The ratio that defines this crime: For every $1 the criminal earns, victims collectively pay $20-40 in electricity bills alone. The botnet is a value destroyer — it creates less than 5% of the economic damage it causes. This is not efficient crime. This is economic parasitism on a global scale.

And this doesn't include: hardware degradation (running CPUs at 100% 24/7), bandwidth costs, server downtime, incident response labor ($150-500/hr), forensic analysis, reputation damage, or regulatory fines for compromised organizations.

This is not laziness or randomness. Unique passwords per victim serve specific operational purposes:

• Asset inventory — the operator maintains a database mapping password → IP → location → CPU specs. This is a managed portfolio of compromised assets.
• Revenue tracking — different victims have different mining profitability (CPU type, bandwidth, uptime). Unique passwords allow per-host accounting.
• Compartmentalization — if one victim detects the intrusion and the password leaks, it doesn't compromise access to all other victims.
• Resale capability — a database of working root credentials to servers across 25+ countries has dark-web market value of $5-50 per host (total portfolio value: $250K-$5M).

This is not a worm. This is a business. With accounting, inventory management, and operational security that would satisfy a Fortune 500 compliance audit.

Two Google Cloud IPs (34.85.232.35 and 35.196.255.242) execute the following sequence:

1. Change root password to "modzmodz"
2. Create user "admin1" with password "modzmodz"
3. Create user "user1" with password "modzmodz"
4. Download "meow" malware from ANOTHER Google Cloud IP

"modzmodz" is the SAME password documented in Dossier 018 (Operation Meow) — the KataBump DDoS botnet operated by identified French individuals. The "meow" binary is the same Go DDoS malware.

The infrastructure chain:

Google Cloud is simultaneously: the attack platform, the malware staging server, AND the compromised victim — all on the same ASN. Google pays itself for the compute used to attack other Google customers.

Consider what's happening:

• Attacker rents Google Cloud VM for $4-10/month
• Uses it to compromise OTHER Google Cloud VMs
• Those VMs are paying $4-300/month each to Google
• The attacker mines crypto on the victim's account
• The victim's Google Cloud bill increases by $50-500/month (CPU usage)
• Google collects revenue from BOTH the attacker AND the victim
• Google has no economic incentive to stop this

Google Cloud literally profits from both sides of every attack that stays within its network. The attacker pays for their VM. The victim pays inflated bills from mining. Google's revenue increases. The "shared responsibility model" means Google bears zero liability.

If a criminal physically stole $10-39M worth of electricity per year from power companies, they would face:

• Grand theft charges in every jurisdiction
• Organized crime (RICO) prosecution
• Asset forfeiture
• 10-20 year prison sentences

But because the electricity theft is distributed across 50,000-100,000 victims in 80+ countries, each individual victim loses $100-400/year in extra electricity costs. Below the threshold of investigation for every single victim. The aggregate crime is massive; the individual impact is invisible.

This is the genius of the model: steal small amounts from many victims across many jurisdictions, convert to untraceable cryptocurrency, and cash out in jurisdictions without enforcement. It's money laundering architecture built into the mathematical foundations of the currency itself.

Is the Outlaw botnet ONLY a cryptomining operation?

Consider: they have root access to government telecoms in Pakistan, Kazakhstan, and Vietnam. They have backdoors on Microsoft Azure and BytePlus/TikTok infrastructure. They profile systems for GPU capabilities (AI/ML theft potential). They've been operating for 8 years without disruption.

Hypothesis (10-20% probability, impossible to disprove): The mining revenue ($450K-930K/year) is the visible revenue stream. The invisible revenue stream is selling access to specific high-value compromised hosts to state actors, APT groups, or organized crime. A single root access to Pakistan's NTC could be worth more to the right buyer than a year of mining revenue.

There is documented precedent: FIN7 operated as both a criminal organization AND sold access to nation-state actors. The line between "cybercrime gang" and "access broker for state-sponsored operations" is not a line at all — it's a business model.