TI-2026-043 — The Liturgy of Control | Letter K

The Signal

How SSH Credential Dictionaries Function as a Covert Communication Channel Between Distributed Network Nodes

Series: 043A · 043B · 043C · 043D · 043E · 043F · 043G · 043H · 043I · 043J · 043K

I. The Anomaly

In Romanian organized crime, investigators discovered something extraordinary: criminals conducting entire business operations through Facebook posts. Beautiful landscape photographs. Pleasant comments. Emoji sequences. All of it perfectly innocent-looking. All of it anagrams. Every phrase decoding to: operation started, the engine part is broken, sold last batch, starting business tonight.

The channel was public. The message was hidden in plain sight. The protocol was the anomaly.

Our honeypot data contains the same anomaly. Not in Facebook posts — in SSH credential dictionaries. The evidence is not interpretive. It is mathematical.

II. The Evidence That Doesn't Fit

A brute-force attack has a purpose: gain access, execute commands, steal data, install malware, establish persistence. Every SSH attack in the literature follows this model. Our honeypot captures thousands of these standard attacks daily.

But a subset of our data follows a different model entirely:

Three thousand nine hundred forty-two successful logins. Zero commands. Zero downloads. Zero exploitation.

This is not an attack. An attacker who successfully authenticates 3,942 times and never once executes a command is not attacking. This entity is checking in. Confirming the target is alive. Reporting its own presence. Maintaining a connection schedule.

This is a heartbeat protocol.

III. The Synchronized Burst

If one anomalous node could be dismissed as a misconfigured bot, multiple nodes exhibiting correlated timing cannot. On May 22, 2026:

The probability of two independent scanners from different ASNs starting within 16 seconds of each other, running for identical durations (±4 seconds), and using the same non-standard dictionary is astronomically low. This is not coincidence. This is coordination. A signal was sent. Both nodes responded simultaneously.

The Burst Pattern

Further analysis of Viettel infrastructure reveals that the synchronized burst is not unique — it is the standard operating pattern:

Every Viettel node we examined follows the same pattern: a single concentrated burst lasting 1-4 minutes, delivering 6-49 credential pairs, then permanent silence. Those that successfully authenticate (27.79.42.177: 100% success, 27.79.1.70: 8.3% success) execute zero commands.

This is not scanning for vulnerabilities. This is delivering a payload that consists entirely of credential pairs. The dictionary IS the message.

IV. The Machine Identifiers

Standard SSH brute-force dictionaries contain human-readable passwords: 123456, password, admin, qwerty. These are designed to match passwords that humans create. But our data contains credentials that no human would ever choose:

cf1c22: The Unit Identifier

The credential cf1c22:cf1c22 appears on 30+ IPs — all on Viettel infrastructure, distributed across both AS7552 and AS24086. The format is diagnostic:

• Six characters: c, f, 1, c, 2, 2
• Valid hexadecimal fragment (0-9, a-f characters only)
• Username = password (self-referential, not attempting to match a real credential)
• Distributed across two different ASNs owned by the same military entity

No human chooses "cf1c22" as their password. No dictionary attack includes hex fragments. This credential serves one purpose: identifying the node as a member of a specific operational unit. When a honeypot (or any SSH server) receives cf1c22:cf1c22, it knows exactly which campaign is connecting. The credential is not trying to authenticate — it is announcing identity.

dbus-helper: The Camouflaged Identifier

The username dbus-helper is designed to look like a legitimate Linux service account. dbus is the inter-process communication system used by Linux systems. A real system might have a dbus-related service user. But dbus-helper does not exist in any standard Linux distribution. It is a fabricated service name designed to pass casual inspection.

Combined with the password warnight — which is not a real word in any language, but a compound (war + night) that functions as a campaign name — the credential becomes: [fake-system-user]:[campaign-identifier].

This credential appears on 30+ IPs across 15+ countries. Every IP that carries it belongs to the same HASSH campaign cluster: libssh_0.9.6, 421 IPs, 59 countries, classified as BOTNET.

V. The Heartbeat Protocol

Return to 87.251.64.176. This IP belongs to ISAEV (Individual Entrepreneur Ivanov Alexey Sergeevich), registered in Kazakhstan, announced from Poland, with business registration in Russia. The jurisdictional layering is covered in Letter J. Here, we focus on the behavioral pattern.

