TI-2026-026O: The Go Scanner — Precision Engineering for Internet-Scale Credential Harvesting

Classification: TLP:WHITE — Unrestricted Distribution
Investigation ID: TI-2026-026O-GO-SCANNER
Series: The Phantom ASN Ecosystem
Published: June 2026
Author: LSN Threat Intelligence Unit

Of all the campaigns we observed over our investigation, one stands apart not by size but by a single metric that matters most: successful logins. The Go_SSH scanner is the most efficient credential harvesting operation we've ever documented — a purpose-built tool that trades brute force for surgical precision, running on purchased VPS infrastructure from legitimate cloud providers, operated by someone who understands the initial access broker market intimately enough to know exactly what each compromised server is worth.

This dossier follows the tool from its HASSH fingerprint to its operators' probable business model, through the cloud providers who host it, the credential dictionaries that power it, and the criminal supply chain it feeds. This is not a botnet. This is a reconnaissance platform for the ransomware economy.

Chapter 1: The Tool — Anatomy of a Go-Based SSH Scanner

The scanner identifies itself through a single, immutable fingerprint: HASSH 16443846184eafde36765c9bab2f4397. HASSH fingerprinting — developed by Salesforce's security research team in 2018 — captures the specific set of SSH key exchange algorithms, encryption algorithms, MAC algorithms, and compression methods offered by a client during the initial handshake. This fingerprint is determined by the SSH library compiled into the binary, not by user configuration. It is, effectively, the scanner's DNA.

This particular fingerprint matches the Go crypto/ssh library — the standard SSH implementation in the Go programming language. Unlike off-the-shelf tools (Hydra, Medusa, Ncrack), this scanner was purpose-built. Someone wrote code, compiled it, and deployed it across 434 nodes spanning multiple continents.

Why Go? The Engineering Decision

Known Go-Based Scanning Frameworks

The Go_SSH scanner is not unprecedented. It exists within a broader ecosystem of Go-based network scanning tools:

• zgrab2 (ZMap Project): Open-source Go-based application-layer scanner used by academic researchers at the University of Michigan. Supports SSH, HTTP, TLS, and dozens of protocols. The scanner could be a modified zgrab2 fork.
• Tsunami Security Scanner (Google): Go-based vulnerability scanner for detecting high-severity vulnerabilities at scale. Open-sourced by Google in 2020.
• Sliver C2 (BishopFox): An open-source adversary emulation framework written in Go, increasingly used by actual threat actors as a Cobalt Strike alternative. Implants compile to single Go binaries.
• goscan: Various community projects on GitHub for SSH brute-forcing in Go, many with credential stuffing capabilities built-in.

The operator likely started with one of these frameworks (most probably a zgrab2 fork or custom project) and modified it to focus exclusively on SSH credential testing with a curated dictionary. The result: a tool that does one thing — test SSH credentials — with maximum efficiency.

The HASSH Fingerprint as Attribution Tool

The HASSH fingerprint 16443846184eafde36765c9bab2f4397 is shared across all 434 scanner nodes. This means every node runs the same compiled binary — or at least a binary compiled with the same version of the Go crypto/ssh library with the same algorithm configuration. This uniformity is itself a finding:

Chapter 2: The Campaign — 87 Days of Continuous Scanning

The Go_SSH scanner campaign has been active for at least 87 days — from March 24, 2026 to June 18, 2026 (the date of this analysis) — with no sign of stopping. This makes it one of the longest-running continuous scanning campaigns we've observed, and its persistence tells us as much about the operator as the tool itself.

