The Food Chain

Step back far enough and the individual campaigns dissolve into something larger. Not fifteen separate scanning operations. One ecosystem. A food chain where each tier feeds the next, information flows upward, and the smallest groups extract the most value.

We've spent three letters inside the Go_SSH fleet — its tools, its post-authentication behavior, its offshore shells. Now we zoom out. The Go_SSH fleet is one species in an ecosystem of fifteen. Understanding where it sits in the hierarchy reveals not just what it does, but what it is for.

I. The Census of Campaigns

The honeypot identifies fifteen distinct SSH scanning campaigns by HASSH fingerprint, operating simultaneously in the same observation window. Together they command 4,619 IPs, generate 133,428 connection attempts, and achieve 11,500 successful authentications.

Fifteen tools. Four programming languages (C, Go, Python, plus compiled binaries). Four confirmed actor clusters. Twenty-three unattributed campaigns. This is not a single threat. This is an industry.

II. The Three Tiers

Sort the campaigns by success rate and three tiers emerge — each with a distinct role in the ecosystem's value chain.

Where Go_SSH Sits

Go_SSH at 4.68% success occupies Tier 2 — the validation layer. This position explains everything we've observed across the previous letters:

• The two-phase architecture (050B) makes sense as a Tier 2 operation: validate credentials at scale, then profile validated hosts for Tier 3 consumption.

• The offshore shell infrastructure (050C) makes sense as persistent Tier 2 infrastructure: the TechTies recon nodes are the bridge between validation (Tier 2) and exploitation (Tier 3).

• The mega-command's GPU detection (050B) makes sense as Tier 2 triage: GPU-equipped hosts are flagged as high-value for Tier 3 exploiters who deploy mining software.

• The honeypot detection (050B) makes sense as Tier 2 quality control: remove false positives before passing the inventory upward.

Go_SSH is not the endgame. It is the supply chain.

III. The Four Actors

Of fifteen campaigns, four have been linked to confirmed actor clusters by the automated attribution system. Each cluster represents a distinct operational identity.

Four confirmed. Eleven unattributed — including Go_SSH, AsyncSSH, Paramiko, PuTTY, Ncrack, and Hydra. The attribution system links campaigns when they share IPs, credentials, command fingerprints, or infrastructure patterns. The Go_SSH fleet shares none of these with any attributed cluster — confirming our finding from 050A that it operates independently.

But "independent" does not mean "unconnected." The TechTies bridge links Go_SSH infrastructure to the libssh swarm's actor-6285990cc704. The ecosystem is connected by infrastructure, not by operations.

IV. The Clock

The Go_SSH fleet's temporal pattern is unlike any other campaign in the ecosystem.

Sixty-one percent of all Go_SSH activity occurs in a two-hour window: 02:00 to 04:00 UTC. This is not random scanning. This is a scheduled batch job.

The Timezone Translation

02:00-04:00 UTC translates to:

The CET/EET window is the most compelling: 04:00-06:00 CET is when European hosting providers' abuse teams are asleep, automated monitoring systems are processing overnight logs, and network traffic is at its daily minimum. For a European operator, this is the optimal window to run scanning batches — maximum activity, minimum observation.

Compare with the libssh swarm from TI-2026-049E: the libssh burst was also 02:00-04:00 UTC, but interpreted as 10:00-12:00 CST (China Standard Time) — mid-morning for Chinese operators. Same UTC window, different local interpretation. The timestamp alone cannot distinguish European pre-dawn from Chinese mid-morning.

V. The Third Shell

While mapping the broader ecosystem, a third Seychelles entity emerged: IP Volume inc (AS202425).

Three shell companies. Three ASNs. One jurisdiction. If any single entity is suspended by RIPE (the European IP registry), the other two continue operating with their separate ASN allocations and separate RDAP records. This is infrastructure resilience through corporate multiplication — the same principle that drives financial shell company networks, applied to network infrastructure.

VI. The Four Downloads

Buried in the timeline data: four file downloads. In 3,476 connections over seven days, four resulted in a file being downloaded to the honeypot. We had not seen this in earlier session samples because the downloads occurred during the peak activity windows — lost in the flood of validation sessions.

Four downloads from 333 successful authentications. That's 1.2%. If these represent exploitation payloads — cryptominers, backdoors, botnet clients — then only 1.2% of validated hosts receive a payload. The rest remain in inventory: credentials confirmed, host profiled, but not yet exploited. This matches the access broker model: validate thousands, exploit dozens, hold the rest for sale.

VII. The Ecosystem Is the Threat

The individual campaigns — libssh, Go_SSH, AsyncSSH, Paramiko — are components. The ecosystem is the threat.

4,619 IPs from 15 campaigns scan the same target space simultaneously. They use different tools, different infrastructure, different strategies. Some are linked by actor clusters. Some share infrastructure through Seychelles shells. Some operate entirely independently. But together, they create a comprehensive, continuous, multi-layered assault on every SSH server connected to the internet.

No single campaign covers every target. But the ecosystem does. No single tool evades every defense. But the diversity of tools ensures that some percentage always gets through. No single operator has the best credentials, the best infrastructure, the best timing. But the ecosystem, collectively, has all of these.

The lesson is not "block Go_SSH." The lesson is that SSH scanning is an economic ecosystem with division of labor, specialization, supply chains, and value extraction at every tier. Disrupting one campaign shifts activity to others. The only effective defense is at the target level: strong credentials, key-based authentication, and monitoring that detects post-compromise behavior regardless of which scanner found the door.

VIII. The Thread Forward

The final letter of this series brings it all together. The Go_SSH fleet. The libssh swarm. The six ecosystems. The three Seychelles shells. The two-phase architecture. The mega-command. The food chain.

Letter E is the synthesis — the complete picture of what the Toolmakers built, how it operates, and what it means for every SSH server on the internet. It is the assessment. The conclusions. And the recommendations for anyone defending against an ecosystem that never sleeps, even if it only runs its batch jobs on Wednesday mornings.