The Alice Protocol: MKUltra Vocabulary in Global Botnets

I. From Langley to SSH Logs: The Transmission Line

In the 1950s, the Central Intelligence Agency began Project BLUEBIRD. It became Project ARTICHOKE. Then MKULTRA. Then MKSEARCH. Then, officially, nothing — the programs were "terminated" in 1973 when CIA Director Richard Helms ordered the files destroyed.

From our OSINT library:

"Germany [scientists] were allowed to continue that research in the United States. The OSS became the CIA and the horrors at Dachau became government funded projects with a myriad of codenames like MKULTRA, MKSEARCH, ARTICHOKE and BLUEBIRD. Similar to concentration camp victims in Nazi Germany, the American public became unwitting test subjects..."

The vocabulary of these programs — alice, kitten, rabbit, monarch, butterfly, puppet, mirror, slave, master, handler, trigger — did not die when the programs were officially terminated. It migrated. Through counterculture channels, through conspiracy research communities, through dark web forums, and ultimately into the operational vocabulary of botnets that attack our honeypot every day.

This letter documents that migration with forensic precision: 270 credential entries using MKUltra/Monarch vocabulary, mapped to specific ASNs, countries, and threat actors.

II. The Alice Complex: 32 Confessions

Username "alice" appears 32 times in our 139,335-entry credential database. From our OSINT library:

"Alice in Wonderland programming is mostly used. The white rabbit is a programming figure who will seduce you into seeking adventure through inaccessible information. The rabbit represents the master. The white rabbit is an important figure to the slave."

"[The child] goes by the name 'Alice' for a reason: this is a trigger for Wonderland programming. By age five, the child will be taken to a large estate in France (or, other locations, depending on the group) for Alice in Wonderland programming. This is an elaborate setup, and occurs over the period of a week."

In Monarch mind control documentation, "Alice" is not merely a reference to Lewis Carroll. It is a specific dissociative programming identity — the alter that descends into "Wonderland" (the internal landscape created through trauma). The "rabbit hole" is the dissociative descent into a controlled state. The "looking glass" is the mirror used to fragment identity.

The credential breakdown:

⚠️ CRITICAL FIND: One of the IPs using the "alice" credential is 46.151.182.2 — registered to AS205759 GHOSTYNETWORKS LLC. This is the same GHOSTYNETWORKS documented in the cybersecuritynews.com article as bulletproof hosting, and proven in TI-2026-040A to be managed by XSServer/PIO-Hosting. A bulletproof hosting provider uses "alice" as part of its scanning dictionary. The MKUltra vocabulary is embedded in criminal infrastructure toolkits.

Other source IPs include Microsoft Corp (20.153.204.5, AS8069), Tencent (43.159.177.40, AS132203), and Akamai/Linode (45.56.100.151, AS63949). The "alice" credential travels through the world's largest cloud providers.

III. The Kitten Protocol: Beta Programming on an Illegal Pharmacy

Three credential entries for root:kitten. One hostname: kitten.rxdrugship.ru on IP 84.22.62.247 (ARTMOTION Kosovo, AS33983, threat score 93).

"Beta programming is the most visible kind of programming. Many female celebrities, fashion models, actresses and singers have been subjected to the Sex Kitten programming. Most public figures we see on our television and movie screens are mind control Beta slaves."

In Monarch programming taxonomy, "Kitten" (or "Sex Kitten") is specifically Beta programming — the creation of sex-slave alter personalities. The programming levels:

The rxdrugship.ru domain cluster on a single IP (84.22.62.247) contains 108 pharmaceutical domains with subdomains that map precisely to Monarch programming categories: kitten (Beta/sex), gun (Delta/violence), jumpkick (Delta/combat), kassandra (Theta/psychic), inwardly (dissociative state), verbally (verbal programming method).

