TI-2026-025D โ โGrameen Bangladesh: The Head of Stateโs Networkโ
๐งญ Series Navigation
๐ Executive Summary
The most persistent attacker in this campaign operates from Grameen Communications โ AS58946 / GRAMEEN1-AS-AP โ a not-for-profit IT subsidiary founded by Muhammad Yunus, Nobel Peace Prize laureate (2006) and Bangladeshโs head of state in practice as Chief Adviser from August 2024 to 2026. This is a tiny network: only 103.26.136.0/24 and 103.26.137.0/24, just 512 IPv4 addresses total. Inside that tiny space sit the campaignโs most persistent nodes.
Every abuse path is broken. The APNIC-listed abuse contact gc@grameen.technology is explicitly marked INVALID, flagged on 2025-09-04 and 2025-11-18. The NOC contact gcnoc@grameen.com is worse than dead: grameen.com itself has been hijacked and now hosts a Japanese cryptocurrency casino. That means email to the organizationโs primary domain does not go to Grameen at all.
The technical pivot is unusually strong. A unique SSH client fingerprint โ HASSH a704be057881f0b1 โ exists on exactly three IPs worldwide: 103.26.136.17 and 103.26.136.30 in Dhaka, plus 103.40.188.143 in Bangkok on UIH Thailand, an enterprise ISP using its own allocation, not a commodity VPN exit. This fingerprint does not match any known SSH implementation and strongly implies the same operator or same bespoke toolkit deployment across Bangladesh and Thailand.
The sole government upstream carrying this traffic is BTCL โ AS17494, 100% state-owned, operator of secure government voice infrastructure, and during Yunusโs tenure structurally answerable to the same executive center. That does not prove direct state tasking. It does prove something narrower and harder: the traffic sits inside a network cluster that is politically adjacent, technically visible, and practically unreachable through normal abuse channels.
Core finding: an organization founded by the head of state, routing through the state telco, with dead abuse contacts and a hijacked domain, hosted the campaignโs most persistent attack nodes while a world-rare custom HASSH linked them to a Bangkok enterprise relay.
๐ข The Organization
| Field | Value | Why it matters |
|---|---|---|
| Organization | Grameen Communications | Not-for-profit IT subsidiary inside the wider Grameen family ecosystem. |
| ASN | AS58946 / GRAMEEN1-AS-AP | Confirmed Grameen network under direct analysis. |
| Address | Grameen Bank Bhaban, 9th Floor, Mirpur-2, Dhaka-1216 | Institutionally anchored, not a disposable VPS brand. |
| IP space | 103.26.136.0/24 + 103.26.137.0/24 | Only 512 IPs total; persistent abuse inside such a small space is conspicuous, not background noise. |
| Founder context | Muhammad Yunus; one of 20+ Grameen family entities | Creates direct political and reputational adjacency. |
| Other entities | GrameenPhone, Grameen Bank, Grameen Telecom, Grameen CyberNet | Demonstrates this is a networked institutional family, not an isolated NGO shell. |
| NOC | gcnoc@grameen.com โ DEAD | Primary comms domain no longer belongs to the organization. |
| Abuse | gc@grameen.technology โ INVALID | APNIC explicitly flagged it invalid twice in late 2025. |
| Public website | No public site; zero Wayback captures for grameencommunications.com | An internet-facing network that barely exists on the internet. |
That last point is not cosmetic. Invisibility is part of the operating condition. No working abuse mailbox, no working NOC path, no meaningful public web presence, and no archival footprint for the branded domain. This is how a small network becomes difficult to challenge even before politics enters the picture.
๐ฐ The Domain Hijack
grameen.com โ the organizationโs primary communication domain โ now resolves to a Japanese cryptocurrency casino. That fact is not peripheral. It means the APNIC NOC address gcnoc@grameen.com is not merely stale; it is routed into infrastructure outside Grameenโs control.
