🎭 The Shell Game

038C proved that four nodes across three shell companies are a single proxy factory — connected by HASSH fingerprint, WinRM management, and port allocation patterns. This letter names the people behind the shells.

RDAP records — the internet's registry data for IP address ownership — contain contact information that operators often obscure but cannot fully hide. When cross-referenced across all nodes in the network, patterns emerge that operators cannot disguise: shared phone numbers, shared NIC handles, shared abuse contacts, and named individuals.

And while following the RDAP trail, we discovered something the proxy factory tried to keep separate from its proxy verification operation: OMEGATECH hosts 67 command-and-control servers for 16 malware families. The same network that verifies our honeypot as a proxy also runs C2 infrastructure for Remcos RAT, AsyncRAT, Amadey, LummaC2, Mirai, and eleven more.

I. The Named Persons

RDAP (Registration Data Access Protocol) records for IP address blocks contain administrative and technical contacts — real people or personas who registered the network resources. Cross-referencing RDAP data across all nodes in the factory reveals four named individuals.

II. The Ukrainian Connection

Two Ukrainian phone numbers. Two different operators. The same proxy factory.

Both numbers are Vodafone Ukraine mobile numbers (the +380 50 prefix). Both are registered as RDAP contacts for infrastructure that shares the same HASSH fingerprint and operates within the same proxy factory documented in 038C.

III. OMEGATECH — The C2 Factory

While investigating OMEGATECH's RDAP records, we found what our honeypot proxy verification evidence only hinted at: OMEGATECH is one of the most prolific bulletproof hosting providers currently operating.

16 Malware Families on One Subnet

Our own Elasticsearch OSINT index confirmed the connection: Abuse.ch ThreatFox IOCs in our library show 158.94.210.207 serving LummaC2 Stealer executables, and Socks5 Systemz / ProxyBox botnet C2 domains resolving to OMEGATECH infrastructure. The same network verifying our honeypot as a proxy also hosts the malware that creates the proxies in the first place.

IV. The Complete Network Map

15 IP addresses. 3 ASNs. 3 shell companies. 4 named persons. 2 Ukrainian phone numbers. 1 Kharkiv email. 1 HASSH fingerprint.

V. OMEGATECH — GPU Profiling from Our Honeypot

Our PostgreSQL intelligence database confirms that OMEGATECH IPs (178.16.54.226, 91.92.240.199, 91.92.243.116) executed GPU profiling commands inside our honeypot — the same behavior documented in TI-010 "The GPU Hunter":

VI. Spamhaus, GreyNoise, AbuseIPDB — The Verdict

When Spamhaus — the internet's most trusted blocklist — drops an entire ASN, it means the network has been deemed so thoroughly criminal that every IP in it should be blocked. OMEGATECH achieved this distinction within three months of registration.

VII. The Business Model, Fully Exposed

We can now describe the complete operation:

1. OMEGATECH hosts the malware infrastructure — 67 C2 servers running RATs (Remcos, AsyncRAT, XWorm), stealers (Stealc, LummaC2), loaders (Amadey, ClearFake), and IoT botnets (Mirai, Bashlite). These tools compromise victims worldwide.
2. Socks5 Systemz / ProxyBox converts compromised machines into SOCKS5 proxy endpoints. Each victim becomes a "residential proxy" with a clean IP address.
3. Private Layer nodes verify proxies against Google and Yahoo — testing whether each enslaved machine can still forward HTTP traffic. Google-passing proxies are premium tier.
4. w1n nodes verify proxies against Yahoo AND Yandex — testing both Western and Russian market connectivity. 37 rotating SSH client versions defeat fingerprint-based detection.
5. Working proxies are sold to customers for ad fraud, credential stuffing, scraping, sanctions evasion, SEO manipulation, and any operation requiring clean residential IPs.
6. Jurisdictional arbitrage protects the operation — Seychelles, Panama, Switzerland, UK, Netherlands, Sweden, Ukraine. No single agency can shut it all down.

"We named them. Milciades Garcia. Anastasiia. Vatlin Mihail. Artem Sevastyanov. They chose shells in the Seychelles and Panama. They chose phones in Ukraine and Switzerland. They chose servers in the Netherlands and Sweden. But they all chose the same HASSH fingerprint. And they all chose our honeypot as a verification target. That choice was their mistake."

TI-2026-038C · The Permanent Siege · Letter D
Published by LSN Threat Intelligence · June 22, 2026
15 IPs · 4 named persons · 2 Ukrainian phones · 67 C2 servers · 16 malware families · Spamhaus LISTED
Sources: Cowrie honeypot, threat_intel PostgreSQL, CrowdSec, RDAP, Breakglass Intelligence, Intrinsec, GBHackers, Abuse.ch ThreatFox, Spamhaus, GreyNoise, AbuseIPDB, Elasticsearch OSINT library
Cross-referenced: TI-007, TI-010, TI-014, TI-019I, TI-2026-038A, 038B, 038C