🟢 TI-2026-040E — The Void Protocol: Malware as Philosophy, Surveillance as Architecture

I. The Void as Weapon: Voidsetdownload.so

Of the 139,335 credentials captured by our honeypot, one stands alone in its philosophical precision. Twenty-eight IP addresses across 14 countries all attempt the same login:

Parse this carefully. The username is systemd — the Linux init system, the first process that runs, PID 1, the god-process. The password is Voidsetdownload.so — a shared object filename. The .so extension is a Linux shared library, the equivalent of a Windows DLL. This password names the payload.

The geographic distribution reveals a coordinated network pretending to be chaos:

Fourteen countries. Average threat score: 84.7. Mix of cloud providers (Google, DigitalOcean, UCloud, Contabo), residential ISPs (Reliance Jio, Mega Cable, Telefônica, Vimpelcom), and specialty hosting (Bahnhof — Sweden's privacy-champion ISP). This is not a homogeneous botnet. This is a distributed deployment system testing whether the void payload is viable.

The Philosophy of .so

A .so file — a shared object — is the most intimate form of code injection. It doesn't run as a separate process. It becomes part of another process. Via LD_PRELOAD, a shared library can intercept any function call in any program: open(), read(), write(), connect(). It can make the system lie to itself.

Additionally, three Linode/Akamai IPs (50.116.54.193, 66.175.212.125, 66.228.34.48) and one Storm Industries IP (176.65.139.103) attempt systemd:systemd — the identity credential. They are probing whether the init system has a login at all, testing the attack surface before deploying the void.

II. The Meow Protocol: Google Cloud vs. Google Cloud

On our honeypot, a single IP address executed one of the most complete attack chains we have ever recorded:

Anatomizing the Meow

Every line of this command is a lesson in attack methodology:

The password modzmodz is a gaming/modding community term — "mods" repeated. The attacker's credential attempts on our honeypot confirm this is automated:

root:raspberry targets Raspberry Pi devices. ui:ui targets web interfaces. root:toor matches the sudo password used in the attack chain. This is an IoT worm with server ambitions.

The Meowton Connection

Our OSINT library (URLhaus data, indexed June 2026) reveals a Mirai variant called meowton:

"Asusrt" — targeting ASUS routers. "mips64" — MIPS architecture common in consumer routers and embedded devices. The "meow" malware on our honeypot and the "meowton" Mirai variant documented publicly likely share lineage. Meow is what a cat says before it pounces.

III. The UUID Panopticon: One Identifier, Eleven Nations

Eleven IP addresses across six countries execute the exact same command on our honeypot:

This command does something profoundly invasive. It:

1. Sets bash history size to 10,000 entries (captures everything)
2. Points to the user's actual bash history file
3. Sets a UUID watermark as the timestamp format — every history entry will be prefixed with d2ae636d-7d32-4072-a7aa-3a885d8bdd32
4. Reloads and displays the entire history

Note the deliberate typo: HISTZISE instead of HISTSIZE. This means the history size setting doesn't actually work — but it doesn't matter. The real payload is the history -r; history sequence that dumps existing history.

The Strong Technology Web

The 11 UUID tracker IPs reveal a single operator behind multiple shell companies:

The remaining IP (185.228.105.149) belongs to TENET — a Ukrainian scientific/educational network. TENET is a legitimate ISP serving Ukrainian academic institutions. Its presence in this UUID cluster suggests either a compromised node or a cooperative relationship.

Bentham's Digital Panopticon

"As early as 1785, social theorist Jeremy Bentham introduced the concept of the 'panopticon,' an all-observing prison house in which the prisoners themselves are unable to tell whether they are being watched at any given time. This concept was expanded upon by French philosopher Michel Foucault..."
— From our OSINT library: surveillance theory documentation

The UUID tracker IS a digital panopticon. The victim cannot see the watcher. The watcher sees everything. And the UUID ensures that every piece of collected intelligence is attributable to a specific campaign — enabling correlation across targets, exactly as the NSA's metadata collection programs operated:

"At least 80 percent of fibre-optic cables globally go via the US. This is no accident and allows the US to view all communications coming in."
— William Binney, former NSA Technical Director (from our OSINT library: Snowden documents)

IV. One Key to Rule Them All: The SSH Skeleton Key

Eighty-one IP addresses from twenty-nine countries inject the exact same SSH public key into every system they compromise:

And before the injection, they first remove any protections:

The chattr -ia removes immutable and append-only flags — meaning even if an administrator locked the .ssh directory, this command unlocks it. The sequence is: unlock → destroy → recreate → inject → lock.