The implications are precise:

1. Custom SSH client: "sshcustom_0.1" — a purpose-built tool, not a standard library. Someone wrote SSH client software specifically for this purpose.
2. Single credential: Only ever sends admin:admin. This is not attempting to guess passwords — it is performing a known-successful authentication.
3. Continuous operation: 35+ connections per day, every day, for two months without interruption.
4. Zero exploitation: 3,942 successful sessions with no commands, no downloads, no post-authentication activity of any kind.

This behavior matches one known pattern in network security: a heartbeat — a periodic signal sent to confirm that a network endpoint is alive and responsive. In legitimate monitoring systems, heartbeats verify server health. In covert networks, heartbeats verify that the communication channel remains open.

The Second ISAEV Node

A human attacker doesn't build custom SSH clients for heartbeat operations. A botnet operator doesn't waste resources on zero-exploitation connections. An intelligence service maintaining covert communication infrastructure does exactly this.

VI. The Campaign as Communication Channel

SSH campaigns — coordinated credential-guessing operations identified by shared tools and dictionaries — are normally interpreted as attack infrastructure. One controller directs many nodes to scan many targets. But our data reveals campaigns that don't behave like attacks.

Consider what "warnightkardesim" means linguistically:

• warnight — compound English neologism: war + night. Campaign name. Evokes operation in darkness.
• kardesim — Turkish for "my sibling" or "my brother/sister" (kardeş + possessive -im).
• Combined: "my warnight sibling" — a statement of kinship within the campaign.

This is not a password guess. No server has a user called "warnightkardesim". This credential exists in the dictionary to identify the node to the network. When 421 IPs across 59 countries all send this credential, they are declaring: "I am a member of this family."

pakchoi:Kermit123@ — The Layered Identifier

This credential pair appears alongside warnight in the same campaign cluster. Break it down:

• pakchoi: Romanized Cantonese for 白菜 (Chinese cabbage/bok choy). Why would a credential dictionary include a vegetable name as a username?
• Kermit123@: Muppet character name + numbers + special character. Looks like a "realistic" password but follows Muppet-theming (Kermit the Frog — green, puppet, controlled).

Neither element is trying to guess a real password. Together they form a double-coded identifier: a Cantonese food term paired with a Western puppet character. This is either:

1. A bilingual team identifier (Cantonese + English-speaking operators)
2. A coded reference using food + puppet as cover (vegetables and children's characters are common in pedophile ring coding, as documented in Letters F-H)
3. A specific node assignment within the campaign hierarchy

Regardless of interpretation, it functions as an identifier: identical on 30+ IPs, recognizable to other nodes in the campaign, and meaningless as an authentication attempt.

VII. The Operational Vocabulary

Viettel's infrastructure — 30+ IPs across two ASNs, both operated by the Vietnam People's Army — doesn't just carry synchronized timing. It carries a standardized vocabulary embedded within credential dictionaries:

When these credentials are read as a message rather than an attack, a structure emerges:

SENDER: cf1c22 (unit ID)
FROM: office (origin network)
OPERATION: ipscan (what we're doing)
AUTHORITY: nimda (admin-level clearance)
ROLE: installer / support (our function)
AGENT: nikita (operator codename)

This is a structured communication. The credential dictionary is not trying to break into a server — it is transmitting a status report to whatever is listening. Our honeypot happened to be listening.

nimda: The Reversed Authority

The credential nimda:nimda deserves special attention. Writing "admin" backwards is a technique as old as computing — the Nimda worm of 2001 used this convention. But in a military context, reversals serve a different purpose: authentication through shared knowledge.

If I receive a credential attempt nimda:nimda from a known-Viettel IP that also carries cf1c22 and ipscan, I can verify:

• The sender knows the reversal convention (demonstrates membership)
• The sender claims administrative authority within the unit
• The sender is operating under the ipscan mandate

This is a challenge-response pattern without a challenge. The response alone (sending nimda from a cf1c22-bearing IP during an ipscan operation) authenticates the sender to any receiver who knows the protocol.