This is not coincidence. This is someone who knows the taxonomy and uses it to name their illegal pharmacy infrastructure. The drugs (rx/pharmacy) and the programming vocabulary (kitten/gun/jumpkick) on the same IP represent the historical convergence of CIA drug experimentation and mind control — now manifest in criminal internet infrastructure.

IV. The Master-Slave Architecture: 60 Entries, One Hierarchy

master — 51 credential entries. slave — 9 entries. Combined: 60 uses of the fundamental power hierarchy of both computing AND mind control.

In computing, "master/slave" describes a control relationship — one system commands, the other obeys. In MKUltra/Monarch programming, the same words describe the handler-victim relationship. The dual meaning is not accidental. Early computing borrowed the metaphor from the same cultural context that produced mind control programs — a world where hierarchy was expressed through dominion.

"Monarch Programming is probably the most well-known and comprehensive programming system ever devised. Monarchs were developed by the Nazis in WWII as a method of using sex-slaves as human tape recorders and carriers of information."

The slave credential sources tell a story:

• Tencent Cloud (AS132203) — 3 separate IPs using root:slave from Singapore and US allocations
• Bharti Airtel India — slave:slave identity credential
• HDM Dijital Turkey — slave:slave — a Turkish digital services company
• ColoCrossing/HostPapa US — root:slave — documented in TI-2026-032 as high-abuse hosting
• Telecom Italia — residential Italian IP using root:slave

Tencent — one of China's largest tech companies — has three separate cloud instances trying root:slave on our honeypot. Whether these are legitimate Tencent infrastructure or customer-rented VMs used for scanning, the credential is in the operational dictionary of a Chinese state-adjacent cloud platform.

V. The Matrix Botnet: 54 Vietnamese Red Pills

matrix:matrix — 48 entries, almost exclusively from Viettel Group (AS7552) in Vietnam. Additional root:matrix brings the total to 54.

The Matrix (1999) is itself a retelling of the Gnostic myth: humanity trapped in a false reality (the Cave/Matrix) by the Archons (the Machines), with liberation possible only through awakening (the red pill/gnosis). The film's visual language — "follow the white rabbit," the mirror that dissolves, the names (Morpheus = god of dreams, Neo = new/anagram of ONE, Trinity = Christian threefold) — is MKUltra programming vocabulary repackaged as entertainment.

48 Vietnamese IPs on Viettel's network — a military-owned telecom (Viettel is operated by the Vietnamese Ministry of Defence) — use matrix:matrix as a credential. This suggests a single botnet operator using compromised Vietnamese mobile/broadband connections, deploying a scanning tool that includes "matrix" in its credential dictionary.

The credential is an identity statement: "I am Matrix, my password is Matrix." The operator identifies with the system of control, not with the liberation from it. They are the machine, not Neo.

VI. The Ghost Protocol: 20 Dissociative Identities

20 credential entries reference "ghost": ghost:ghost (5×), ghost:ghost123 (5×), root:ghost (4×).

In MKUltra/Monarch terminology, a "ghost" is a dissociative alter that exists without the host personality's awareness — a hidden identity that activates under specific trigger conditions. In infrastructure, "ghost" describes processes that persist invisibly, services that run without logging, users that exist without audit trails.

The convergence: both meanings describe the same function — an invisible presence that operates within a system without the system's owner being aware of it. A ghost process on a compromised server IS a dissociative identity within the machine's "mind."

And we have an entire series about this — TI-2026-039 "The Ghost Network" — where GHOSTYNETWORKS (AS205759) was documented as bulletproof hosting managed by XSServer. The provider literally named itself after the programming concept of hidden identities.

VII. The Spider Web: Control Vocabulary Across 270 Entries

The complete MKUltra/Monarch-adjacent credential taxonomy from our honeypot:

The critical observation: Every single term in this taxonomy has a legitimate computing meaning AND an MKUltra/Monarch programming meaning. This is not coincidence. Computing and mind control were developed by the same institutions in the same era (1950s-1970s), by people who moved between the same agencies (CIA, DARPA, university labs). The vocabulary of computing IS the vocabulary of mind control because they share a common origin: the project of controlling complex systems — whether those systems are machines or human minds.