Campaign Timeline

The Success Metric

Our honeypot recorded 333 successful authentications from the Go_SSH campaign (the honeypot deliberately accepts most credentials to capture post-authentication behavior). But the success rate is what distinguishes this campaign from everything else we've observed:

Session Behavior Analysis

The Go_SSH scanner's session pattern is distinctive and revealing:

1. Connect: TCP handshake + SSH key exchange (Go crypto/ssh default algorithms)
2. Authenticate: Present credential pair (typically 1-3 attempts per session, not hundreds)
3. If Success: Record the valid credential pair, catalog target metadata, disconnect immediately
4. If Failure: Disconnect without additional attempts — move to next target

Average session duration: under 3 seconds. This is significantly faster than the libssh botnets (which average 3.42 seconds with more credential attempts per session). The Go_SSH scanner is optimized for throughput — testing as many targets as possible with minimal time per target.

Top Scanner Nodes

The most active individual scanner nodes reveal infrastructure choices:

Chapter 3: The Infrastructure — A Cloud Provider Census

The Go_SSH scanner's choice of infrastructure is deliberate and reveals both the operator's resources and their operational philosophy. Unlike botnet operators who use compromised home routers and IoT devices, the Go_SSH operator exclusively uses commercial cloud and hosting providers. This is not a scrappy operation — it's a managed service running on enterprise-grade infrastructure.

Provider Distribution

The Oracle Cloud Free Tier Exploit

11 of the 434 Go_SSH nodes run on Oracle Cloud infrastructure. This is notable because Oracle Cloud offers a generous "Always Free" tier that includes:

• 2 AMD-based Compute VMs with 1 GB RAM each
• 4 Arm-based Ampere A1 cores with 24 GB RAM
• No credit card verification in some regions
• Minimal identity verification for free-tier accounts

The attacker can create unlimited free-tier accounts with disposable email addresses, each account providing 2 VMs perfect for running the Go_SSH scanner. The 11 Oracle nodes likely represent 5-6 free-tier accounts — costing the operator nothing. Oracle's abuse response team handles ~200,000 free-tier abuse reports per quarter (from various SSH scanning campaigns, cryptocurrency miners, and DDoS bots), with average response time of 72+ hours — plenty of time to complete a scanning run.

Provider Response Analysis

The Driftnet Anomaly

Among the 50+ hosting providers, one stands out: Driftnet Ltd (AS211298). This small UK-registered hosting company contributes 15 IPs (3.5% of the fleet) — a disproportionate share for a company with likely fewer than 5,000 total IP addresses in its allocation.

Chapter 4: The Credential Strategy — A Dictionary of Certainty

The Go_SSH scanner doesn't brute-force. It knows. Where the libssh botnets spray hundreds of credential combinations per target, the Go_SSH scanner presents a curated dictionary of 50 credential pairs — the minimum viable set to compromise the maximum number of real-world SSH servers. This isn't guessing. It's applied statistics.

The Credential Dictionary

Based on our honeypot session analysis, the Go_SSH scanner uses the following credentials, presented in approximate order of frequency:

(Full list continues to ~50 pairs, including cloud-specific defaults like ec2-user/ec2-user, azureuser/azure, and IoT credentials like admin/password123)

Why These 50 Passwords Work

The internet has approximately 22 million SSH servers reachable on port 22 (per Shodan). Studies show that:

• 0.3-0.5% of internet-facing SSH servers accept default credentials (66,000-110,000 servers)
• The top 10 credential pairs account for ~60% of all successful default-credential logins
• The top 50 credential pairs cover ~95% of successful default-credential logins
• Adding credentials beyond the top 100 provides diminishing returns (<2% additional coverage)

The Go_SSH operator has done this math. Their 50-credential dictionary is the Pareto-optimal scanning strategy: maximum coverage per unit of scanning time. At 434 nodes, each scanning ~1,000 targets per hour, the fleet processes approximately 434,000 targets per hour. A full sweep of all 22 million SSH servers takes roughly 50 hours — two days. The operator can rescan the entire internet SSH population twice per week.

The Economics of Credential Scanning

Chapter 5: The Geography — 43 Countries, One Scanner

The Go_SSH scanner operates from 434 IPs across 43 countries. This isn't organic spread — it's engineered geographic diversity designed to evade geographic-based blocking, maximize scanning coverage across time zones, and reduce the likelihood of coordinated takedown across jurisdictions.

