The Feedback Loop - Cross-Dossier Meta-Analysis

🔴 META-ANALYSIS — Operation Shadow Nexus Part H · The Feedback Loop · When Dossiers Create Reactions · All Roads Lead to the Same Network

TI-2026-019H — "The Feedback Loop" — How 18 Investigations Reveal One Interconnected Criminal Ecosystem, a P2P Botnet Named "sshd", and the Observable Consequences of Publishing Intelligence

TI-2026-019H · Published June 9, 2026 · Part H of Operation Shadow Nexus · Confidence: HIGH

📋 When You Watch the Watchers, They Watch Back

This dossier presents findings that were never asked for. They emerged from cross-referencing all 18 previous investigations — and they reveal something unexpected: the actors from separate dossiers are connected. They share credentials, infrastructure, breach data, and most tellingly — they react to our publications.

Since the publication of DOSSIER-011 ("The Personal Touch"), our MikroTik router's cooling fans have been running at full speed. While prerouting rules block all non-honeypot traffic, the volume of blocked connection attempts has visibly increased. This is the feedback loop: publish intelligence → attackers escalate → generate more intelligence → publish again.

Additionally, we've discovered a previously undocumented P2P botnet that replaces the SSH daemon itself with a worm that knows 299 peer IP addresses, and a network of credential validators logging in 16,061 times just to disconnect — monitoring our honeypot without triggering alarm bells.

🕸️ SEGMENT 1: The Cross-Dossier Connection Map

Every previous dossier was treated as an independent investigation. When we cross-reference their actors, a different picture emerges:

Actor	First Appeared	Also Appears In	Current Status
Proton66 (Russia)	011 Campaign A, Wave 1	019F Bulletproof hosting	Active, 6 IPs, 197 silent logins
SPARKED HOST (US)	011 Campaign A (30.8% of attacks)	019 dataset (7 IPs)	Active, threat 100, still attacking
OMEGATECH (Seychelles)	010 GPU Hunter	019 silent logins (560x)	Evolved: GPU profiling → passive monitoring
Private Layer (Panama)	014 Phase Layer	019 silent logins (5,751x!)	12+ IPs, massive monitoring campaign
Baidu Cloud (China)	003 Weaponized Infra	019 P2P sshd botnet (peer node!)	Compromised by P2P worm, threat 100
Grameen (Bangladesh)	011 "The Grameen Operator"	019 G••••••86. distribution	Still active, same unique HASSH
FranTech/BuyVM (US)	019F Bulletproof (121 IPs)	Uses G••••••86. credential	Active, hosting Tor nodes + attack infra
Viettel (Vietnam)	016 Phantom Pipes	019B Military cluster	92 IPs (AsyncSSH), proxy + offensive ops

🔑 THE "GOOGLE1986." DISTRIBUTION NETWORK

The breached credential G••••••86. — first documented in DOSSIER-011 as the primary weapon against our infrastructure — is now observed across 26 unique IPs from 15 different organizations:

🇧🇩 Grameen Communications (Bangladesh) — dossier-011 primary actor
🇪🇹 Ethio Telecom (Ethiopia) — dossier-011 OSINT operator
🇰🇭 CamGSM/Cellcard (Cambodia) — tried "lsn" username
🇺🇸 FranTech/BuyVM — bulletproof hosting (dossier-019F)
🇺🇸 PureVoltage Hosting — 3 IPs
🇩🇪 Hetzner — 2 IPs
🇺🇸 DigitalOcean — 2 IPs
🇪🇪 EENet (Estonian Ministry of Education!) — 1 IP
🇵🇱 Mevspace — 2 IPs
🇵🇾 Red Paraguaya — 1 IP

Interpretation: Different SSH client libraries (paramiko, libssh2, Go) across these IPs proves multiple operators purchased or received this credential from a shared source. This is not one actor using 26 proxies — this is a credential marketplace where breached data about specific targets is sold to multiple buyers.