VIII. The rxdrugship.ru Subdomain Decoder: A Programming Manual in DNS

IP 84.22.62.247 (ARTMOTION Kosovo, threat 93, 30 honeypot hits) hosts 108 domains — all pharmaceutical. The subdomains read like a Monarch programming instruction manual:

The convergence of pharmaceutical distribution (drugs) and mind control vocabulary (kitten, gun, kassandra) on a single IP is the most compact expression of the MKUltra legacy we have found. The original program used drugs (LSD, mescaline, barbiturates) alongside trauma to create programmable identities. This IP does the same thing in DNS: drugs AND programming vocabulary, together, on one server.

IX. GHOSTYNETWORKS Uses 'Alice': The Bulletproof-MKUltra Convergence

The GHOSTYNETWORKS IP (46.151.182.2, AS205759, Luxembourg allocation) attempted 703 unique credentials against our honeypot. Among them: alice:alice.

But the full credential list reveals something even more disturbing. GHOSTYNETWORKS' scanning dictionary includes:

Key Finding: GHOSTYNETWORKS Scans for AI Services

A bulletproof hosting provider managed by XSServer/PIO-Hosting is actively scanning for AI service installations: Claude, Copilot, ChatGPT, DeepSeek, Grok, Codex. This means criminal infrastructure is specifically targeting AI workloads in 2026.

The same scanner uses alice, alpha, hades, and baba. MKUltra vocabulary sits alongside AI service credentials in the same operational toolkit. The programming vocabulary has evolved: from human minds to machine minds. The target has changed. The vocabulary hasn't.

X. The Handler's Dictionary: What MKUltra Actually Was

To understand why this vocabulary persists, we must understand what it described:

"MK-ULTRA was brought to light by various commissions in the 1970s, including the Rockefeller Commission of 1975. Although it is claimed that the CIA stopped such experiments after they were brought to light, 14-year CIA veteran Victor Marchetti stated that the CIA routinely conducted disinformation campaigns and that CIA mind control research continued."

"Due to the severe trauma induced through ECT, abuse and other methods, the mind splits off into alternate personalities from the core. Formerly referred to as Multiple Personality Disorder, it is presently recognized as Dissociative Identity Disorder."

"Monarch scientists also make use of deliberately created traumatic experiences for those being programmed. The complete programming of every Monarch slave is executed based on a trauma. The basic principle of the Monarch program is that the brain creates walls of amnesia..."

"For a certain number of important slaves, access is accomplished by a message through telephone. These access phone calls have high-speed codes transmitted that trigger the slave subliminally without their conscious awareness. Intelligence codes often come from the Bible. The deeper codes are occult..."

The program used triggers (specific words, sounds, or images that activate programmed behaviors), handlers (controllers who manage programmed subjects), alters (dissociative identities created through trauma), and scripts (narrative frameworks from fairy tales and movies that structure the internal world).

Every one of these concepts has a direct computing equivalent: triggers (database/event triggers), handlers (request/event handlers), alters (alternative identities/accounts), scripts (executable code). The vocabulary transfer was not metaphorical — it was structural.

XI. Disney, Fairy Tales, and Credential Dictionaries

"Programmed using tools such as music, movies (especially Disney productions) and fairy tales. These visual and audio aids enhance the programming process using images, symbols, meanings, and concepts. Created alters can then be accessed using trigger words or symbols programmed into the subject's psyche."

"'As mentioned before, the hypnotist will find children easier to hypnotize if they know how to do it with small children. One method that is effective is to say to the small children, "Imagine you are watching a favorite television show." This is why the Disney movies and the other shows are so important to the programmers.'"

