Why this is NOT criminal/financial:

• No cryptomining payloads — zero XMRig, zero pool connections
• No ransomware deployment — no file encryption, no ransom notes
• No credential harvesting for sale — no browser password dumps, no keyloggers
• Telegram sessions have no resale value on criminal markets (unlike credit cards)
• GSM modem access has zero criminal monetization path — except for one: 2FA bypass for targeted account takeover

Why this IS intelligence collection:

• Telegram is the #1 communication platform for opposition groups, journalists, and activists in post-Soviet states, Iran, and Southeast Asia
• GSM modem access enables silent SMS interception — the exact capability documented in NSO Group's Pegasus and similar tools
• The 11/36 concentration on Korea Telecom residential IPs suggests compromised home routers as collection infrastructure
• The command is reconnaissance, not exploitation — it's checking what's available before exfiltrating, indicating a multi-stage operation with human operators reviewing results

Estimated cost to operate: $0 (uses compromised residential infrastructure). Estimated value of intelligence collected: Incalculable — depending on whose Telegram is accessed, this could compromise journalists, dissidents, corporate executives, or government officials.

Hypothesis A — Compromised CPE Fleet (60% probability):

Viettel deploys standardized home routers (Huawei/ZTE) to customers. A single firmware vulnerability → mass compromise → all running identical AsyncSSH. This is the "innocent" explanation. But: Viettel's Cybersecurity Division (VCS) was established in 2019 specifically to prevent this. They employ 500+ security engineers. They offer SOC-as-a-service. They know about botnet infection patterns.

Hypothesis B — Tolerated/Unmonitored (30% probability):

Viettel knows but does not act. Under Vietnam's 2018 Cybersecurity Law (Decree 15), telecoms must "ensure information safety" but enforcement is selective. Military-owned entities in Vietnam enjoy de facto immunity from civilian oversight. The cost of cleanup vs. the cost of ignoring: $0 revenue impact from doing nothing.

Hypothesis C — Deliberate Infrastructure (10% probability):

Cannot be proven or disproven. However: Vietnam's MPS (Ministry of Public Security) has documented use of spyware (Predator, per Citizen Lab). Viettel literally IS the military. Attribution is architecturally impossible — which is the entire point of using residential infrastructure for state operations.

The math: It costs Google 80-320x more to investigate an abusive account than the account generates in revenue. The rational economic decision is to do nothing until someone complains — and even then, the response time is measured in weeks. This isn't negligence. It's a profit-maximizing strategy.

Now multiply by Microsoft Azure (99 IPs), DigitalOcean (133 IPs), Tencent (159 IPs), OVH (96 IPs)... The cloud industry generates billions in revenue from attack infrastructure at the margin, with zero legal liability under the shared responsibility model.

Iraq is unique in our dataset because multiple state and non-state actors simultaneously operate cyber capabilities on its infrastructure:

• Iranian IRGC — documented offensive cyber operations through Iraqi proxies (Mandiant: APT33/APT34)
• PMF (Popular Mobilization Forces) — Iran-aligned militias with documented cyber capabilities
• US Military (CENTCOM) — acknowledged offensive cyber operations in Iraq
• Turkish intelligence (MIT) — active in northern Iraq/Kurdistan
• Criminal groups — using Iraqi infrastructure for bulletproof hosting

When an ISP called "Hulum Almustakbal" (Dreams of the Future) operates at 98.6% threat score with 100% abuse confidence, the question is not "is this compromised?" — the question is "by whom, and for what purpose?"

Iraq has no Budapest Convention obligations. No CERT with international cooperation mandates. The 65.20.0.0/16 addresses will never be cleaned up.

The Afghan Government Communication Network was built with international development funding (World Bank, USAID) before 2021. After the Taliban takeover:

• The network now serves Taliban intelligence and internal security operations
• Original equipment (Cisco, Huawei) was not decommissioned — it was captured
• International routing agreements remain in place — the network still peers globally
• Port 1701 (L2TP) on a government network suggests VPN-based covert communication channels
• The IP with threat score 100 is actively participating in attacks against foreign systems

The broader lesson: International development funding for telecommunications in unstable regions creates infrastructure that outlasts the government it was built for. The Taliban inherited a modern telecom network — built by the West, paid for by Western taxpayers — and that network is now attacking Western infrastructure.

Previous dossier findings (TI-017 "Glass Houses"):

• 421 state-owned IPs attacking from military, government, education, and children's infrastructure
• Hungarian government IP ranges overlapping with documented Pegasus deployment (Hungary confirmed as NSO Group customer by Amnesty International)
• UAE (Etisalat/du) — confirmed NSO Group customer, documented surveillance of journalists and activists
• Palestine — targeted by both Israeli and PA security services using network-level surveillance

The pattern: Countries with documented histories of using commercial spyware (NSO Pegasus, Cytrox Predator, Candiru) against their own citizens also appear as sources of SSH attack traffic in our honeypot. This could be: (a) unrelated criminal compromise of their infrastructure, or (b) the same surveillance apparatus conducting offensive operations.

Statistical note: Hungary (population 10M) has 2 IPs at threat 100. Germany (population 83M) has 172 high-threat IPs. Normalized per capita, Hungary's rate is comparable — but Hungary has 2/2 at maximum score (100%), while Germany's average is 54.7. Hungary's presence is small but maximally aggressive.

The mass targeting of AI infrastructure credentials tells us:

• Attackers are already adapting to the AI boom — credential dictionaries now include AI service names
• 111 IPs = organized campaign, not random — someone specifically added "claude" to a distributed brute-force dictionary
• The target value is AI compute — a compromised AI server has GPU resources worth $10-100/hour for cryptomining, versus $0.01/hour from a CPU-only server
• Or: AI model theft — accessing AI infrastructure could yield proprietary models, training data, or API keys worth millions

Also notable: oracle:oracle (70 IPs), postgres:postgres (implied by credential targeting patterns), hadoop-related credentials — attackers are systematically targeting data-rich infrastructure.