👻 SEGMENT 2: The Silent Army — 16,061 Login-and-Disconnect Operations

Of 17,044 successful honeypot logins, 16,061 (94%) execute zero commands. These are not failed attacks — they're deliberate login-and-disconnect operations. The top operators:

Actor	Country	Silent Logins	Credential Used	Assessment
Private Layer INC (Panama)	🇵🇦 PA	5,751	`admin:admin`	Honeypot monitoring / intelligence
w1n ltd (UK→Sweden)	🇬🇧 GB/SE	4,496	`admin:admin` + `0:0`	Monitoring + router credential testing
ISAEV Igor (Kazakhstan)	🇰🇿→🇵🇱/🇷🇺	3,670	`admin:admin` + support creds	Residential proxy network builder
OMEGATECH (Seychelles)	🇸🇨→🇺🇦/🇹🇷	686	Various	Evolved from GPU profiling (Dossier-010)
SOLDATOV ALEXEY (80.66.66.x)	🇰🇿→🇷🇺	198	`admin:admin`	Known Russian cybercrime range
Proton66 OOO (Russia)	🇷🇺	197	Various	Bulletproof hoster (also in Dossier-011)

🧮 WHAT ARE THEY DOING?

Three distinct purposes for silent logins:

Honeypot Monitoring: Private Layer (5,751x) and w1n (4,496x) log in repeatedly with admin:admin — they KNOW it's a honeypot. They're tracking uptime, response changes, and whether the honeypot adds new fingerprinting. This is counter-intelligence.
Credential Validation: Testing if passwords still work. Log in → success → log out → credential confirmed valid → sell access or return later.
Proxy Suitability Assessment: ISAEV's one command execution checks for SSH tunneling capability (socat, chisel, gost), router OS (MikroTik, OpenWrt, Ubnt), and TCP forwarding config. He's building a residential proxy network — same business model as DOSSIER-016 "Phantom Pipes".

🐛 SEGMENT 3: The Undocumented P2P "sshd" Botnet

A previously undocumented botnet has been operating in our data, disguised by naming its binary sshd — the same name as the legitimate SSH daemon. Its behavior is unlike anything in our previous dossiers:

INFECTION SEQUENCE:

1. Compromise target via SSH brute-force
2. Create hidden directory: ./{random_19_digit_number}/
   Examples: .1015026083002449969, .3659982939581713256, .8789527882976412579
3. Download binary named "sshd" (SHA256: 94f2e4d8d4436874...da4c00)
4. chmod +x ./{id}/sshd
5. Launch with peer list: nohup ./{id}/sshd [IP1] [IP2] [IP3] ... [IP50+] &

PEER LIST ANALYSIS:
├── 299 unique IP addresses observed across 11 infection sessions
├── Each launch receives 50+ peer IPs as command-line arguments
├── Peers span: China (dominant), US, GB, Vietnam, Indonesia, India
├── 11 peer IPs confirmed in our honeypot database (attacking us too)
├── Includes: Baidu Cloud, ChinaNet, China Mobile, DigitalOcean, UK hosting
└── Binary SHA256 is POLYMORPHIC — 24 unique hashes observed (recompiled per victim?)

NOTABLE PEERS (confirmed in our database):
  180.76.175.142 — Baidu Cloud (Dossier-003!) — threat 100
  49.72.111.25   — ChinaNet — threat 100
  159.203.120.106 — DigitalOcean — threat 100
  36.137.79.219  — China Mobile — threat 100
  46.101.107.202 — DigitalOcean — threat 100

⚠️ WHY THIS BOTNET IS DIFFERENT

P2P architecture: Unlike Outlaw (central C2), this botnet passes peer lists to each node. No single point of failure. Takedown requires simultaneous action against 299+ nodes.
Binary polymorphism: 24 unique SHA256 hashes for "sshd" across 36 downloads. Either recompiled per victim (unique build ID) or uses packing/encryption.
Naming camouflage: The binary is literally named "sshd" — on a compromised server running SSH, this is INVISIBLE to casual process listing. ps aux | grep sshd shows the real sshd AND the malware identically.
Hidden directory obfuscation: 19-digit random numbers as directory names, with leading dot (hidden). ls won't show them; ls -la will, but the 19-digit name looks like a legitimate process artifact.
China-dominant peer mesh: 60%+ of peer IPs are Chinese residential/cloud (Baidu, ChinaNet, China Mobile, China Unicom). This is either a Chinese-operated botnet or one that primarily targets Chinese infrastructure.
Cross-campaign victim: Baidu IP 180.76.175.142 is BOTH a peer in this botnet AND was documented in DOSSIER-003 as weaponized Baidu infrastructure. The same server compromised by multiple botnets.