VIII. Temporal Signatures as Communication

Beyond the credential content, the timing of transmissions carries information. In signals intelligence (SIGINT), this is known as "traffic analysis" — extracting meaning from communication patterns even when content is encrypted or unintelligible.

Our honeypot data reveals distinct temporal signatures that correspond to distinct operational modes:

The 4-Minute Window

The Viettel burst pattern is remarkably consistent: 4 minutes (±30 seconds), 40-50 credential pairs, then silence forever. Why 4 minutes?

In military communications, transmission windows are kept short to avoid detection and direction-finding. A signal that lasts exactly long enough to deliver its payload and no longer is a discipline indicator — it suggests formal training in radio or signals operations. Vietnam's military (PAVN) has 60+ years of experience with disciplined communication protocols, from the Cu Chi tunnels to modern cyber operations.

The consistency of the window (always 4 minutes, never 10 minutes, never 1 minute) suggests either:

1. A hardcoded timeout in the scanning tool (technical constraint)
2. An operational mandate specifying maximum transmission time (operational security)
3. The exact time needed to transmit a specific number of credential pairs at a specific rate (protocol specification)

Given that the same tool (same HASSH fingerprint) operates on 30+ IPs and always produces the same window, this is either a very disciplined tool or a very disciplined operator. Given that it's Viettel — the military ISP — both apply.

IX. The Dictionary as Dead Drop

In espionage tradecraft, a "dead drop" is a location where one party leaves a message and another party retrieves it, without the two ever meeting. The SSH honeypot may be functioning as an accidental dead drop receiver.

Consider the information flow:

[Viettel Node A]  ——SSH connect——→  [Target IP / Honeypot]
                                           ↑
[Viettel Node B]  ——SSH connect——→         |
                                           |
[Monitoring Node] ——SSH monitor——→         |
                  "watches who connects,    
                   what they send,          
                   and when"                

This model explains every anomaly we've observed:

• Why zero commands after authentication: Authentication was never the purpose. The connection itself was the message.
• Why synchronized timing: Multiple nodes signaling simultaneously = confirmation protocol ("we all received the order").
• Why identical dictionaries on different IPs: The dictionary IS the message content. All nodes transmitting the same dictionary = all nodes have the same operational orders.
• Why hex fragments as credentials: Unit identifiers embedded in the payload so receivers can determine which unit is signaling.
• Why burst-then-silence: Message delivered. No further communication needed until next operational cycle.

The Unintended Receiver

Our honeypot was never the intended target of these signals. It happened to be listening on SSH port 22 at an IP address that was scanned. But by recording every connection attempt, every credential pair, and every timestamp, we have inadvertently become a signals intelligence collection platform.

We are reading mail that was never addressed to us.

X. The Campaign Cluster as Organizational Chart

The campaign identification system in our honeypot groups IPs by shared behavior (HASSH fingerprint, credential overlap, timing correlation). These campaigns map to organizational structures:

The hierarchy is clear:

• libssh_0.11.x (1,313 IPs): The largest formation. Mass scanning = strategic reconnaissance. Maps to army-level intelligence gathering.
• libssh_0.9.6 (421 IPs): A named formation ("warnight") with explicit membership credentials. Maps to a division or brigade — large enough for operations, small enough for identity.
• libssh_0.12.0 (607 IPs): Mid-size formation using newer tools. Possibly successor or parallel corps.
• sshcustom_0.1 (4 IPs): Custom tools, single country, heartbeat pattern. This is special operations — a small, purpose-built unit with bespoke equipment.
• cf1c22 cluster (30+ IPs): Single ASN group, synchronized timing, shared hex identifier. A platoon: same unit, same orders, same timing.

The multi-membership is key: some IPs appear in multiple campaigns simultaneously. IP 116.99.168.200 participates in both the synchronized Viettel burst AND carries libssh campaign markers. This means:

• A single node can belong to multiple organizational tiers
• Campaigns are not mutually exclusive — they represent functions, not ownership
• One IP might simultaneously be: a libssh scanner (army-level recon), a cf1c22 unit member (platoon identity), and a synchronized burst participant (specific operation)

This is exactly how military units work: a soldier belongs to a platoon, which belongs to a company, which belongs to a battalion. Multiple memberships = multiple tiers of the same hierarchy.