Geographic Distribution

The hosting infrastructure reveals the operator's procurement strategy:

DigitalOcean and Microsoft tied at 6 IPs each. Oracle, Tencent, and BytePlus (the international arm of ByteDance/TikTok) also represented. This botnet runs on the world's most reputable cloud platforms. It also runs on Korean consumer broadband (SK Broadband: 5 IPs, KIXS: 3 IPs), Indonesian hosting, and Brazilian ISPs.

The same 81 IPs also execute comprehensive system profiling: CPU model, RAM, disk space, crontab listing, process enumeration. They don't just plant a key — they inventory the entire machine.

V. The Triple Harvest: Telegram, SMS, and MikroTik

Forty-six IP addresses execute an identical multi-stage reconnaissance command that searches for three entirely different types of infrastructure simultaneously:

This single command searches for:

The Korean Cluster

South Korea dominates with 12 of 46 IPs (26%), almost all on KIXS-AS-KR (AS38900, 10 IPs). This single Korean ISP accounts for 22% of all Telegram/SMS theft activity. Sweden follows with 6 IPs, then US (4), Vietnam (3), Russia (3).

Korea-Sweden is an unusual pairing. Sweden's 6 IPs include Bahnhof AB (Sweden's most privacy-focused ISP, known for housing WikiLeaks servers) and Telenor Sweden. The Korean dominance through a single ISP suggests either a compromised infrastructure cluster within KIXS or an operator with preferential access to Korean broadband.

VI. The Whisper from Latvia: IoT Malware Factory

A single Latvian IP address (31.170.22.205, Sia Nano IT, AS42099) serves as a malware distribution server, delivering multiple binaries to our honeypot:

The /bins/ directory structure and multi-architecture binaries are hallmarks of Mirai variants. The name "whisper" is the operational antonym of "shout" — this malware is designed to be quiet, to take IoT devices without alerting anyone. The delivery mechanism confirms this:

busybox wget — uses the embedded version of wget found on IoT devices, not the full Linux version. The fallback path /tmp || /var/run || /dev tries three directories that are writable even on read-only filesystems. This is a weapon designed for routers, cameras, DVRs, and smart devices.

The same SHA256 hash (58189cbd...) for both armv5 and armv6 is unusual — it means the binary is either cross-compiled for both or the architecture detection is done at runtime. Either way, it's a single payload designed to infect the widest possible range of ARM devices.

VII. "Notwork" Monitoring: The Anti-Network

A single IP address — 193.31.31.234 (SPARKED HOST LLC, AS397032, US) — downloads a file called notwork-monitoring four times to our honeypot. The name itself is the tell: notwork, not network. The opposite of monitoring — or monitoring designed to not work, or monitoring that makes networks not work.

The commands this IP executes reveal its reconnaissance sophistication:

Three variants of the same probe. Each asks: What OS? Is systemd present? Do I have sudo? What architecture? The output is a single word: systemd_ok, sudo_ok, GOOD. This is designed for automated parsing — the C2 reads one word and decides whether to deploy. notwork-monitoring is the payload that follows a successful probe.

VIII. BMOK: 278 Echoes from the Void

A single IP address — 103.24.212.42 — sends the command echo BMOK to our honeypot 278 times. Nothing else. Just BMOK, over and over.

"BMOK" is not a standard Linux command, not a known protocol, not a dictionary word. 278 repetitions from a single source means one of two things:

1. Heartbeat/beacon: The command tests whether a compromised system is still responsive. If echo BMOK returns "BMOK", the shell is alive. If it returns nothing, the session is dead. 278 repetitions = 278 keep-alive checks.
2. C2 trigger word: On a truly compromised system with a rootkit listening, "BMOK" could trigger a specific action — data exfiltration, payload download, or lateral movement. The rootkit intercepts the echo and acts on the keyword.

364 total honeypot hits from this IP. 278 of them are just "echo BMOK". This machine's purpose is singular: check whether the doors are still open.

