💰 Follow the Money

The previous letters documented the machinery: the proxy hunters (037A), the post-compromise operators (037B), the malware delivery networks (037C), and the statistical census of the entire ecosystem (037D).

Now the question the census demanded: who pays for all of this, and how?

Seven distinct botnets. 2,190+ IPs. Cloud servers costing money. Bulletproof hosting costing more money. Custom Go scanners costing development time. Paramiko pipelines costing engineering effort. The 1,247-character reconnaissance command that checks for socat, chisel, gost, MikroTik, OpenWrt, and Ubiquiti — someone wrote that. Someone maintains it. Someone pays that person.

The SSH exploitation ecosystem is not chaos. It is a market. And markets have prices.

I. The Five Revenue Streams

A single compromised SSH server can generate revenue through five distinct channels simultaneously. The operator who gains access in the first ten seconds (037B) doesn't necessarily monetize it. They sell access. The buyer might use it for any combination of the following:

II. Revenue Stream 1: The Residential Proxy Market

This is why the ISAEV go_scanner cluster exists (037A). The 1,247-character reconnaissance command doesn't check for socat and chisel and gost by accident. It checks because those tools convert an SSH server into a SOCKS5 proxy — and residential SOCKS5 proxies are worth money.

The Market

The residential proxy market is not underground. It is a publicly traded industry.

What Our Honeypot Proves

The go_scanner's reconnaissance command checks for:

• AllowTcpForwarding, PermitTunnel, GatewayPorts — SSH tunneling capabilities
• socat, chisel, gost — proxy and tunneling tools
• MikroTik, OpenWrt, Ubiquiti firmware signatures — router identification

This is a capability assessment for proxy recruitment. The scanner is determining: can this device be turned into a relay? The 91% success rate documented in 037A — 3,942 successful logins out of 4,336 attempts — means ISAEV's cluster identifies and enrolls residential proxies at industrial scale.

III. Revenue Stream 2: Cryptomining on Stolen Compute

The GPU Hunter profile from 037B executes nvidia-smi and lspci | grep -i nvidia within the first ten seconds. They are not checking for graphics cards to play games. They are checking for mining capacity.

Our census (037D) identified 3 IPs specifically targeting NVIDIA-equipped servers. But the real cryptomining operation is invisible in our data because the miners don't need SSH access — they are deployed via the malware payloads documented in 037C. The whisper ARM malware, the meow Mirai variant, the notwork-monitoring iterative builds — each likely includes mining capability alongside their primary function.

The Google Cloud Arbitrage

The meow botnet operators (037B) run their entire infrastructure on Google Cloud — scanner, C2, backup C2, all on GCP. The free trial abuse pattern documented in our data creates a specific economic model:

IV. Revenue Stream 3: The Credential Market

Not all operators exploit the access they gain. Many are access brokers — they compromise, catalog, and sell. The Go_SSH cluster from 037D is the clearest example: 49% success rate, 432 commands, zero downloads. They log in, profile the system, and leave. The profiling data — OS version, installed software, network position, available resources — determines the price.

V. Revenue Stream 4: Ransomware-as-a-Service

The most lucrative downstream use of SSH access is ransomware deployment. FinCEN's analysis of Bank Secrecy Act filings identified $1.2 billion in ransomware-related suspicious activity in 2021 alone, with the true figure estimated significantly higher due to unreported payments.

The connection to our data: ransomware affiliates purchase SSH access from the same access brokers who profit from the Go_SSH compromises. The Go_SSH operators (037D) profile systems without deploying payloads. The ransomware affiliate — operating under a separate identity, through a separate chain of proxies — purchases the access listing, deploys the ransomware, and negotiates the ransom. The SSH compromise is step one of a supply chain that ends with a hospital paying $200,000 in Bitcoin.

VI. Revenue Stream 5: The Data Market

The mdrfckr SSH key injector from 037B installs a persistent RSA-2048 backdoor. This provides indefinite future access to the compromised system. For servers that process or store data — databases, web servers, mail servers — this access enables continuous data exfiltration.

The value depends entirely on what the server contains:

VII. The Infrastructure Costs — What the Attackers Spend

Every revenue stream requires infrastructure investment. The census data lets us estimate what the seven botnets actually cost to operate.

* Free cloud trial abuse. † Running on already-compromised infrastructure (cost externalized to victims).

VIII. The Money Laundering Pipeline

Revenue generated through SSH exploitation flows through a documented financial pipeline. Europol's Cryptocurrency Tracing Report and FinCEN's SAR analysis describe the standard laundering process:

IX. The Scale of the Economy

Combining the five revenue streams with the census data from 037D:

These estimates are derived from one honeypot seeing one IP address. The actual scale — across the entire IPv4 space, across SSH, Telnet, RDP, HTTP, and every other protocol — is orders of magnitude larger.

The US Treasury estimated $1.2 billion in ransomware-related suspicious activity in 2021. Chainalysis tracked $1.1 billion in ransomware payments in 2023. The residential proxy market alone is estimated at $3-7 billion annually. Cryptojacking adds another $200-400 million.

The total SSH exploitation economy — from the first scan to the last laundered dollar — likely exceeds $10 billion annually.

X. Who Gets Paid — The Distribution

The revenue does not flow evenly. Like any industry, value concentrates at the top.

XI. The Structural Conclusion

The SSH exploitation economy is not a criminal underworld. It is a shadow economy operating in parallel with — and sometimes within — the legitimate technology sector.

"A publicly traded Israeli company purchases bandwidth from a botnet that recruits devices via SSH brute-force. A Chinese cloud giant hosts 23% of a classified botnet through its Singapore subsidiary. A Latvian apartment in Riga serves malware to ARM devices with zero abuse reports. A Panamanian-Swiss shell company runs 57 proxy ports visible to anyone with a Shodan account. And at the bottom of the chain, a Raspberry Pi with the factory password pi:raspberry becomes someone's exit node."

This is not a failure of technology. SSH is cryptographically sound. Key-based authentication is provably secure. The protocol itself is not broken.

What's broken is the incentive structure. The cloud provider profits from the botnet operator's server rental. The bulletproof host profits from the scanner's persistence. The proxy company profits from the compromised router's bandwidth. The cryptocurrency exchange profits from the laundering transaction fee. The device manufacturer profits from selling a router with admin:admin as the factory default.

Everyone in the chain profits except the victims.

That's not a bug. That's the business model.

TI-2026-037E · Ghost Machines Series · Letter E
Published by LSN Threat Intelligence · Data: LSN Cowrie Honeypot + FinCEN + Europol + KrebsOnSecurity
5 revenue streams · 7 botnet ROIs · $10B+ annual economy
All data sourced from proprietary honeypot deployment, open-source intelligence, and government publications.