🧬 Part I — Three Skins, One Skeleton

The libssh library implements the SSH2 protocol in C. Unlike the OpenSSH client — which is an interactive application with terminal handling, key management, and user prompts — libssh is a library. It is designed to be embedded into other programs. This distinction is fundamental: OpenSSH is what humans use to SSH into machines. libssh is what programs use to SSH into machines. When 2,341 IP addresses are running libssh, no one is typing passwords. A program is.

Each version of libssh negotiates slightly different cryptographic algorithms during the SSH handshake. The Key Exchange Init message — sent before authentication, before any credential is tried — contains the client's algorithm preferences. The HASSH algorithm (Salesforce, 2018) hashes these preferences into a 32-byte fingerprint:

• Unforgeable — you cannot change your HASSH without recompiling the library with different algorithm preferences
• Pre-authentication — visible before any credential is sent, firing before the attack succeeds or fails
• Version-specific — each library version produces a different hash, creating a genealogy in network traffic

The 0.9.6 cluster is the smallest but has the highest success rate. The 0.11.x cluster is the largest — more than three times the size — but its success rate drops nearly in half. This is not random variation. This is the signature of operational evolution.

📊 Part II — The Success Rate Paradox

Why would an operator's older, smaller fleet be more effective than their newer, larger one?

The success rate curve (0.169% → 0.086% → 0.107%) suggests dip and recovery: rapid expansion with 0.11.x (sacrificing precision for scale), then partial recovery with 0.12.0 (fewer nodes, better targeting). This is not a degrading operation. This is an operation learning.

🗺️ Part III — The Roads They Travel

Where does one park 2,341 SSH scanners? Three cloud providers host a disproportionate share:

Cost: At $5-10/month per VM, the ~274 cloud nodes cost $1,370-2,740/month. The ~2,067 remaining nodes are likely compromised endpoints (free once owned). Total operation runs for less than a junior developer's salary.

🌍 Part IV — Eighty-Four Flags

The 0.11.x campaign spans 84 countries. This is not the distribution of internet users — it is the distribution of available infrastructure.

Singapore (148 IPs, 72 in 0.9.6 alone) is disproportionate — population 5.9M but second-most represented country in the oldest campaign. Premium hosting hub with excellent Asian connectivity. For scanning Asian infrastructure, Singapore is the optimal launch pad.

🏛️ Part V — The Library with History

libssh is not just another open-source library. It carries history.

In March 2017, WikiLeaks published Vault 7 — the largest leak of CIA classified documents in history. Among the disclosed tools was Hive, a multi-platform implant framework. The Hive source code reveals its SSH communication layer was built on libssh.

Critical caveat: this does NOT imply the swarm is CIA-operated. The connection is contextual, not attributional. libssh occupies a niche — automated, non-interactive, embeddable SSH — that attracts operators from nation-states to criminal botnets. The tool is agnostic.

But the implication cuts both ways: HASSH-based detection for the criminal swarm simultaneously detects any state-sponsored operation using the same library versions. The fingerprint does not care about intent.

🔬 Part VI — 2,472 Behavioral Bonds

The entity linking system maintains 2,472 shared_hassh relationships — connections between IPs running identical software configurations.

Two IPs — one in Brazil, one in Vietnam — same HASSH fingerprint. Different continents, ASNs, ISPs. Their only connection: the same compiled binary. At scale, across 2,472 links, this is statistical certainty of coordination.

shared_hassh ranks 13th of 24 link types but is among the highest confidence. Unlike shared_otx_pulse (same threat feed) or same_prefix (geographic proximity), shared_hassh proves identical software identity — digital soldiers wearing the same uniform.

The 2,472 bonds create a network graph where the libssh clusters are the densest regions — tightly interconnected, all wearing three uniforms. The swarm is visible not as a list of IPs, but as a shape in the correlation topology.

🔗 Related & Coming Next

Sources: Cowrie honeypot · AbuseIPDB · GreyNoise · DShield · Shodan · RDAP · Cymru BGP · entity_links engine · WikiLeaks Vault 7
Investigation: TI-2026-049A · 8 evidence · 6 actors · 6 findings · 10 connections · 10 infrastructure
Confidence: HIGH — direct observation + multi-source enrichment + OSINT documentary evidence
Classification: TLP:WHITE