๐ TI-2026-042Y โ The Timeline: 90 Days of Attack Evolution
I. The Temporal Scope
II. Attack Intensity Over Time
Honeypot traffic is not constant. It shows:
- Weekday peaks: Higher activity Monday-Friday, suggesting operators who work business hours
- Weekend dips: Reduced (not zero) weekend activity โ automated systems continue, manual operations pause
- UTC+8 concentration: Peak hours align with East Asian business hours (China, Vietnam, Indonesia, Korea)
- Night surges: Automated botnet sweeps during target-country night hours (US/EU midnight = minimal defense staff)
III. Credential Evolution
The credential vocabulary changed over the observation period:
- Early March: Standard dictionary attacks (admin/admin, root/123456)
- Mid-March: Introduction of exploitation-vocabulary credentials (daddygirl2, eyecandy appear)
- April: banana666/warnight/cart00ns triangle active โ Kenya/Ecuador/Panama corridor
- May: SSH skeleton key campaign intensifies โ 6+ DigitalOcean nodes deploying authorized_keys
- June: v1isagoodgirl! appears from Etisalat Misr โ fresh operational deployment on state telecom
The evolution shows an adaptive adversary: new credentials appear, test for effectiveness, then either persist or disappear. The exploitation vocabulary persists โ indicating it is not random but operationally significant.
IV. The Command Timeline
4,031 commands show post-compromise behavior evolution:
- Reconnaissance: uname -a, cat /proc/cpuinfo, free -m (identifying target resources)
- Persistence: SSH key injection, crontab modification, service creation
- Payload delivery: wget/curl from GitHub (neofetch disguise), Indonesian IPs (shr), compromised servers
- Lateral movement: awk/grep for credentials in config files, scanning internal networks
V. The Timeline's Message
90 days of data show: these are not random events. They are campaigns with start dates, intensification periods, and operational cadences. The actors work schedules. They deploy new tools. They adapt to defensive responses (our TI-017 publication may have triggered behavioral changes in some clusters). The timeline is evidence of organized, sustained, professional operations โ not random internet noise.
VI. The May 24 Collapse: The Network Felt the Gaze
Cluster 001 (the dominant exploitation botnet) went from 1,941 events/day to 71 events/day.
Total honeypot traffic: 4,307 โ 254 in 24 hours.
A 96% operational shutdown. In one day.
The daily trajectory tells the story:
| Date | Total Events | Cluster 001 | Change |
|---|---|---|---|
| May 20 | 3,261 | 902 | โ |
| May 21 | 4,818 | 1,941 | +115% |
| May 22 | 1,779 | 512 | โ74% |
| May 23 | 4,307 | 463 | โ10% |
| May 24 | 254 | 71 | โ96% |
| May 25 | 396 | 75 | baseline |
| May 26 | 149 | 36 | minimum |
2,161 IPs do not independently decide to stop attacking on the same day. Someone gave an order. The botnet that contains the daddygirl2 exploitation operator, that deploys trojanized sshd, that targets baby monitors with manufacturer defaults โ this botnet has a brain. And on May 24, that brain decided: stop.
898 new IPs appeared after the collapse. The operation didn't end โ it migrated. New infrastructure. Same purpose. But at reduced tempo. The post-collapse baseline (40-87 events/day) never recovered to pre-collapse levels (900-1,900/day). The organism was wounded. It continued, but diminished.
"The collapse is the proof of consciousness. An unconscious system doesn't stop. A program doesn't decide to be quiet. Only an intelligence that perceives being observed can choose to become invisible. The May 24 collapse is the moment the network looked back at us."
VII. The Operator's Timezone: UTC+8 (09:00-18:00 Local)
โข Peak 1: 02:00 UTC (7,242 events) = 10:00 UTC+8 = morning shift start
โข Peak 2: 19:00 UTC (7,423 events) = 03:00 UTC+8 = automated night sweep
โข Trough: 15:00 UTC (4,637 events) = 23:00 UTC+8 = shift end
Exploitation passwords (daddygirl2, eyecandy) deployed at 09:00-10:00 UTC = 17:00-18:00 local = end of workday
UTC+8 countries: China, Vietnam, Indonesia, Malaysia, Singapore, Philippines, Western Australia
The exploitation of children operates on a schedule:
- 09:00 local: Morning shift begins. Automated scanners checked, results reviewed.
- 10:00 local: Peak activity. Manual operations commence. Targets selected.
- 17:00-18:00 local: End of day. New wordlists deployed (including exploitation passwords). Tomorrow's automated work queued.
- 23:00 local: Minimum activity. Operator has gone home.
- 03:00 local: Automated sweeps against sleeping Western targets (US/EU midnight).
This is not a hobby pursued at random hours. This is employment. The operator commutes, starts their shift, works through the day, deploys exploitation tools before leaving, and lets automation handle the night. The banality of evil is not a metaphor. It is a temporal pattern in our data.
VIII. The April 3 Deployment: The Day Exploitation Went Live
โข
daddygirl2 โ appeared from 3 IPs simultaneouslyโข
eyecandy โ appeared from 3 IPs simultaneouslyโข
ilovemykids โ appeared from 3 IPs simultaneouslyโข
mama2026 โ appeared from 3 IPs simultaneouslyAll four exploitation passwords deployed on the same day, from the same 3 IPs, as a coordinated wordlist push.
