🧭 The Discovery

The campaign was detected because the target runs a Cowrie SSH honeypot on his home infrastructure. What began as routine brute-force noise became alarming on March 10–20, 2026 when login attempts shifted from dictionary words to actual private credentials — passwords the target recognized from his own password manager.

The forensic escalation path:

1. Honeypot captures surgical credential attempts using private passwords (zero HIBP matches)
2. Wife's credentials appear 8 days after husband's — deliberate two-phase intelligence operation
3. Credentials include private Calibre-Web password ([REDACTED]) from a service deployed on a non-standard port with no public indexing
4. 326 algorithmically-generated password variants prove reverse-engineering of the target's password construction logic
5. Cross-campaign pivot IP proves both campaigns share infrastructure
6. OSINT enrichment reveals MEVSPACE bulletproof hosting, Grameen Communications (head of state connection), FranTech global botnet
7. Post-dossier surveillance detected: MEVSPACE IP returns weekly for handshake-only probes after the target publishes initial findings

This is not spray-and-pray. This is someone who bought or stole specific credentials, studied the target's password construction habits, and deployed infrastructure across multiple continents to attack a single household.

Sources: cowrie honeypot sessions; honeypot_credentials table; HIBP API (0 results for private passwords); threat_intel.ips enrichment data.

⚔️ Campaign A — "The Wordlist Blitz"

19 IPs · 1,763 attempts · Algorithmically-generated passwords · March–May 2026

Campaign A was the noisy phase — high-volume credential testing using a custom wordlist. But this was not a generic dictionary. Forensic analysis of the 326 unique passwords revealed a reverse-engineered pattern derived from the target's actual password construction habits:

The wordlist proves the attacker possessed at least one real password before generating variations. They understood the target's cognitive pattern for creating passwords — not just the passwords themselves. This level of derivation requires a human analyst studying the stolen credentials, not an automated spray tool.

Sources: honeypot_credentials (326 unique passwords, 19 source IPs); password pattern analysis; threat_intel.ips for hosting providers.

🎯 Campaign B — "The Credential Leak / OSINT Recon"

23 IPs · 72+ surgical attempts · Actual stolen passwords · March–June 2026

Campaign B was the quiet, precise phase. Low volume, high accuracy. These were real passwords — not variations, not guesses. The attacker possessed the target's actual credentials from multiple services:

The 8-day gap between operator and wife credentials is operationally significant. It indicates two separate research/acquisition phases — first the primary target, then the partner. This is not automated spraying. This is proxy targeting: attacking a person's family to apply pressure or find alternate access paths. In intelligence tradecraft, this is classified as a coercion/intimidation technique.

Sources: honeypot_credentials; HIBP API lookups; Calibre-Web deployment records; sonatural.life DNS records.

🔗 The Cross-Campaign Pivot

IP 87.106.149.146 (IONOS, DE) appeared in both Campaign A and Campaign B. This single shared node proves the campaigns are not independent — they share infrastructure, and by extension, share an operator or operator group.

The separation into two campaigns is therefore operational compartmentalization, not organizational separation. One group runs the noisy brute-force (testing password variations) and the quiet precision strikes (using known-good credentials) as two modes of the same operation.

Sources: honeypot_sessions cross-reference; IP appears in both campaign credential sets with different password types.

🌍 Infrastructure Geography

The campaign's infrastructure spans 6 countries across 4 continents, with distinct roles for each geographical cluster:

The geographic spread is not random. It follows a pattern: bulletproof hosting for the human operator (MEVSPACE), institutional cover for persistent probing (Grameen/state telco), mobile anonymization for transit (CamGSM), botnet scale for noise (FranTech), and commodity VPS for disposable spray nodes (IONOS/OVH/Contabo).

Sources: threat_intel.ips; honeypot enrichment data; RIPE/APNIC WHOIS; GreyNoise classifications.

👁️ Post-Publication Surveillance

After the target published initial findings (first dossier: April 25, 2026), the MEVSPACE IP 195.3.220.7 returned on a weekly cadence with a new behavioral pattern: SSH handshake only, no credentials attempted.

This is surveillance behavior. The operator shifted from active exploitation to passive monitoring after becoming aware the target was investigating them. The weekly cadence suggests an automated check ("is the honeypot still running?") rather than active attack. The operator is aware they are being watched and is watching back.

Sources: honeypot_sessions for 195.3.220.7 (sessions with null credentials post May-25); timing correlation with dossier-008 publication date.

⏱️ Timeline: Campaign Predates Publication

A critical finding from temporal analysis: the campaign began before any dossier was published, eliminating simple retaliation as the primary motive.

The campaign was triggered by credential acquisition (an infostealer log becoming available for purchase), not by the target's research activities. However, the post-publication surveillance shift proves the operator reads the publications and adapts.

Sources: honeypot session timestamps; shuffle-on.com publication dates; dossier-008 and 011 metadata.

📊 Attribution Probability Matrix

Based on all evidence gathered across the investigation, the following probability-weighted hypotheses explain the campaign's origin:

Note: These are not mutually exclusive. The most likely scenario is a composite chain: credentials stolen by commodity infostealer → sold on market → purchased by actor with specific interest in this target (retaliation or supply-chain motivation) → weaponized with human-level password analysis → deployed via bulletproof infrastructure.

🔗 Cross-References

💡 Why This Matters Beyond One Family

If you use a browser password manager, your credentials may already be for sale. Rhadamanthys, Lumma, Raccoon, RedLine — these infostealers harvest everything: saved passwords, cookies, crypto wallets, session tokens. The gap between "my password was stolen" and "someone is trying it against my SSH server" was approximately 2-3 weeks in this case.

If you run self-hosted services: you are not invisible. Non-standard ports, missing public indexing, private domains — none of these are protection against an adversary who has your browser's password database.

If you publish threat intelligence: expect retaliation. Not maybe. Certainly. The operator adapted their behavior within 6 days of the first publication. This is the cost of transparency.

We do care. We do make mistakes. But we stay in truth. And we are not hiding.