What this breaks
- NOC escalation via
@grameen.com - Operational accountability via registry contacts
- Basic assumption that abuse mail reaches the network owner
What this implies
- The organization is effectively uncontactable
- Registry data remains publicly present but practically useless
- Any external abuse report can be silently black-holed
All email to @grameen.com now goes somewhere else. In ordinary negligence cases, a contact address bounces. Here, it is worse: it may deliver successfully to the wrong operator. That is operational unaccountability, not mere clerical sloppiness.
๐๏ธ Muhammad Yunus โ Head of State Connection
Muhammad Yunus won the 2006 Nobel Peace Prize for microcredit and the Grameen Bank model. He later became the 5th Chief Adviser of Bangladesh from August 2024 to 2026, following the July 2024 uprising that toppled Sheikh Hasina. During that tenure, Grameen-linked institutions saw a notable sequence of favorable outcomes:
| During Yunus tenure | Observed institutional outcome |
|---|---|
| Grameen University | Approved |
| Grameen Employment Services | Received manpower export licence |
| Grameen Telecom | Received digital wallet licence |
| Grameen Bank | Government stake reduced from 25% to 10% |
| Legal exposure | Cases against Yunus dismissed |
The structural map matters more than any single headline: Yunus โ Chief Adviserโs Office โ BTCL (state telco) + NSI (civilian intelligence). That does not authorize us to claim command-and-control from the office to the packets. It does authorize a narrower conclusion: the founder of this network occupied the top of the state during the entire period in which the attacks persisted, while the traffic transited the state telco and remained untouched.
๐ก BTCL โ The State Telco Transit
| Field | Value | Forensic meaning |
|---|---|---|
| ASN | AS17494 | Confirmed upstream path in the case. |
| Entity | Bangladesh Telecommunications Company Limited | State-owned incumbent telco. |
| Ownership | 100% government-owned | Not a private transit intermediary. |
| Relationship to AS58946 | Sole government upstream | All Grameen attack traffic passed through BTCL infrastructure. |
| State function | Runs secure red telephone exchange for government VIPs | Institutional sensitivity is built into the operator. |
| Monitoring context | DGFI Signals Intelligence Bureau has capability over BTCL traffic | Visibility exists, even if action does not. |
| Integrity history | Former MDs convicted over 2 billion BDT call-record erasure, VoIP fraud, ignored court orders | Looking away is not hypothetical in this institutionโs history. |
The important distinction is between capability and proof of tasking. We do not have direct evidence that BTCL or the Chief Adviserโs Office ordered an SSH campaign. We do have direct evidence that all Grameen attack traffic crossed a state telco with both monitoring capability and a documented history of institutional compromise.
๐งฌ The Unique HASSH Fingerprint
The strongest technical anchor in this dossier is HASSH a704be057881f0b1. It does not match any known standard SSH implementation in our corpus. It appears on exactly three IPs worldwide:
| IP | Network | Location | Assessment |
|---|---|---|---|
103.26.136.17 | AS58946 Grameen Communications | Dhaka, Bangladesh | Persistent Grameen attack node |
103.26.136.30 | AS58946 Grameen Communications | Dhaka, Bangladesh | Persistent Grameen attack node |
103.40.188.143 | AS38794 UIH | Bangkok, Thailand | Enterprise relay using same client/toolkit |
The simplest technical explanation is a custom-compiled Paramiko build with modified algorithm negotiation. The important point is not the library name; it is the rarity. This fingerprint is not achievable by coincidence. Three hosts on earth emitting the same nonstandard HASSH โ two in Grameen, one in Bangkok โ is near-conclusive evidence of either the same operator or a tightly shared bespoke toolkit.