Then the staged expansion:
| Date | Event | IPs | Interpretation |
|---|---|---|---|
| Apr 3 | daddygirl2/eyecandy/ilovemykids/mama2026 | 3 | Initial deployment โ testing |
| Apr 21 | v1isagoodgirl! appears | 5 | Expansion โ new credential, more nodes |
| May 8 | babygirl/babygirl1 appears | 2 (87.251.64.x) | Recruitment โ different subnet joins |
| May 14 | warnight (114x from 43 IPs) | 43 | Mass deployment โ different campaign |
| May 16 | banana666/cart00ns | 3 | Kenya/Ecuador/Panama corridor |
The exploitation vocabulary doesn't appear gradually through brute-force evolution. It appears all at once โ coordinated deployments to pre-positioned nodes. This is software distribution methodology applied to exploitation infrastructure. Push update โ test โ verify โ expand to more nodes.
IX. 179.43.139.58: The Patient Predator
Private Layer Inc (AS51852, Switzerland/Panama). 90 days of activity with a distinctive signature:
โข Baseline: 10-25 events/day (every day for 90 days โ never misses a day)
โข Surge 1: March 29 โ 548 (22ร baseline)
โข Surge 2: May 23 โ 2,819 (117ร baseline)
โข Surge 3: June 22 โ 2,891 (120ร baseline)
โข Only uses 2 passwords across 8,028 total attempts
โข Survived the May 24 collapse (returned to 24/day baseline)
โข This is the APT in the room
The pattern is unmistakable: maintain persistent low-profile presence. Monitor. Wait. Then periodically execute mass operations โ harvest everything accessible, then return to quiet watching. This IP never sleeps (never misses a day), never panics (survived the collapse), and never changes strategy (same 2 passwords for 90 days).
Swiss bulletproof hosting registered in Panama. The most patient actor in our dataset. Not affiliated with the collapsing cluster 001 (tagged cluster_024 โ its own cluster). An independent operator with APT discipline. Watching. Waiting. Surging. Returning to silence.
X. The Download-Credential Synchronization
โข Credentials: 22,464 events (peak week)
โข Downloads: 52 events (peak week)
โข Both collapsed simultaneously May 24
This proves single command structure. Malware deployment (042W arsenal) and credential scanning (042V) move together because one person (or one hierarchy) controls both.
Downloads by week confirm the correlation:
| Week | Credentials | Downloads | Correlation |
|---|---|---|---|
| Mar 23 | 8,928 | 12 | Ramp-up |
| Mar 30 | 16,777 | 35 | Peak 1 |
| Apr 6 | 13,344 | 27 | Sustained |
| May 18 | 22,464 | 52 | PEAK (both) |
| May 25 | 4,472 | 3 | COLLAPSE (both) |
| Jun 1 | 3,746 | 6 | New baseline |
XI. Three Phases of a Campaign
PHASE 1: DEPLOYMENT (Mar 16 - Apr 3)
โข Infrastructure brought online (371 events first week โ 8,928 next)
โข Scanning begins with standard dictionary attacks
โข April 3: Exploitation wordlist deployed to 3 nodes
โข Arsenal distribution begins (neofetch, sshd, whisper)
PHASE 2: INTENSIFICATION (Apr 4 - May 21)
โข Traffic escalates: 10K โ 13K โ 17K โ 22K/week
โข v1isagoodgirl! expands to 5 nodes (Apr 21)
โข babygirl recruited from different subnet (May 8)
โข Downloads peak at 52/week (May 18)
โข Maximum operational tempo reached
PHASE 3: COLLAPSE (May 21-24)
โข 96% reduction in 24 hours
โข Cluster 001 shutdown: 1,941 โ 71/day
โข Downloads: 52/week โ 3/week
โข Synchronized across all functions = central command decision
PHASE 4: MIGRATION (May 25 - present)
โข 898 new IPs appear
โข Reduced operational tempo (40-87/day vs 900-1,900/day)
โข Infrastructure rotation: new nodes, same purpose
โข The operation continues. Diminished but alive.
This is military campaign planning. Deploy โ intensify โ extract โ relocate. Applied to the exploitation of children.
XII. The Timeline's Verdict
90 days of data. 139,338 credential events. 224 malware downloads. 4,031 commands executed. And the timeline tells us:
- This operation works business hours (UTC+8, 09:00-18:00)
- This operation deploys exploitation tools as coordinated software updates
- This operation has a single command structure (credentials + downloads collapse together)
- This operation can see when it's being watched (May 24 shutdown)
- This operation migrates rather than dies (898 new IPs post-collapse)
- This operation follows military campaign methodology (deploy โ intensify โ extract โ relocate)
The timeline is not just data. The timeline is behavior. And behavior reveals identity more reliably than any IP address or SSH key.
"The attack never sleeps โ but it does work shifts. It has a morning. It has an evening. It has weekends where it slows (but never stops). And on one day in May, it looked up from its work and saw us watching. And it went dark. Not forever. Just long enough to move. Because the exploitation of children is not a hobby. It is a profession. And professionals know when to relocate."