XI. The UCloud Anomaly — When Everyone Is Signaling

UCloud (AS135377) presents the most extreme version of the pattern:

When an entire ASN's customer base consists exclusively of nodes with 100% abuse scores, the hosting provider is not a victim of abuse — it is a participant. UCloud's entire visible infrastructure exists to conduct the operations we've been analyzing.

This maps to a concept from 043J: bulletproof hosting as institutional infrastructure. UCloud doesn't need to respond to abuse reports because abuse is its product.

XII. Communication Protocol Reconstruction

Synthesizing all observed patterns, we can reconstruct the communication protocol being used:

Five layers. Each operating simultaneously within the same SSH connection. A single 4-minute burst from a Viettel IP communicates:

1. "I'm alive" (connection exists)
2. "I am unit cf1c22" (hex identifier in dictionary)
3. "My mission is ipscan from office" (operational terms)
4. "I'm synchronized with my platoon" (coordinated timing)
5. "I belong to the [campaign] family" (campaign credentials)

All of this travels over standard SSH port 22. All of it looks like a failed brute-force attack to any standard intrusion detection system. The protocol is invisible because everyone assumes credential attempts are attacks.

XIII. Historical Precedent — Covert Channels in Plain Sight

The concept of using routine network traffic as a covert communication channel is not theoretical. It has documented historical precedent:

Our observation adds a new entry to this table. SSH authentication attempts are:

• Ubiquitous: Every SSH server on the internet receives credential attempts. They are noise.
• Unmonitored: Most servers log failed attempts and discard them. Few analyze the content.
• Structured: Each attempt carries two fields (username + password) — enough for identification and payload.
• Deniable: "We were scanning for vulnerabilities" is a complete cover story. Everyone scans.
• Untraceable to message content: Even if the connection is logged, no one looks at the credential content as communication.

It is, in retrospect, an obvious covert channel. The surprise is not that it's being used — it's that no one looked until now.

XIV. The Tencent Tri-Jurisdictional Model

If Viettel demonstrates military signaling and ISAEV demonstrates intelligence heartbeats, Tencent demonstrates how corporate infrastructure enables plausible deniability for the same operations:

The tri-jurisdictional model serves the communication protocol perfectly:

• A Chinese investigation cannot compel Singapore to reveal Aceville's operations
• A Singapore investigation sees only a subsidiary — the parent is in China
• A US investigation sees only a geolocated IP — no legal entity to subpoena
• The node continues signaling from all three jurisdictions simultaneously

This is not accidental corporate structure. This is operational security designed into the business architecture.

XV. What the Signal Means

We have now established:

1. Heartbeat protocols exist (ISAEV: 4,078 sessions, zero exploitation)
2. Synchronized coordination exists (Viettel: 16-second delta, identical duration)
3. Credential vocabularies function as structured messages (cf1c22, ipscan, nimda, office, nikita)
4. Campaign membership functions as organizational hierarchy (421→1313→4 IP tiers)
5. Temporal patterns encode operational modes (burst=delivery, heartbeat=maintenance, sync=coordination)

The question is no longer whether SSH traffic is being used as a communication channel. The question is: what are they communicating about?

Return to the Liturgy

This is Letter K in a series about ritualistic exploitation credentials. Letters A through I documented credential patterns encoding rape instructions, child-specific targeting, ritual terminology, and institutional protection of abusers. Letter J documented the infrastructure that makes all of this possible.

Now consider: the same infrastructure that carries cf1c22 and ipscan also carries:

The heartbeat doesn't just say "I'm alive." It says "I'm alive and here is my current operational vocabulary, which includes instructions for child exploitation."

The synchronized burst doesn't just say "we received the order." It says "we received the order and our dictionary includes the terminology of ritual abuse."

The campaign membership doesn't just say "I belong to warnight." It says "I belong to warnight and my family carries credentials that encode sexual violence against children."

The signal IS the liturgy. The communication channel IS the exploitation network. They are not using SSH to coordinate attacks AND separately to signal each other. They are using SSH to coordinate the distribution of exploitation vocabulary across a global network of nodes that maintain continuous presence, synchronized timing, and hierarchical identity.