๐น๐ญ UIH Thailand โ The Bangkok Relay
| Field | Value |
|---|---|
| Organization | United Information Highway Co., Ltd. (AS38794) |
| Address | 499 Benchachinda Bldg., Kamphangphet 6 Rd., Ladyao, Chatuchak, Bangkok 10900 |
| Type | Enterprise ISP โ not a public VPN provider |
| Admin | sunsern_ss@uih.co.th |
| Abuse | system_team@uih.co.th โ validated 2026-01-23 |
| IRT | Last modified 2026-06-11 |
| Observed host | 103.40.188.143 in UIHโs own allocation |
Unlike Grameen, UIH looks reachable. Its abuse path is live, its incident response object is maintained, and the IP is not hidden behind a generic proxy provider. That makes the Bangkok node more revealing, not less. Grameen Communications also has documented international presence in East Timor, Jakarta, and Manila, so the BangladeshโThailand bridge is structurally plausible. Same rare tool across two countries points to shared operator continuity, not ambient scanner overlap.
๐ค AI/ML Server Infrastructure
The Grameen hosts 103.26.136.17 and 103.26.136.30 are tagged โaiโ by Shodan-derived service metadata. Their exposed profile is consistent with AI/ML inference or training support infrastructure rather than generic office servers.
| Host | Observed traits | Interpretation |
|---|---|---|
103.26.136.17 | Ports 9000/9191, nginx/1.23.4, OpenSSH 7.4 | Inference gateway + legacy SSH stack |
103.26.136.30 | Ports 9000/9191, nginx/1.23.4, OpenSSH 7.4 | Companion AI/ML service node |
OpenSSH 7.4 points back to the CentOS 7 era, which reached end-of-life in June 2024. That alone is enough to explain the old daemon. It is also enough to expose the hosts to a long tail of inherited risk: approximately 27 known CVEs in the platform generation, including serious authentication and pre-auth concerns depending on patch level. The campaign telemetry shows 24/7 automated behavior with no sleep-cycle signature. The working hypothesis is straightforward: unattended tooling deployed on compromised or badly managed AI servers.
๐งน AS23956 Correction
Initial analysis incorrectly associated AS23956 with Grameen. That attribution is wrong.
| ASN | Correct identity | Address | Status |
|---|---|---|---|
AS23956 | AmberIT Limited | Navana Tower, 45 Gulshan 1, Dhaka-1212 | Separate company; not Grameen |
AS58946 | Grameen Communications | Grameen Bank Bhaban, Mirpur-2, Dhaka-1216 | Confirmed Grameen network in this dossier |
That correction matters because the case is already severe without inflation. Only AS58946 is confirmed Grameen. Accuracy is what lets the stronger claims survive.
โฑ๏ธ The Persistence Pattern
The Grameen IPs are the most persistent nodes in the entire campaign. They remain active from first detection to present, with no meaningful dormancy and no human circadian rhythm visible in the timing. This is machine persistence, not a hobbyist logging in after work.
- Continuous activity from first detection through the present collection window
- 24/7 operation with no visible sleep cycle
- Same rare HASSH retained across campaign duration
- Behavior consistent with an unattended automated tool on stable infrastructure
- AI/ML server profile suggests a plausible host class for high-uptime automation
The simplest reading is still the best one: the attack tool was deployed and then left running. Whether that reflects compromise, insider abuse, or tolerated misuse remains the open question.
โ Conspirative Questions
โ Is this state-directed?
Structural capability exists: Yunus sat atop the executive center; BTCL was the state telco transit; DGFI/NSI had visibility paths. But there is no direct evidence of an order chain. The evidence supports adjacency, capability, and non-intervention โ not proven command authority over the operator.
โ Is this insider abuse inside Grameen?
That is one of the strongest non-state hypotheses. Someone with access to the Grameen AI servers may have deployed or tolerated the tool. The persistence and infrastructure stability are compatible with misuse from inside the organization, whether negligent or intentional.
โ Why does a Nobel laureateโs organization have all abuse contacts dead?