🎯 SEGMENT 4: ISAEV Igor — The Proxy Network Builder

ISAEV Igor (AS number registered in Kazakhstan, operating from Poland and Russia) runs a single comprehensive command on successful login that reveals their exact business model:

ISAEV's probe command checks (in order):
├── System info: uname, hostname, arch, user ID
├── SSH config: AllowTcpForwarding, PermitTunnel, GatewayPorts
│   → Can this host be used as an SSH tunnel proxy?
├── Network: IP addresses, listening services
├── Resources: uptime, memory, CPU count, disk space
├── Tunnel tools: socat, curl, wget, python3, ncat, chisel, gost
│   → Are proxy tools already installed?
├── Write test: touch /tmp/.sshprobe (can we write files?)
├── Package manager: apt, yum, apk, opkg, dnf, pacman, zypper
│   → Can we INSTALL proxy tools?
├── Sudo: sudo -n true → can we escalate privileges?
├── Device type detection:
│   ├── /system resource print → MikroTik router?
│   ├── /etc/openwrt_release → OpenWrt router?
│   └── /etc/version → Ubiquiti device?
└── Goal: Build inventory of devices suitable for SSH tunnel proxying

💰 THE BUSINESS MODEL

ISAEV operates the same business documented in DOSSIER-016 "Phantom Pipes" — a residential proxy network. The infrastructure:

8 IPs in 87.251.64.x (all threat score 100), registered to an individual in Kazakhstan, operating from Poland/Russia
3,670 silent logins + 8 support-credential attempts — testing for ISP equipment defaults
Revenue model: Residential proxies sell for $5-15/GB. A network of 1,000 compromised home routers generating 10GB/day = $50K-150K/month
Why check for MikroTik/OpenWrt/Ubnt? These are HOME ROUTERS — the most valuable proxy endpoints because their IP addresses appear "residential" to anti-fraud systems

This is the SAME operation as Viettel's 102 compromised home routers in DOSSIER-016, but run by a different operator targeting different geography. The residential proxy market is large enough to support multiple competing criminal enterprises.

🔄 SEGMENT 5: The Observable Feedback Loop

Since publishing dossiers on shuffle-on.com, observable changes in attacker behavior:

Observable Change	Evidence	Interpretation
MikroTik CPU load increase	Cooling fans at maximum since dossier publication	DDoS or scanning surge against edge router (blocked at prerouting)
248 IPs targeting "shuffleon" user	Domain-specific credential generation (Shuffleon2026@)	Increased targeting after domain gained visibility
16,061 silent monitoring logins	94% of successful logins do nothing	Counter-intelligence: tracking honeypot behavior changes
CYBEROLOGY honeypot fingerprinting	20+ IPs checking /proc/1/mounts, container detection	Mapping whether honeypot infrastructure changed after publications
G••••••86. spread to 26 IPs	Was 3-4 IPs in original dossier-011, now 26	Credential was RESOLD after publication confirmed it was known

The paradox of transparency: Publishing intelligence about attacks creates a feedback loop. Attackers read the publications (our analytics confirm traffic from IP ranges matching attacker infrastructure). They learn what we know. They adapt. But adaptation creates NEW observable signatures. The 16,061 silent logins wouldn't exist if they weren't specifically trying to understand our capabilities. Their caution IS the signal.

