The Glass Cage

🪞 CAPSTONE — Five windows onto one siege. The whole arc, and the architecture that saw it.

TI-2026-047F — The Glass Cage

TI-2026-047F · Series: 🪞 The Glass Cage (Letter F · capstone) · TLP:WHITE

How the .env harvest, the repeat offenders, the botnet census, the cartographers, and the first ten seconds resolve into a single kill chain — and why the cage is made of glass.

📋 The Short Version

The five letters of this series are not five threats. They are five windows onto one machine — the attackers' and the defenders'.
Web reconnaissance (A, C, D) and the SSH endgame (E) are one continuous kill chain; the cross-surface census (B) is the proof.
One operation — Meow, on Google Cloud — appears on both surfaces, closing the loop end to end.
Every operation runs the same split-infrastructure model: bulletproof for the noise, blue-chip for the payload.
The estate saw all of it because six independent layers each caught what the others missed — and a graph stitched them together.
And after everything: the whole economy still pivots on a default password and an exposed .env.

A glass cage is invisible to whatever is inside it and perfectly clear to whoever is watching. That is what we built — and this is what we saw through it.

🪟 The Five Windows

Each letter looked at the same siege from a different side. Read together, they stop being separate stories.

The Login Page That Watched Back. Authelia answers every path with a 200 login page and records the target in ?rd= — turning the gate into a sensor that logs each scanner's full shopping list. 1,820 IPs on both web and SSH; 47 auth-indifferent scanners.

The Repeat Offenders. The web surface didn't find new villains — it re-convicted known ones. 217 probes map onto prior dossiers; 73 confirmed at four layers at once; M247 and ADVIN return.

The Botnet Census. Coordination leaves three fingerprints — time, identity, toolkit. 36 campaigns, ~88k requests; a 7-IP fleet shares one 170-path .env dictionary across Amazon and Google.

The Cartographers of the Web. An address has five disagreeing locations, weaponised for jurisdiction-shopping. Data Campus HK-on-paper/NL-on-wire; M247's virtual Cuba and Iran, physically in Romania.

The First Ten Seconds. A trivial admin/admin login, then a 24-command paste in one second — multi-arch malware, root password reset, backdoor users. The password "admin" wins 97.3% of the time it's tried.

⛓️ The Unified Kill Chain

Laid end to end, the letters are not parallel — they are sequential. One funnel, from the first scan to the planted backdoor:

1 · Harvest — sweep the web for .env, .git/config, DB dumps, credentials (Letters A, C — and the Authelia trap logs every attempt)

↓

2 · Choose your flag — route the operation through whichever jurisdiction is least reachable (Letter D)

↓

3 · Spray — try the harvested and default credentials against SSH; admin/admin lands 97% of the time (Letter E)

↓

4 · The one-second paste — fetch multi-arch payload, reset root, plant sudo backdoors, mark the box (Letter E)

↓

5 · Monetise — cryptominer + DDoS agent; the host joins the fleet that runs step 1 against everyone else (Letters C, E)

The single clearest proof that this is one chain and not five coincidences is the Meow operation: scanner 35.196.255.242 and payload host 35.237.91.38, both Google Cloud, appear in the web harvest (A, C, and TI-2026-046E) and in the one-second SSH endgame (E). Same operator, same cloud, both ends of the chain.

Takeaway — the host compromised in step 4 becomes part of the fleet running step 1. The chain is a loop, and it feeds itself.

🏗️ The Pattern Beneath Every Letter — Split Infrastructure

One structure recurs in every window, on both surfaces:

The deniable half — credential-stuffing and scanning run from bulletproof / abuse-tolerant networks: ISAEV (KZ/PL), Proton66 (RU), w1n (GB), STORMINDUSTRIES (Offshore), Data Campus (HK/NL). Noisy, cheap, disposable — built to absorb the abuse complaints.
The reputable half — the payload, C2 and high-value delivery ride Google, Azure and Amazon, because no defender dares blanket-block a hyperscaler.

🔍 Reading between the lines — the "trusted cloud" allowlist that most enterprises run is not a defence the attacker fears; it is a feature they depend on. The reputable half of every operation is reputable on purpose, chosen precisely because your firewall waves it through. The good name of the cloud is the camouflage.

🔬 The One Lesson Every Letter Teaches

Beneath the specifics, all five windows point at the same defensive truth: stop trusting the signals that are cheap to change, and fingerprint the ones that are not.

Cheap to change (don't trust)	Expensive to change (fingerprint this)
IP address (rotates hourly)	Path dictionary — the 170-entry `.env` list (C)
Country (five sources disagree — D)	Toolkit filename — `this_is_a_new_hello_world.php` (B/C)
User-agent (empty or forged)	Command paste & `modz` branding (E)
ASN (rented by the week)	SSH keys, HASSH, shared credentials

They change their address every hour and their target list never. So we learned to read the target list.