There are only two serious readings: catastrophic negligence or deliberate unaccountability. Either one is already institutionally damning. For an organization this small, leaving every abuse path nonfunctional is not a subtle failure.
โ What is the grameen.com hijack really about?
The public fact is enough: the domain now fronts a Japanese crypto casino. The deeper possibilities remain open โ abandoned domain, quiet monetization, or a more deliberate move that permanently killed the legacy NOC address. We do not need to choose among them to conclude the result is operationally convenient for abuse.
โ Why Thailand specifically?
UIH is an enterprise ISP, not a throwaway VPN. Grameen has documented regional presence beyond Bangladesh. The Bangkok node may represent an employee, contractor, partner office, or secondary staging point. The technical link is solid; the human role behind it is still unresolved.
โ Are DGFI or NSI involved?
We cannot prove participation. We can say something narrower: Bangladesh intelligence has the structural ability to see traffic on BTCL. If the campaign persisted unchanged across the entire period, then either they did not notice, did not care, or saw no reason to intervene. Passive facilitation remains a live question.
โ What are those AI servers actually inferring?
The exposed ports and service profile say AI/ML. They do not say which workload. One possibility is innocent neglected inference infrastructure. Another is that the same hardware class is being repurposed for credential derivation, username generation, or scoring of harvested access. The server role is visible; the model purpose is not.
๐๏ธ Read Between the Lines
โก What the evidence is saying without lowering its voice:
- A 512-IP organization with dead abuse contacts and a hijacked primary domain is effectively untouchable by normal reporting channels.
- The only three IPs on earth sharing HASSH
a704be057881f0b1are two Grameen hosts and one Bangkok enterprise host. That is not commodity scanner behavior. - โCentOS 7 EOL explains OpenSSH 7.4โ is the simplest answer, not automatically the complete one. Negligence and intentional misuse can coexist.
- BTCL has both capability and precedent for looking the other way. Two billion BDT in erased records is not a minor institutional blemish.
- The attack continued throughout Yunusโs tenure. Even if the founder knew nothing, the timing destroys any argument that the surrounding state-adjacent environment was aggressively self-policing.
- Grameen Communicationsโ invisibility is itself a finding. An internet operator with no real website, no Wayback footprint, dead contacts, and live persistent abuse is not merely obscure; it is operationally opaque by design or by neglect so extreme it becomes equivalent.
๐ Cross-References
- TI-2026-011 โ โThe Personal Touchโ: original targeted-credential campaign where the Grameen operator first surfaced as a named actor.
- TI-2026-019H โ โThe Feedback Loopโ: confirms Grameen remained active and retained the same unique HASSH inside the broader cross-dossier ecosystem.
- TI-2026-021C โ โThe Architecture of Impunityโ: institutional frame for how policy, registry structure, and accountability gaps protect abusive networks.
- TI-2026-024A โ โOffshore Bulletproofโ: contrast case for what deliberate unaccountability looks like in hostile hosting; Grameen is smaller, but the accountability void is comparable.
๐งช Method Note
How this dossier was built: passive honeypot telemetry was correlated with APNIC/RDAP registration data, PeeringDB contact and facility context, HASSH census analysis, Shodan-derived banner and service classification, routing/upstream mapping, and public reporting on Bangladeshโs political and telecom institutions.
- Passive telemetry: campaign timing, persistence, fingerprint recurrence, cross-IP correlation
- Registry analysis: AS58946 contacts, invalid abuse markers, address space scope, upstream structure
- Service exposure: AI tags, ports
9000/9191,nginx/1.23.4,OpenSSH 7.4 - Fingerprint analysis: uniqueness of HASSH
a704be057881f0b1across the observed corpus - Institutional anchoring: Grameen family structure, Yunus tenure, BTCL state ownership, intelligence visibility context
No unauthorized access was performed. The claims here come from passive observation, public registry records, and openly available political/corporate information. Where intent cannot be proven, it is labeled as question, not conclusion.