🧩 SEGMENT 6: The Unified Theory — One Ecosystem, Many Operators

These 18+ investigations, when viewed together, reveal not separate campaigns but one criminal ecosystem with specialized roles:

THE ECOSYSTEM (roles, not individuals):

┌─────────────────────────────────────────────────────────────────┐
│ LAYER 1: INFRASTRUCTURE PROVIDERS (enabling layer)               │
├─────────────────────────────────────────────────────────────────┤
│ • Proton66 (RU) — Bulletproof hosting, zero abuse response      │
│ • FranTech/BuyVM (US) — "Privacy" hosting, Tor exit nodes       │
│ • YISU Cloud (HK/SC) — Shell company, offshore routing          │
│ • Private Layer (PA) — Intelligence-grade hosting               │
│ • SPARKED HOST (US) — Budget attack infrastructure              │
└────────────────────────────┬────────────────────────────────────┘
                             │ provides infrastructure to
                             ▼
┌─────────────────────────────────────────────────────────────────┐
│ LAYER 2: BREACH DATA MARKET (intelligence layer)                 │
├─────────────────────────────────────────────────────────────────┤
│ • Credential databases (G••••••86. sold to 26+ buyers)         │
│ • Domain OSINT packages (shuffleon service enumeration)         │
│ • Vulnerability feeds (exposed Portainer, SSH keys)             │
│ • Target dossiers (family names, personal details)              │
└────────────────────────────┬────────────────────────────────────┘
                             │ purchased by
                             ▼
┌─────────────────────────────────────────────────────────────────┐
│ LAYER 3: OPERATORS (action layer)                                │
├─────────────────────────────────────────────────────────────────┤
│ • Grameen/UIH cluster — Targeted credential stuffing (011)      │
│ • Outlaw botnet — Mass SSH worm, crypto-mining (019A-C)         │
│ • P2P sshd botnet — Sophisticated China-focused worm (NEW)     │
│ • ISAEV network — Residential proxy recruitment                 │
│ • OMEGATECH — GPU profiling → access brokering (010→019)        │
│ • Viettel cluster — State-adjacent offensive ops (016, 019B)    │
└────────────────────────────┬────────────────────────────────────┘
                             │ monetized by
                             ▼
┌─────────────────────────────────────────────────────────────────┐
│ LAYER 4: REVENUE (extraction layer)                              │
├─────────────────────────────────────────────────────────────────┤
│ • Crypto mining — $450K-930K/year (Outlaw, 019C)                │
│ • Residential proxies — $50K-150K/month (ISAEV, Phantom Pipes)  │
│ • Access brokering — $5-50 per validated credential             │
│ • Data exfiltration — Priceless (AI models, student records)    │
│ • State intelligence — No price tag (Viettel, Afghan gov)       │
└─────────────────────────────────────────────────────────────────┘

COUNTER-INTELLIGENCE (watching it all):
├── CYBEROLOGY (NL) — Active honeypot fingerprinting
├── Private Layer (PA) — Passive availability monitoring
├── w1n ltd (UK) — Passive availability monitoring
└── OMEGATECH (SC) — Evolved from profiling to monitoring

📎 Sources (Part H)

📄 Cross-reference of all 18 previous dossier investigations (001-019G)

📄 Direct honeypot observation — 16,061 silent logins, P2P sshd botnet (299 peers), credential distribution

📄 DOSSIER-011 "The Personal Touch" — original G••••••86. documentation (3-4 IPs → now 26)

📄 DOSSIER-010 "The GPU Hunter" — OMEGATECH evolution from profiling to monitoring

📄 DOSSIER-014 "Phase Layer" — Private Layer INC (Panama) first identified

📄 DOSSIER-003 "Baidu Cloud" — Same Baidu IP now in P2P sshd botnet peer list

📄 DOSSIER-016 "Phantom Pipes" — Residential proxy model (Viettel) now replicated by ISAEV

📄 MikroTik router diagnostics — cooling fan speed increase post-publication

🧭 Operation Shadow Nexus — Complete Series:
A: Core · B: Ugly Machinery · C: Follow The Money · D: Open Doors · E: Web Between · F: Ghost in the Machine · G: Broken Window · H: The Feedback Loop (Meta-Analysis)

Methodology: Cross-dossier correlation · Passive SSH honeypot · Credential distribution tracking · P2P peer list analysis · Behavioral pattern classification · No active scanning performed