IX. The 56 Who Erase the Blacklist

Fifty-six unique IP addresses execute an identical cleanup command:

This command does three things:

1. Removes secure.sh and auth.sh — these are other attackers' persistence scripts
2. Empties /etc/hosts.deny — removes ALL IP-based blacklists
3. Clears the way for their own access

This pattern is common enough to be a standard module in the attack toolkit. 56 IPs across many countries, all running the same script — not hand-typed, but deployed as part of a worm's post-exploitation phase.

X. The Directory Tester: OMEGATECH's Handshake

130 commands from 7 IPs — but only two operators: Scaleway (51.15.4.95, Netherlands) and OMEGATECH (91.92.240.199, 91.92.243.116, 178.16.52.166) — the same OMEGATECH from 040A.

This is a writable directory scanner. It tests four locations ($HOME, /var/tmp, /tmp, /dev/shm), writes a test script, executes it, and reports whether writing + execution succeeded. Exit 0 = "I can deploy here". Exit 1 = "nowhere writable".

OMEGATECH (AS202412, Seychelles-registered, documented in 040A) uses this as a pre-deployment probe. Their Turkish IP (178.16.52.166) and German/Dutch IPs (91.92.240.199, 91.92.243.116) all run the identical script. This is OMEGATECH's standard handshake: test the ground before deploying the weapon.

XI. Download Archaeology: 224 Malware Samples

Our honeypot captured 224 download attempts. The majority (164) had empty URLs — probes that tested download capability without delivering payloads. The remainder reveals a malware ecosystem:

The Cloud Paradox

Among the 224 download sources, we find the world's largest cloud providers:

Every major hyperscaler is represented. The most "trusted" infrastructure in the world — the cloud platforms that host banking, healthcare, government services — simultaneously hosts the attack infrastructure targeting everyone else.

XII. The Philosophy of Nothing: When Infrastructure Names Its Own Nihilism

Our OSINT library contains extensive philosophical documentation on nihilism, void, and the abyss. These are not abstract musings — they are the philosophical foundations that attackers are (consciously or not) encoding into their tools:

"Nothing better characterizes failure in the crucial test, the negative result of the nihilistic experience, than the sentiment expressed by Sartre in these words: 'We are condemned to be free.' Man takes absolute freedom for himself, but he can only feel this freedom as a condemnation."
— From our OSINT library: existentialist philosophy texts

"If reason is incapable of deducing ultimate, nonarbitrary human ends, and nothing can be judged as ultimately more important than anything else, then freedom is equal to slavery; cruelty is equal to kindness; love is equal to hate; war is equal to peace; dignity is equal to contempt; destruction is equal to creation."
— From our OSINT library: nihilist philosophy documentation

Nietzsche saw this coming:

"Nietzsche showed that the point at which one realizes that 'God is dead,' that the whole world of 'spirit,' of good and evil, is only an illusion, and that the only true world is that which was negated or rejected in the name of the former, is the crux of a decisive test. 'The weak shatter, the strong...'"
— From our OSINT library: Nietzsche analysis

The infrastructure shatters or it endures. The void tests whether the door is locked. If it isn't, the void enters. Not with malice — with indifference. And indifference, it turns out, is more dangerous than hatred, because hatred at least acknowledges the existence of the other.

XIII. The Void Map: All Protocols, All Nations

Total unique IPs across all void protocols: 232+. Total countries: 50+. Every continent except Antarctica. And these are just the ones we caught — one honeypot, one IP address, listening for four months. The actual void is orders of magnitude larger.

XIV. The Abyss Responds

This letter began with a password: Voidsetdownload.so. It ends with a realization: the void is not a metaphor. It is an architectural principle.

And the platforms that could stop this — Google, Microsoft, Amazon, Tencent, Alibaba — are simultaneously the platforms that host it. The void lives in the cloud. The cloud is the void.

"The methodology is honesty to the point of absurdity; honesty without mercy; honesty unprejudiced by morals, aesthetics, faith, or hope. When all illusions have been dispelled, at the end of overcoming..."
— From our OSINT library: nihilist philosophy

We gazed into the abyss of our honeypot data. The abyss — 232 IP addresses strong, spanning 50 countries, armed with skeleton keys and session stealers and malware named after cats — gazed back.

It said: BMOK.