Country Distribution

Geographic Strategy Analysis

The Five Eyes Concentration

An unexpectedly high proportion of Go_SSH nodes operate from Five Eyes intelligence alliance nations:

Chapter 6: What Happens After Success — The Reconnaissance Paradox

Every other SSH scanning campaign in our honeypot follows the same pattern: authenticate, deploy payload, execute. The Go_SSH scanner does something different. It authenticates, catalogs, and disconnects. No payload. No commands. No persistence. The most sophisticated scanner in our dataset is the only one that doesn't exploit what it finds.

Post-Authentication Behavior Comparison

The Three Interpretations

Interpretation 1: Pure Reconnaissance (Initial Access Broker)

The Go_SSH scanner is a credential harvesting tool. Its purpose is to build a database of target:username:password tuples that can be sold to other operators who handle the exploitation phase. This is the IAB (Initial Access Broker) model, documented by CISA in advisories AA24-241A (Pioneer Kitten), AA24-109A (Akira), and AA23-061A (BlackSuit), where Iranian state actors and cybercriminal groups sell network access on underground forums at prices ranging from $50-$500 per SSH/RDP access credential for small businesses to $1,000-$50,000+ for enterprise domain admin access.

Under this interpretation, the Go_SSH operator is the first stage of a multi-stage attack pipeline:

1. Stage 1 (Go_SSH): Discover valid credentials → $0.04/credential cost
2. Stage 2 (IAB marketplace): List credentials on forums → $50-500/credential revenue
3. Stage 3 (Buyer): Deploy ransomware, steal data, mine crypto → $10K-$10M+ revenue per high-value target

Interpretation 2: Pre-Positioning (State Actor)

The scanner is building a strategic access database — a catalog of systems that can be compromised on demand. This is the nation-state model: don't exploit now, but know that you can exploit later. When a geopolitical crisis demands cyber capability, the operator doesn't need to scan — they pull from the database. CISA's advisory on Volt Typhoon (AA24-290A) describes exactly this pattern: Chinese state-sponsored actors maintaining persistent access to critical infrastructure for future use during a potential Taiwan contingency.

Interpretation 3: Continuous Intelligence (Red Team/Audit)

The scanner measures the internet's default-credential exposure as a ongoing assessment. This is the legitimate security research model — organizations like Shadowserver and CERT/CC conduct similar scans to identify vulnerable systems and notify owners. Under this interpretation, the operator is mapping vulnerability exposure, not exploiting it.

The IAB Supply Chain Position

Internet SSH Population (22M servers)
    │
    ▼
┌─────────────────────────┐
│  Go_SSH Scanner Fleet   │  ← YOU ARE HERE
│  434 nodes, 50 creds    │
│  Cost: $3,500/month     │
└────────────┬────────────┘
             │ Validated credentials
             ▼
┌─────────────────────────┐
│  Credential Database    │
│  ~8,000-15,000 new/mo   │
│  Format: host:user:pass │
└────────────┬────────────┘
             │ Listed on forums
             ▼
┌─────────────────────────┐
│  IAB Marketplace        │
│  Exploit.in, XSS.is,   │
│  RAMP, Russian Market   │
│  Price: $50-$500 each   │
└────────────┬────────────┘
             │ Purchased by
             ▼
┌─────────────────────────┐
│  Exploitation Operator  │
│  Ransomware, mining,    │
│  data theft, espionage  │
│  Revenue: $10K-$10M+    │
└─────────────────────────┘

Chapter 7: The Supply Chain Economics — A $1.2 Million Annual Business

If the Go_SSH scanner is an IAB operation, what does its financial model look like? We can construct a bottom-up revenue estimate from observed data, industry pricing intelligence, and the documented economics of the initial access brokerage market.

