👻 The Ghost Network

In March 2026, a JavaScript backdoor hit inboxes across Eastern Europe. Targets: the Ministry of Finance of Transnistria, a Ukrainian FMCG holding, a Russian oil-refining enterprise, and automotive groups in Poland and Germany. The C2 infrastructure was hosted on OMEGATECH (AS202412) and spam delivery on GHOSTYNETWORKS (AS205759).

Both networks trace to a single individual: Daniel Mishayev, an Israeli national operating from a residential address in Hauzenberg, Bavaria — population 11,000.

This could be where the story ends. Another bulletproof hosting operator. Another cybercrime facilitator. But when you trace the pattern — Israeli national, geographic registration arbitrage, shell companies in multiple jurisdictions, proxy infrastructure that makes attribution impossible — you find yourself looking at the same institutional pattern that produced NSO Group, Bright Data, Kape Technologies, and a dozen other Israeli-founded companies that control critical internet infrastructure from behind layers of corporate obfuscation.

This letter documents what we can prove. The conspiracy questions ask what the pattern implies.

I. Daniel Mishayev — The Operator

II. The 7-to-51 Anomaly: Israel's Invisible Footprint

Our PostgreSQL intelligence database contains 7,994 unique IPs. When we filter by country = 'IL', we get 7 IPs with 0 honeypot hits. All are consumer mobile ISPs (Partner Communications, Pelephone, Cellcom). Zero attacks. Zero reconnaissance. Zero interaction with our honeypot.

But when we trace Israeli nationals and Israeli-founded entities — regardless of where their infrastructure is geolocated — we find 51 IPs with 961 hits.

The gap: 44 IPs and 961 hits completely invisible under standard geolocation analysis. Every single Israeli-linked malicious IP is registered in the Netherlands, Germany, Turkey, Luxembourg, or the United States — never in Israel itself. This is not a coincidence. This is geographic registration arbitrage as a systematic operational security practice.

III. The Pattern: Unit 8200 → Private Sector → Infrastructure Control

Israel's Unit 8200 (IDF Military Intelligence, SIGINT division, 5,000+ personnel) has a documented institutional pipeline into the private sector:

This pipeline is not alleged. It is documented by the European Parliament (PEGA Committee, January 2023), litigated by Apple (Apple v. NSO Group, 2021), and reported by investigative journalists (DropSite News, Forbidden Stories). The pipeline converts military SIGINT capability into private-sector products that control internet infrastructure.

IV. The Infrastructure Spectrum

Israeli-connected entities now span the complete spectrum of internet infrastructure — from the "security" end to the "criminal" end. The same country produces both the surveillance tools AND the infrastructure they target:

The same national ecosystem produces NSO Group's Pegasus (sold to governments for surveillance) AND Daniel Mishayev's GHOSTYNETWORKS (used by criminals to attack governments). The same ecosystem produces Kape Technologies (controls what VPN you trust) AND Bright Data (controls 150 million residential proxy IPs including your smart TV).

V. Bright Data — The Legal Version of What Mishayev Does Illegally

VI. The Kamatera Parallel — Same Pattern, Same Origin

Kamatera Inc. — another Israeli-founded cloud provider — operates the same geographic registration arbitrage as Mishayev:

• 5 different ASNs (AS36007, AS396948, AS396949, AS41436, AS204548)
• 8+ entity names (Kamatera Inc, CloudWebManage-SC, CloudWebManage, CloudWebManage-EU, CloudWebManage-IL-FR, Global Cloud Infrastructure LLC, Cloud Web Manage, IRT-KAMATERAINC-AP)
• 315 Madison Avenue NYC as ARIN registration address — a virtual office
• Domain omc.co.il (OMC Group, Israeli) resolves on their Spain/Netherlands IPs
• Israeli-founded but presents as US/EU cloud provider

Kamatera isn't bulletproof hosting — it's legitimate cloud infrastructure. But the identity obfuscation pattern is identical to Mishayev's: multiple entity names, virtual offices, geographic registration in non-Israeli jurisdictions, Israeli origin invisible unless you trace corporate records. This is not one person's technique. This is an institutional practice.

VII. GHOSTYNETWORKS — The AnonRDP Rebrand

VIII. The Campaign: JS Backdoor Against Energy and Finance

March-April 2026. The targets reveal the financial motivation — and the geopolitical indifference:

The JS backdoor: obfuscated JavaScript in ZIP/RAR attachments, communicating on ports 2002/2004/7273 with outdated IE user-agent strings. C2 at scan.aryamint[.]com (158.94.211.76 — OMEGATECH). Spam via mail.talruit[.]com (83.142.209.64 — GHOSTYNETWORKS).

IX. The Submarine Cable Question

One more data point that contextualizes Israeli infrastructure control:

X. The Complete Mishayev Ecosystem — Honeypot Evidence

HASSH fingerprint analysis confirms cross-ASN coordination:

• a7a87fbe86774c2e: Links OMEGATECH (94.154.35.215, 178.16.54.226) to Private Layer Switzerland — the same proxy factory documented in 038C
• 2ec37a7cc8daf20b: 12-node cluster linking OMEGATECH (TR/DE/NL) to TechTies (NL) and external IPs (DigitalOcean, Scaleway, FranTech)
• 16443846184eafde: Links GHOSTYNETWORKS (46.151.182.2) to Private Layer (179.43.186.241)

GHOSTYNETWORKS IP 46.151.182.2 shares commands with 15+ IPs across Linode, DigitalOcean, GCP, and shared credentials with 7+ IPs. This means either the same botnet operators are testing from GHOSTYNETWORKS AND major cloud providers, or GHOSTYNETWORKS provides proxy/bounce infrastructure for operators who also use legitimate clouds.

