TI-2026-049F โ The Census
๐ The Numbers
2,341
Unique IPs
84,726
Scanning Attempts
90
Successes
0.11%
Success Rate
84
Countries
606
ASNs
1,343
Network Prefixes
54
Days Observed
3
libssh Versions
3
HASSH Fingerprints
2
Command Families
1
Actor Cluster
๐ I โ The Organism (Letter A)
| Campaign | HASSH | IPs | Countries | Attempts | Success | Rate | Strategy |
|---|---|---|---|---|---|---|---|
| libssh 0.9.6 | f555226d | 421 | 59 | 14,222 | 24 | 0.17% | Botnet |
| libssh 0.11.x | 03a80b21 | 1,313 | 84 | 44,341 | 38 | 0.09% | Scanner |
| libssh 0.12.0 | af8223ac | 607 | 71 | 26,163 | 28 | 0.11% | Scanner |
| TOTAL | 2,341 | 84 | 84,726 | 90 | 0.11% | โ | |
All three campaigns share actor-6285990cc704. Deployed March 28-29, 2026 (0.9.6 + 0.11.x simultaneously), 0.12.0 added April 21. All ceased May 20-21.
๐ฌ II โ The Language (Letter B)
Family 1 โ The Recon Chain
56 IPs ยท 19 commands ยท Systematic reconnaissance + persistence
Same SSH RSA key as TI-2026-008 (Outlaw/Shellbot)
Commands: uname, whoami, cat /proc/cpuinfo, free -m, crontab, authorized_keys injection
Family 2 โ The Sentinel
7 IPs ยท Sentinel check + download ยท Distributed C2
Tests connectivity before payload delivery
Commands: curl/wget sentinel โ download payload โ execute
Bridge IP 45.172.152.74 appears in both 0.11.x and 0.12.0 campaigns โ cross-version node.
๐ III โ The Territory (Letter C)
| Continent | IPs | % | Top 3 Countries |
|---|---|---|---|
| Asia | 1,276 | 54.5% | CN=228, HK=187, SG=160 |
| Americas | 573 | 24.5% | US=313, BR=93, CO=30 |
| Europe | 353 | 15.1% | DE=68, RU=62, GB=47 |
| Africa | 67 | 2.9% | SC=24, KE=11, MA=9 |
| Oceania | 4 | 0.2% | AU=4 |
๐ธ๐จ Seychelles Per-Capita
240/M
267ร US rate
๐ข ByteDance Total
141
6% of swarm
๐จ๐ณ China in 0.11.x Only
96.5%
220 of 228 IPs
๐ณ IV โ The Genome (Letter D)
CVE Inventory
| Total CVEs in lineage | 38 |
| Unpatched in 0.9.6 | 6+ |
| CVE-2018-10933 relevance | NONE (client, not server) |
| Operator MitM-vulnerable | CVE-2023-2283 (0.9.6) |
Detection Diversification
| Block 0.9.6 only | 18% removed |
| Block 0.11.x only | 56% removed |
| Block all three | 100% |
| Requires knowing | All 3 HASSH values |
๐ V โ The Clock (Letter E)
Weekend vs Weekday
8.4%
Human scheduling
Burst Wave
2,339
3 hrs / 8 IPs / 37.5ร avg
NL Migration
+67%
11% โ 78% traffic
Precision Mode
136 IPs ยท 34.5% success ยท 263 commands
Curated targets, high interaction
Burst Mode
103 IPs ยท 6.5% success ยท 177 commands
Volume spray, carpet bombing
๐ VI โ The Credentials
| # | Username | Password | Attempts | IPs | Target Profile |
|---|---|---|---|---|---|
| 1 | admin | 123456 | 5,196 | 16 | Cloud VM consoles |
| 2 | admin | admin | 765 | 81 | Generic admin panels |
| 3 | pi | raspberry | 77 | 12 | Raspberry Pi / IoT |
| 4 | root | root | 40 | 38 | Linux servers |
| 5 | ubuntu | ubuntu | 14 | 8 | Ubuntu cloud images |
3,249 unique credential combinations ยท 16,770 total attempts ยท 37.2% honeypot success rate ยท Strategy: collect the unlocked ones, don't crack the locked ones
๐๏ธ VII โ The Infrastructure
Top Infrastructure Providers
| Provider | Type | IPs | Role |
|---|---|---|---|
| Aceville Pte Ltd (AS132203) | SG hosting | 157 | #1 ASN. 0.9.6 anchor (92 IPs). |
| ByteDance (AS4811+137718+150436) | CN/SG cloud | 141 | 6% of swarm. TikTok parent. |
| UCloud HK (AS135377) | HK cloud | 135 | Top in 0.11.x (73) and 0.12.0 (44). |
| Microsoft Azure (AS8075) | US cloud | 98 | All 3 campaigns. Persistent. |
| DigitalOcean (AS14061) | US cloud | 74 | All 3 campaigns. Cross-version. |
| TechTies Inc. (AS197170) | SC shell โ NL | 35 | Seychelles shell, NL hosted. Densest /24. |
| Cloud Innovation (14 ASNs) | SC shell | 24 | 14 ASNs, 1 beneficial owner. |
Two Seychelles shell companies (Cloud Innovation + TechTies) account for 59 IPs โ small in absolute terms but disproportionate to Seychelles' population (100,000). This is jurisdictional arbitrage at the ASN level.