Revenue Model

Cost Structure

Downstream Economic Impact

The Go_SSH scanner's credentials aren't the end of the financial chain — they're the beginning. Each credential sold enables downstream exploitation:

Chapter 8: The Uncomfortable Questions

Every investigation reaches a point where the evidence supports multiple conclusions, some of which are deeply unsettling. This chapter addresses the questions that most threat intelligence reports avoid — not because they're speculative, but because their answers challenge comfortable assumptions about who runs the internet and who's responsible for its security failures.

Question 1: Is This a State Operation Disguised as Crime?

Question 2: Do Cloud Providers Profit from Scanning Operations?

The Go_SSH scanner operates 434 nodes across 50+ cloud providers. These providers charge for compute time, bandwidth, and storage. The Go_SSH operator pays approximately $2,000-5,000/month across these providers. This is revenue.

Cloud providers' Terms of Service prohibit using their infrastructure for unauthorized access. But enforcement requires:

1. Detecting the scanning activity (technical cost)
2. Investigating the abuse report (human cost)
3. Suspending the account (revenue loss)
4. Blocking re-registration (additional engineering cost)

For a provider like DigitalOcean with 47 Go_SSH nodes paying ~$5-10/month each ($235-470/month total), the abuse investigation and enforcement cost likely exceeds the revenue from those accounts. From a pure financial perspective, ignoring the scanning is the rational choice — the accounts pay, the complaints are handleable, and enforcement creates no additional revenue.

Question 3: What Happens If 140,000 Servers Are Compromised?

If the Go_SSH operation runs for 12 months at current scale and 0.3-0.5% of SSH servers fall to default credentials, the operator will have discovered valid credentials for approximately 66,000-110,000 unique servers (accounting for re-finds and credential rotation). Extrapolating to 24 months: up to 140,000 servers.

For context:

• The Mirai botnet, at peak, controlled ~600,000 devices and conducted the largest DDoS attack in history (1.2 Tbps, Dyn DNS, October 2016)
• The SolarWinds compromise affected ~18,000 organizations but is considered one of the most significant cyber incidents in history
• A database of 140,000 valid SSH credentials represents potential access to servers collectively hosting millions of users' data, thousands of businesses' operations, and an unknown number of critical infrastructure systems

Question 4: Why Hasn't This Been Stopped?

Chapter 9: Defense Playbook — What Actually Works

Against a scanning operation this persistent, most conventional defenses are ineffective. Here's what works, what doesn't, and why.

What Doesn't Work

What Actually Works

PasswordAuthentication no

HASSH-Based Detection Rules

For organizations running intrusion detection systems (Zeek, Suricata, Corelight), the Go_SSH scanner can be identified by HASSH fingerprint:

# Zeek HASSH detection rule
@load base/protocols/ssh
event ssh_client_version(c: connection, version: string) {
    if (c$ssh$hassh == "16443846184eafde36765c9bab2f4397") {
        NOTICE([
            $note=SSH::Interesting_Hostname,
            $msg="Go_SSH scanner detected (primary HASSH)",
            $conn=c,
            $identifier=cat(c$id$orig_h)
        ]);
    }
    if (c$ssh$hassh == "98f63c4d9c87edbd97ed4747fa031019") {
        NOTICE([
            $note=SSH::Interesting_Hostname,
            $msg="Go_SSH scanner variant detected (secondary HASSH)",
            $conn=c,
            $identifier=cat(c$id$orig_h)
        ]);
    }
}

# Suricata rule (banner-based)
alert ssh any any -> $HOME_NET 22 (
    msg:"ET SCAN Go crypto/ssh scanner detected";
    ssh.software; content:"SSH-2.0-Go";
    threshold: type both, track by_src, count 3, seconds 60;
    classtype:attempted-recon; sid:9000001; rev:1;
)

IOC Summary

Chapter 10: The Final Reckoning

The Go_SSH scanner is not the most destructive threat in our honeypot. It doesn't deploy malware. It doesn't steal data. It doesn't mine cryptocurrency. By every traditional metric of impact, it's one of the quietest campaigns we've observed.

And that's precisely why it's the most dangerous.

📚 The Phantom ASN Ecosystem — Full Series

📋 Methodology