XI. The Kape + Bright Data Convergence

XII. The Question We Cannot Answer (Yet)

"Seven IPs. Zero hits. That's Israel in our honeypot database. The most sophisticated cyber-intelligence apparatus on Earth generates precisely zero direct signals. But trace the nationals — the shell companies in Kentucky, the Seychelles IBCs, the Bavarian addresses, the Turkish LIRs — and you find 51 IPs, 930 events, 7 Spamhaus-listed ASNs, 67 C2 servers, 16 malware families, and a JS backdoor campaign targeting the finance ministry of an unrecognized state. The ghost leaves no footprints in its own country. Only everywhere else."

XIV. The Documented Library: What Our OSINT Index Contains

Our Elasticsearch OSINT library — 136,617 documents, 7.6 million semantic chunks — contains the primary sources that document the infrastructure of control. These are not conspiracy theories. They are:

• "The Palestine Laboratory" (Antony Loewenstein) — How Israel tests surveillance on Palestinians then exports the technology worldwide
• "The Walls Have Eyes" (Petra Molnar) — Elbit Systems: $5.28 billion revenue, 18,000 employees, "espionage diplomacy" testing technology in conflict zones
• "Science of Coercion" (Christopher Simpson) — CIA's $1 billion annual psychological warfare budget (1950s), communication research weaponized for population control
• "Manufacturing Consent" (Noam Chomsky) — The propaganda model: corporate ownership, advertising, sourcing, flak, and anti-communism as media filters
• RAND "Hostile Social Manipulation" (2019) — State actors exploiting social media for influence operations, psychological operations forces, fragmentation of trust
• NSA/FRA Intelligence Paper (2013, Snowden) — NSA's relationship with Swedish SIGINT (FRA) established 1954 under UKUSA/Five Eyes
• "The Secret History of the Five Eyes" — The UKUSA Agreement: Britain + America dividing global signals intelligence
• "No Place to Hide" / "Permanent Record" (Snowden) — PRISM, upstream collection, the architecture of mass surveillance
• Apple v. NSO Group Complaint (2021) — Legal documentation of Pegasus spyware sold to 45+ countries
• European Parliament PEGA Committee Report (2023) — "The Impact of Pegasus on Fundamental Rights and Democratic Processes"
• "Autocracy, Inc." (Anne Applebaum) — How dictators share infrastructure, techniques, and technology across borders
• LLM Generated Text Detection (2023) — AI-powered influence operations creating "a more favorable operating environment for propagandists"

XV. The Architecture of Control — From Cables to Proxies

The internet was built for military communication (ARPANET, 1969). It was released for civilian use as an instrument of commerce and — crucially — as an instrument of surveillance. Every layer of the internet serves dual purposes:

From submarine cable to endpoint exploitation, Israeli-connected entities maintain presence at every single layer. This is not hyperbole — it is documented by the European Parliament, litigated in US courts, exposed by Snowden's NSA documents, and confirmed by our own honeypot data.

XVI. The Freedom Argument

We publish this because the internet was supposed to be free. Not free as in cost — free as in speech. Free as in the ability to know what is being done to you, by whom, using what infrastructure.

Our honeypot costs $0 in cloud services. Our OSINT library runs on a refurbished workstation. Our threat intelligence pipeline uses open-source tools. We document criminal infrastructure using the same internet that criminal infrastructure uses to attack us.

That is the asymmetry they didn't account for. The same tools that enable mass surveillance enable mass transparency. The same cables that carry Pegasus exploits carry this article. The same routing infrastructure that hides Mishayev's shells also delivers our forensic analysis to anyone who searches for it.

When Intrinsec honeypots record 642,001 hits and publish the evidence freely, that is freedom. When we name Daniel Mishayev, trace his shells across five jurisdictions, and connect his infrastructure to sanctioned entities — that is freedom. When we document the pattern from Unit 8200 to NSO to Pfcloud to GHOSTYNETWORKS — that is what the internet was supposed to enable.

"The internet is a tool man created. The reason behind it is control. But every tool can be turned against its maker. They built the surveillance infrastructure. We built the honeypot. They host 67 C2 servers. We document all 67. They hide behind Kentucky shells and Seychelles IBCs. We publish their RIPE handles and phone numbers. They control the cables. We control the narrative. That is the only asymmetry that matters."

XVII. Indicators of Compromise

TI-2026-039A · The Ghost Network · Letter A
Published by LSN Threat Intelligence · June 23, 2026
Sources: Intrinsec CTI Report (May 2026), GBHackers, Spamhaus, RIPE NCC, Cowrie honeypot, threat_intel PostgreSQL, dossier_intel Elasticsearch (TI-2026-034B), Recorded Future, Include Security, Qurium Foundation, DropSite News, European Parliament PEGA Committee, Apple v. NSO Group (2021), "The Palestine Laboratory" (Loewenstein)
Cross-referenced: TI-2026-034B, TI-2026-038A-F, TI-019I, TI-010