๐ก VIII โ The Detection Landscape
48.8%
AbuseIPDB Score 100
1,143 of 2,340 IPs
Known-bad. Still active.
8.1%
GreyNoise "malicious"
190 of 2,340 IPs
Conservative classifier.
43.9
Avg Threat Score
Across all honeypot IPs
Moderate overall.
โ๏ธ Final Verdict โ What the Census Reveals
The libssh swarm is not a botnet in the traditional sense โ compromised home routers following simple instructions. It is a managed scanning infrastructure business. The evidence:
- Software engineering: 3 versions deployed in phases, fingerprint diversification, version management across 2,341 nodes
- Business scheduling: Weekday operations, precision/burst modes, human-triggered waves at UTC+8 business hours
- Jurisdictional optimization: Seychelles IBC shells, ByteDance cloud, Netherlands migration โ each hosting choice optimized for a different variable
- Operational security: Multiple library versions for detection evasion, coordinated deployment and cessation, acceptable risk calculation (own CVEs vs fingerprint stability)
- Industrial economics: 0.11% success rate is a feature, not a bug โ at 2,341 nodes scanning simultaneously, even fractions of a percent yield daily compromises that fund the operation
This is the complete census of the libssh swarm. Every number has been counted. Every pattern has been mapped. Every dimension has been analyzed. What emerges is not a portrait of chaos but of order โ an organization that builds, deploys, schedules, and optimizes its infrastructure with the discipline of a legitimate business.
The swarm does not buzz randomly. It hums.
๐ The Swarm Protocol โ Complete Series Index
| Letter A | The Library That Moves โ Organism identification: 3 campaigns, 1 actor cluster, libssh as client |
| Letter B | The Command Language โ 2 post-auth families, shared SSH key, Outlaw/Shellbot connection |
| Letter C | Eighty-Four Flags โ 84 countries, Seychelles 240/M, ByteDance 141 IPs, China version skew |
| Letter D | The Version Tree โ 38 CVEs, fingerprint diversification, operator's own MitM vulnerability |
| Letter E | The Temporal Pattern โ Human scheduling, burst/precision modes, NL migration |
| Letter F | The Census |
๐ฎ What Comes Next
The Swarm Protocol is complete. The next series โ TI-2026-050: The Toolmakers โ shifts focus from the libssh swarm to the Go_SSH fleet: 320 IPs, 43 countries, different tooling, different operator. Same honeypot. Different organism.
Sources: Cowrie honeypot ยท AbuseIPDB ยท GreyNoise ยท NVD ยท RDAP ยท entity_links ยท campaign dossiers ยท credential intelligence ยท network intelligence ยท All OSINT library references from 049A-049E
Investigation: TI-2026-049F ยท 6 evidence ยท 1 actor ยท 5 findings ยท 6 connections ยท 5 infrastructure
Total series: 6 investigations ยท 46 evidence ยท 15 actors ยท 34 findings ยท 31 connections ยท 28 infrastructure records
Confidence: HIGH โ multi-dimensional convergent analysis across five independent methods
Classification: TLP:WHITE