🔭 Why the Cage Is Made of Glass

The attackers were visible not because any one sensor was clever, but because six independent layers each recorded what the others could not — and a graph stitched the views into one picture:

L3 · MikroTikfirewall bans at the router edge

L7 · CrowdSecbehavioural scenarios (sensitive-files, admin-probing, CVE-2017-9841)

Autheliaforward-auth ?rd= interception — scanner intent on protected hosts (A)

web-threatsTraefik classifier — intent labelling, campaign detection (C)

CowrieSSH honeypot — the post-compromise transcript (E)

Qdrant graph15,587 crosslinks stitching one IP's faces together (B)

No single layer saw the whole kill chain. The Authelia trap saw web intent; the honeypot saw the payload; CrowdSec and MikroTik saw the bans; the crosslink graph saw that they were all the same IP. 73 addresses tripped four of these layers at once — the highest-confidence verdict the estate can issue.

Takeaway — defence-in-depth's real prize is not redundancy — it is correlation. Each layer's blind spot is another's clear view, and the graph is what turns six partial pictures into one.

🛡️ The Defense Playbook

Every recommendation here is grounded in a behaviour observed across Letters A–E — not best-practice boilerplate:

Close the funnel's mouth. Eliminate default credentials and exposed .env/.git. The whole economy begins with admin/admin (E) and an open secrets file (A/C).
Put sensitive services behind forward-auth. It blocks the unauthorised and doubles as a deception sensor that logs attacker intent (A).
Correlate across surfaces. One IP wears many faces — web probe, SSH session, prior dossier. Only cross-surface correlation sees the whole actor (B).
Fingerprint behaviour, not identity. Key detection on path-dictionaries, toolkits and keys — never on IP, country or user-agent (C/D).
Automate the response. The attack finishes in one second (E); a human cannot be the control loop.
Treat any successful login as full account compromise. Persistence (reset root, backdoor users) is planted first, not last (E).

🚪 And Yet — The Front Door

This is the humbling coda. For all the sophistication catalogued across six dossiers — multi-cloud fleets, 170-path dictionaries, virtual nations, sub-second payloads — the entire apparatus still depends on the cheapest possible failure on the defender's side.

The SSH endgame begins with admin/admin. The web harvest begins with an .env file left in a web root. The most advanced attack infrastructure of 2026 is gated, at the very first step, by whether someone changed a default and removed a secret from a public folder.

The hard part was never stopping the attacker. The hard part is not leaving the door open — and the door is still open almost everywhere.

❓ The Questions That Remain

Who is this, ultimately?
A commodity economy, not a villain. A handful of toolkits and operations (Meow chief among them) renting blue-chip and bulletproof compute, monetising stolen cycles and bandwidth at industrial scale.

What did the cage prove?
That web scanning and SSH brute-force are one phenomenon; that the same actors recur across surfaces and across years of dossiers; and that correlation, not any single sensor, is what makes them legible.

What is still hidden?
The handoff between recon and exploitation — whether the crew that harvests on Google is the crew that sprays from bulletproof space, or sells to them. The census shows the shifts; the contract between them is the next investigation.

What happens next?
The loop continues. Every host taken in step 4 becomes a scanner in step 1. The cage will keep filling — and keep recording.

⚖️ Verdict

The Glass Cage set out to read the under-used web-threats surface and ended up documenting a complete machine: a self-feeding loop that harvests secrets on the web, shops for a permissive jurisdiction, sprays the credential against SSH, and converts a won login into a mining-and-flooding node in one scripted second — all on infrastructure that is half bulletproof, half blue-chip, and entirely visible to a defender who watches every layer at once.

The attackers were sophisticated in their logistics and trivial in their entry. That asymmetry is the whole lesson: close the front door, watch every surface, and fingerprint what they cannot afford to change. The cage is glass. They never knew we were watching — and now the whole world can read what we saw.

Six windows, one machine, one second of consequence — and a door that was open the entire time.

🔗 The Complete Series

Series: 🪞 The Glass Cage · Letter: F (capstone) · Classification: TLP:WHITE

Data sources: the full TI-2026-047 series (A–E) · LSN six-layer architecture (MikroTik L3, CrowdSec L7, Authelia forward-auth, Traefik web-threats classifier, Cowrie SSH honeypot, multi-source enrichment) · Qdrant entity-crosslink graph (15,587 edges). External frame: Sysdig EMERALDWHALE; Unit42; VulnCheck (CVE-2017-9841); Verizon DBIR 2024; CrowdStrike GTR 2024.

Investigation: TI-2026-047F · 5 actors · 8 evidence · 6 findings · 7 connections