🎯 The Nine-Command Sequence

Every node executes this exact sequence in well under ninety seconds — connect, run nine commands, disconnect:

The platform's intel-linker tags the whole session with one TTP label: reconnaissance. Decoded line by line, nothing is idle:

🔬 Step 7 — The Full Target List

The single most revealing command enumerates five distinct asset classes at once:

Two prize classes, one ls. Telegram tdata: copy the folder and you are the victim on Telegram — no password prompt, no second factor. SMS/GSM gateways: control one and you can read inbound SMS (intercept 2FA codes), send premium-rate SMS, and run smishing at scale.

The asset-triage decision tree

What the nine commands set up is a branch table — the same logic TI-2026-002 reconstructed, still in force:

🕰️ The Continuity Proof — Spring Nodes, Summer Cluster

This is the heart of The Long Memory. TI-2026-002 documented 15 nodes between March 21 and April 11. Months later, the same HASSH fingerprint cluster contains the very same addresses — proof it is one continuous campaign, not a look-alike:

Thirteen of fifteen spring nodes are still in the cluster — and fresh ones (112.185.48.244, 211.48.137.43) run the identical script. The campaign didn't migrate; it endured.

🧬 How the Platform Knows It Is One Operation

The addresses never repeat enough to matter — so identity is reconstructed from things the operator cannot cheaply change. Two independent signals converge:

HASSH hashes the SSH client's key-exchange/cipher/MAC offer — a build-specific signature of the attacker's tool, not its location. Shared-command clustering hashes the exact command strings and groups every IP that issued them. When the same 49 residential addresses across twenty countries share both a client fingerprint and a byte-identical command set, coincidence is excluded: it is one toolkit, many disposable hosts.

Behavioral fingerprint

🪞 The Ugly Mirror — A Stolen Copy of a Documented Industry

Strip the criminal framing and look at what this kit hunts — inbound SMS spools, GSM modems, SIM managers, QMI interfaces, messaging sessions — and it is indistinguishable from a product catalogue. It is one: the commercial lawful-interception and surveillance industry, exposed in the WikiLeaks Spy Files.

The capability the surveillance vendors sold to states for millions — intercept the SMS, own the second factor, read the messages — is what a residential botnet now improvises with nine shell commands and a stolen tdata folder. The criminal who copies a session directory and the appliance that taps an SMS gateway are reaching for the same files for the same reason.

This thread — the convergence of criminal telecom-theft and the documented interception industry — is developed in full in a later letter of this series.