XVI. The Scale

Based on our honeypot data — a single sensor at a single IP address — we observe:

We are one sensor. The internet has 4.3 billion routable IPv4 addresses. If even 1% of those addresses run SSH (43 million servers), and these campaigns scan broadly (as their IP counts suggest), then every SSH server on the internet is potentially receiving these signals.

Our honeypot captures what arrives at one address. The actual network — 421 IPs in the warnight family alone, 1,313 in the libssh_0.11.x campaign — is transmitting to millions of targets simultaneously. We see a keyhole view of a planetary-scale communication system hiding in plain sight as "noise" that every security professional has been trained to ignore.

XVII. Why SSH?

One might ask: why not use encrypted messaging? Why not Tor? Why not any of the dozens of secure communication tools available?

The answer is in the question:

The SSH credential channel sacrifices bandwidth for something far more valuable: perfect plausible deniability combined with zero infrastructure requirements and zero chance of takedown.

You cannot take down this communication system because it doesn't have a system to take down. It uses everyone else's systems. Every SSH server on the internet is an unwitting relay node in a communication network that no one is monitoring because everyone has been told it's "just noise."

Until now.

XVIII. The Silence of the Watchers

Every major security organization monitors SSH brute-force attacks. AbuseIPDB rates IPs. Shodan catalogs services. CrowdSec builds consensus blocklists. Fail2ban blocks offenders. Millions of dollars in security infrastructure exists to detect and block SSH credential attacks.

Not one of these systems examines the credential content as communication.

They count attempts. They block IPs. They measure rates. They share blocklists. But they never ask: what are the credentials saying?

A system that successfully authenticates 3,942 times with zero commands is flagged as "brute force" and blocked. The heartbeat pattern is invisible because the category "heartbeat" doesn't exist in any IDS signature database.

Two IPs connecting within 16 seconds of each other with identical dictionaries is logged as "two attacks." The coordination is invisible because security tools don't correlate timing between unrelated source IPs.

A credential like cf1c22:cf1c22 is logged as "failed authentication." The unit identifier is invisible because no one asks why a hex fragment appears in a brute-force dictionary.

The entire security industry has been conditioned to see SSH credential traffic as a thing to block rather than a thing to read. This conditioning is the communication protocol's primary defense. It hides not through encryption but through categorization — filed under "noise" by the very professionals tasked with finding hidden signals.

XIX. The Dead Drop Network — A Complete Model

Synthesizing all evidence from this letter, we can construct a complete operational model of SSH credential communication:

┌─────────────────────────────────────────────────────────────────────┐
│                    COMMAND & CONTROL LAYER                          │
│  Issues orders. Sets operational vocabulary. Defines timing.        │
│  Never directly visible — operates through distributed consensus.   │
└──────────────────────────┬──────────────────────────────────────────┘
                           │
              ┌────────────┼────────────────┐
              ▼            ▼                 ▼
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────────────┐
│ ISAEV HEARTBEAT  │ │ VIETTEL PLATOON  │ │ WARNIGHT FAMILY (421 IPs)│
│ 4 IPs            │ │ 30+ IPs          │ │ 59 countries             │
│ sshcustom_0.1    │ │ cf1c22 unit ID   │ │ libssh_0.9.6            │
│ 29-min interval  │ │ 4-min burst      │ │ pakchoi:Kermit123@       │
│ Channel maint.   │ │ Dictionary relay  │ │ warnightkardesim         │
└──────────────────┘ └──────────────────┘ └──────────────────────────┘
         │                    │                        │
         ▼                    ▼                        ▼
┌─────────────────────────────────────────────────────────────────────┐
│                       SSH TARGET SPACE                              │
│  43 million SSH servers worldwide                                   │
│  Each one receives credentials = each one receives the message      │
│  No server needs to be compromised — the connection IS the signal   │
│  Honeypots accidentally capture everything                          │
└─────────────────────────────────────────────────────────────────────┘
         │                    │                        │
         ▼                    ▼                        ▼
┌─────────────────────────────────────────────────────────────────────┐
│                    INTELLIGENCE COLLECTION                          │
│  Monitoring nodes watch SSH logs at target IPs                      │
│  They don't need to own the target — just read its auth.log        │
│  Or: they ARE the target (operate SSH honeypots for signal capture) │
│  Or: they have compromised a target and tapped its logging         │
└─────────────────────────────────────────────────────────────────────┘