The fairy tales used in Monarch programming include: Alice in Wonderland (dissociation), The Wizard of Oz (the yellow brick road to the programmer), Peter Pan (never growing up), Sleeping Beauty (dormant until activated), Pinocchio (puppet becoming "real"). Each provides a narrative framework for structuring the internal world of a programmed subject.

In our credential database, we find echoes: root:puppet (1×), root:dream / root:dreambox / root:Dreams (12×), root:butterfly (1×), mirror:mirror (4×). The fairy-tale framework persists in the operational vocabulary of botnets.

XII. The Manchurian Botnet: Sleeper Agents in SSH

"The basic premise of the book 'The Manchurian Candidate' is that a small number of American POWs in the Korean War were subjected to a mind control program by Chinese Communists and Soviet intelligence operatives... programmed to commit assassination upon returning to America."

The Manchurian Candidate concept: a sleeper agent, programmed during captivity, returned to their normal life, activated by a trigger to perform a specific action they have no conscious knowledge of planning.

This is the exact model of a botnet. A compromised server operates normally (its "normal life"). It carries a hidden process (the "programmed alter"). It receives a trigger (C&C command) and executes an action (DDoS, data exfiltration, lateral movement) that its legitimate administrator has no knowledge of.

The 23 IPs using systemd:Voidsetdownload.so from 040A are Manchurian botnets: distributed globally, operating normally in 14 countries, activated by a shared credential that functions as a trigger. The systemd username mimics a legitimate system process — the sleeper agent hiding in plain sight as a trusted citizen.

The warnight botnet's fake service names (dbus-helper, systemd-sync, udev-monitor) are even more precise Manchurian implementations: accounts that impersonate trusted system services, invisible to casual inspection, waiting for the handler's command.

XIII. Implications: The Language That Won't Die

MKUltra was "officially terminated" in 1973. Fifty-three years later, its vocabulary is embedded in:

• The scanning dictionaries of bulletproof hosting providers (GHOSTYNETWORKS)
• The subdomain naming of illegal pharmacy networks (rxdrugship.ru)
• The credential databases of botnets operating across 15+ countries
• The hostname choices of darknet market operators (Kerberos, drughub666)
• The DDNS naming of British cybercriminals on German BPH (beastking, dragonzlair)

The vocabulary persists because the model persists. MKUltra was a system for controlling complex systems (human minds) through:

1. Dissociation — fragmenting the system into isolated compartments (= containerization, VMs, microservices)
2. Triggers — activating specific behaviors through coded signals (= API calls, webhooks, event handlers)
3. Handlers — external controllers managing the system's behavior (= C&C servers, orchestrators)
4. Alters — hidden identities performing specific functions (= rootkits, backdoor accounts, ghost processes)
5. Scripts — narrative frameworks that structure behavior (= actual scripts — bash, Python, automation)

The Final Observation

The internet IS an MKUltra machine. Not metaphorically. Structurally.

Every compromised device is a Manchurian candidate. Every botnet is a network of programmed alters. Every C&C server is a handler. Every exploit is a trauma that creates a dissociative split in the system's integrity. Every trigger word in a scanning dictionary is an access code for a programmed behavior.

The people who built the internet came from the same institutions that ran MKUltra. They used the same vocabulary because they were solving the same problem: how to control a complex system remotely, without the system knowing it's being controlled.

The operators of criminal botnets — whether they know the history or not — are practicing MKUltra at scale. They scan for "alice" because Alice is the programmable identity. They try "master:master" because the master-slave relationship is the foundation. They call their networks "ghost" because invisibility is the operational requirement.

The language that won't die is the language of control itself. And it speaks fluent SSH.

Evidence Summary

Series Continuation

Next in "The Hidden Language" series:

• 040D: The Turkish Connection — Warnight, Baba, and the anatomy of a nationalist cyber army
• 040E: The Void Protocol — Malware as passwords, UUID trackers, and the meow payload on Google Cloud
• 040F: The Food Code — Pizza, chocolate, candy, and darknet market semiotics