Hanoi University of Science and Technology (HUST) — IP 202.191.58.34 — is simultaneously:

• Hosting asiaccs2025.hust.edu.vn — the ACM Asia Conference on Computer and Communications Security 2025 website
• Hosting bkcs.hust.edu.vn — the university's Computer Science department
• Registered as a threat score 100 attacker in our honeypot

A cybersecurity conference's own hosting infrastructure is compromised and attacking the internet. The people presenting papers about defending against SSH attacks are hosted on infrastructure that IS an SSH attack.

When a university network is compromised by botnet malware (confirmed: TERNET, HUST, ZAMREN, Koforidua, RENATA), the attacker has access to:

• Student Information Systems — names, national IDs, addresses, phone numbers, grades, financial aid status
• Research data — unpublished papers, grant proposals, experimental data, intellectual property
• Email systems — all communications between faculty, students, and administration
• Medical records — university health centers (TERNET connects medical universities)
• Financial systems — tuition payments, salary information, bank account details

For Koforidua Technical University (Ghana): the exposed MikroTik API port (8728) means the router itself is compromised. This enables: traffic interception of ALL university traffic, DNS poisoning to redirect students to phishing sites, and credential capture at the network layer.

Total students potentially affected: TERNET alone connects 67+ institutions with estimated 200,000+ students. HUST has 40,000+ students. ZAMREN serves all Zambian universities. Conservative estimate: 500,000+ student records accessible through compromised education networks in our dataset.

IP 125.212.243.14 (Viettel, Vietnam People's Army) exposes port 4444 — the default Metasploit reverse shell listener port. Combined with MySQL 3306 and FTP 21, this is either:

• A compromised server running Metasploit payloads — the botnet operator has planted a persistent reverse shell
• An offensive security tool deliberately deployed — Viettel's Cyber Security division (VCS) conducting operations

Either answer is alarming. If compromised: a foreign criminal group has a Metasploit shell on Vietnam's military telecom with database access. If deliberate: Vietnam's military is running offensive tools that are simultaneously attacking our honeypot.

Korea Telecom's exposed services tell a story of massively compromised residential and small-business devices:

• Port 7547 (TR-069) — ISP remote management protocol. If exposed and compromised, an attacker can remotely reconfigure every customer's router connected to this management server. The Mirai botnet exploited exactly this vulnerability in the 2016 Deutsche Telekom attack (900,000 routers offline).
• Port 8333 (Bitcoin) — A Korea Telecom customer running a Bitcoin full node. If this device is compromised and attacking our honeypot, the Bitcoin wallet on it is also compromised.
• Port 1883 (MQTT) — IoT messaging protocol. Smart home devices, industrial sensors, medical devices. All connected, all potentially leaking data through a compromised gateway.
• Oracle Database (1521) on a Korea Telecom IP at threat score 100 — this is likely a business server (small/medium enterprise) with customer data, financial records, or inventory systems. Compromised AND attacking the internet simultaneously.

South Korea context: With 52 million population and 90% KT market share, approximately 47 million people depend on Korea Telecom infrastructure. The 90 compromised IPs we see are the tip — they're the ones actively attacking. The compromised devices NOT attacking (just mining, or dormant) are invisible to us.

This is from OUR dataset of 7,614 IPs alone. We observe a single honeypot. The actual number of compromised databases globally is orders of magnitude larger.

• Long exploitation window: A stolen adult identity averages 2 years before detection. A stolen child's identity averages 7-10 years — because children don't check credit reports, don't apply for loans, and parents rarely monitor child credit.
• Clean credit history: Children's SSN/national IDs have zero credit history — perfect for creating synthetic identities. Each child's record is worth $25-50 on dark web markets vs. $1-5 for adults.
• Permanent damage: By the time a child turns 18 and applies for their first loan or rental, their credit may already be destroyed. Remediation takes 2-5 years of disputes.
• COPPA/GDPR-K violations: Organizations storing children's data under COPPA (US) or GDPR Article 8 (EU) face enhanced fines for breaches — up to $50,000 per child in the US. But when the breach is in Tanzania, Ghana, or Vietnam — there IS no enforcement.

TERNET (Tanzania): Connects universities but ALSO teacher training colleges and secondary school networks. Estimated 200,000+ students, many under 18. Their data is accessible to whoever controls the mdrfckr backdoor on 41.93.28.9.

Koforidua Technical University (Ghana): Router-level compromise (MikroTik API exposed) means ALL traffic — including student registration, exam results, financial aid applications — can be intercepted in real-time.