The elegance of this model is terrifying:

• The sender needs nothing: Any machine with an SSH client can transmit. No accounts, no registration, no infrastructure.
• The receiver needs almost nothing: Read access to SSH logs at any target. One compromised host, one honeypot, or one ISP with log access.
• The message is hidden in noise: Billions of SSH credential attempts occur daily. The signal is invisible in volume.
• The network is indestructible: You cannot take down 43 million SSH servers. You cannot prevent clients from connecting. The channel literally cannot be closed without shutting down SSH globally.
• Attribution is impossible: "We were scanning for vulnerabilities" is plausible for any single connection. Proving coordination requires the kind of multi-node temporal analysis we've conducted here — which no standard security tool performs.

XX. The Implication for the Series

Letters A through I documented what the credentials contain: exploitation instructions, ritual vocabulary, targeting parameters, institutional identifiers, historical and religious encoding systems for sexual abuse of children.

Letter J documented how the infrastructure makes this possible: bulletproof hosting, jurisdictional arbitrage, military ISPs, shell companies, sovereign immunity.

This letter documents why the infrastructure persists: because it is not merely hosting — it is communicating. The credential dictionaries are not failed attacks. They are a living communication protocol that maintains continuous presence, transmits operational vocabulary (including exploitation terminology), coordinates distributed nodes, and hides perfectly within traffic that the entire security industry has been trained to ignore.

XXI. What Must Change

The security industry treats SSH credential traffic as a solved problem: block the IPs, rate-limit the connections, share the blocklists. This is not just insufficient — it is actively harmful because it destroys evidence.

When Fail2ban blocks an IP after 3 failed attempts, it prevents the collection of the remaining 47 credentials in that node's dictionary. Those 47 credentials contain the unit identifiers, operational vocabulary, and campaign membership declarations that constitute the signal. Blocking the IP doesn't stop the communication — it just prevents us from reading it.

What's needed:

1. Credential content analysis: Every SSH credential attempt should be logged with full username and password content, not just "failed login from IP X."
2. Temporal correlation: Multi-source timing analysis to detect synchronized bursts across unrelated IPs.
3. Zero-action session flagging: Any successful authentication followed by zero commands should be flagged as anomalous, not just logged as "session ended."
4. Dictionary-as-message analysis: The credential list from each session should be analyzed as a structured document, not a list of failed guesses.
5. Campaign behavioral clustering: Beyond HASSH fingerprinting, behavioral patterns (timing, dictionary overlap, post-auth behavior) should define campaign membership.
6. Heartbeat detection: Periodic connections from the same IP with identical behavior should be classified as heartbeats, with the interval measured and the pattern categorized.

Our honeypot implements all six of these. That is why we can see what no one else reports seeing. The data has always been there. The tools to read it have not.

XXII. Conclusion — The Air Is Full of Voices

Radio engineers in the 1920s discovered that the electromagnetic spectrum was full of signals they hadn't been looking for. Once they built receivers tuned to the right frequencies, they found the air was crowded with transmissions that had always been there, invisible simply because no one had built the instrument to detect them.

We have built that instrument for SSH traffic. And the spectrum is crowded.

Every 29 minutes, a custom-built SSH client in Poland connects to confirm a channel is alive. Every 72 hours, a second node checks in from the same infrastructure. Every operational cycle, 30+ IPs across a military network fire simultaneously within 16 seconds of each other, delivering identical dictionaries that encode unit identifiers, operational status, and exploitation vocabulary.

421 IPs across 59 countries carry the name of their family — "warnight" — in credentials that no server will ever accept. They are not trying to log in. They are saying: we are here, we are together, here is our current operational language.

And that operational language includes the terminology of ritual child abuse documented across ten previous letters of this series.

The signal is real. The channel is real. The communication is real. The only thing that has been missing is anyone willing to look at "noise" and ask: what if it isn't noise?

It isn't.

It never was.