🏭 The Port Factory

038A documented Private Layer's 112 open ports. 038B documented w1n's dual-market verification. This letter connects the wiring behind both: a single proxy factory operating through four servers, three corporate shells, and five jurisdictions — already identified in our earlier investigation TI-019I "The Trident" as a coordinated access-broker operation.

What we found in the port forensics goes further than TI-019I. The four nodes don't just share credentials and behavior. They share the same port allocation logic, the same management infrastructure, and — when combined — they expose 386 proxy port slots serving 331 unique port numbers.

I. The Four Nodes

II. The Port Allocation Forensics

Every node runs the same pattern: a few management ports below 10000, then a dense array of proxy service ports from 10000 upward.

WinRM (port 5985) is present on every single node. This is the control plane. The operator manages all four servers via Windows Remote Management — a protocol that allows remote PowerShell execution. WinRM is the factory floor control system.

The 12000-Range Concentration

Three of four nodes show extreme port density in the 12000-12999 range:

The 12000-range is the primary proxy pool. OMEGATECH .226 alone has 84 ports in this range — one proxy port every 5.7 numbers. That's not random service allocation. That's programmatic port assignment by proxy management software.

III. Three Verification Targets — Three Markets

We now know the network verifies proxies against three different services, each served by a different node:

IV. The Defense Stack — What We See, What We Block

Our infrastructure documents every layer of this attack:

V. The Corporate Shell Architecture

Five jurisdictions. Three companies. One HASSH.

The pattern is consistent: register in an offshore jurisdiction, route through a privacy-friendly country, host in a third country, and put your abuse contact in a fourth. No single law enforcement agency has complete jurisdiction over any node.

VI. MITRE ATT&CK Mapping

This proxy factory maps to documented adversary techniques:

T1090 — Proxy T1090.002 — External Proxy T1584.005 — Botnet T1133 — External Remote Services T1078 — Valid Accounts T1571 — Non-Standard Port T1021.004 — SSH

The MITRE ATT&CK framework documents that acquired botnets may support Command and Control activity through established Proxy networks (T1090). What we're observing is the verification and quality assurance layer of exactly this infrastructure — the factory that tests whether each compromised host still functions as a proxy, before routing customer traffic through it.

VII. The Cross-Investigation Map

This operation has been documented across six investigations:

VIII. For Every Defender Reading This

This dossier exists because a single Cowrie honeypot on a home server captured 178,581 events from two IPs over 94 days. The total hardware cost of this intelligence operation: a retired enterprise workstation and an internet connection.

The defense stack — CrowdSec, MikroTik firewall rules, Cowrie honeypot, threat intelligence pipeline — is built entirely on open-source software. Every tool in this chain is available to any organization, any defender, any individual.

You don't need a SOC to fight back. You need a honeypot, a firewall, and the willingness to publish what you find.

The port factory runs 24/7 because it's profitable. It's profitable because most victims never know they're being proxied. Every published investigation makes that business model slightly less viable. Every shared CrowdSec decision makes the attacker's infrastructure slightly less useful. Every firewall rule reduces their pool of available proxies by one.

"They have 386 proxy ports across five jurisdictions. We have one honeypot and the truth. The asymmetry is real — but it favors us. Their ports need to be open to function. Our findings, once published, can never be un-published. Their infrastructure depreciates. Our intelligence compounds."

TI-2026-038C · The Permanent Siege · Letter C
Published by LSN Threat Intelligence · June 22, 2026
4 nodes · 3 shell companies · 5 jurisdictions · 386 proxy ports · 331 unique · CrowdSec banned · MikroTik documented
Cross-referenced: TI-007, TI-010, TI-014, TI-019I, TI-2026-038A, TI-2026-038B
MITRE ATT&CK: T1090, T1090.002, T1584.005, T1133, T1078, T1571, T1021.004
All data sourced from live honeypot, CrowdSec, MikroTik, Elasticsearch, and open-source intelligence.