data confirms the same IPs attack globally — appearing in honeypot feeds across Japan, France, and other countries during the same time period.
5. This is one tentacle of a larger hydra. Cross-referencing with TI-011 (personal credential campaign), TI-013 (Krane Botnet), and TI-014 (Phase Layer) reveals a criminal ecosystem where botnets, bulletproof hosters, credential markets, and human operators interlock — each providing services to the others.

If you run a Raspberry Pi, IoT device, or any system with default credentials exposed to the internet — change them now. This actor gains access in seconds, enumerates your entire system in 60 seconds, and maintains persistent hourly verification that you haven't noticed them. By the time you detect the beacon pattern, your wallet files, SSH keys, and secrets have already been exfiltrated.