The Shopping List

I. The Five-Phase Pipeline

A credential gets you through the door. But what's on the other side?

Our honeypot records every keystroke after successful authentication. Across the current observation window: 133 unique commands, executed in sequences that reveal not improvisation but protocol. Every attacker who runs commands follows the same five-phase pipeline:

The ordering is consistent across multiple IPs, multiple campaigns, and multiple weeks of observation. No attacker skips Phase 1 (fingerprinting). Most stop at Phase 2 (value assessment) — because 96.4% of sessions determine the target isn't worth exploiting (as documented in Series 050B, The Silent Handshake). Only the high-value minority proceeds to Phases 3-5.

This is a quality control system. The credential gets you in the factory. The shopping list determines what you take.

II. Phase 1: "What Am I Looking At?"

The first command after login is always identification. Not of the attacker — of the target.

Notice the redundancy. The command uname is tried via four different paths: /bin/uname, /usr/bin/uname, busybox uname, and bare uname. This is not uncertainty — it's environmental resilience. The script must work on full Linux, stripped containers, BusyBox-based IoT devices, and embedded systems where PATH is non-standard.

The fingerprinting answers four questions simultaneously:

1. What payload architecture? — x86_64, aarch64, armv7l, mips? This determines which binary to download.
2. What exploitation surface? — Kernel version determines which local privilege escalation exploits work.
3. What mining potential? — CPU count and model determine crypto-mining profitability.
4. What network position? — Internal IP reveals whether lateral movement is possible.

The CIA's Vault 7 "Codex Spec" (SECRET//ORCON/NOFORN) defines a standardized metadata collection format: "original filename, path, size, MD5 hash, modified time, accessed time, created time, owner, group." The same intelligence requirement — characterize the target before exploitation — drives both nation-state operations and criminal botnets. The methodology is identical. Only the classification level differs.
— WikiLeaks, CIA Vault 7: Codex Specification, 2017

III. Phase 2: "Is This Worth My Time?"

After fingerprinting comes the economic decision. Not every compromised system is worth exploiting. The attacker must determine: is the marginal revenue of deploying a payload greater than the marginal cost of maintaining access?

The 1 GB threshold is the most revealing command in the entire dataset. It is an explicit, coded economic decision. The operator has calculated that:

• A machine with <1 GB RAM mines at approximately X hash/second
• At current Monero difficulty, this produces <$Y per month
• Maintaining the compromised host (C2 communication, persistence, updates) costs approximately $Z
• When Y < Z, the host is abandoned.

This is not hacking. This is asset management. The same calculation a venture capitalist makes when deciding which portfolio companies to continue funding.

Read between the lines: The 1 GB threshold tells us exactly what the attacker is deploying: a cryptocurrency miner. Not ransomware (which would encrypt regardless of RAM). Not a botnet relay (which needs bandwidth, not memory). Not data exfiltration (which needs disk access, not RAM). The memory check IS the payload declaration.

IV. Phase 3: "Nobody Saw Me Here"

Before touching anything permanent, the sophisticated attacker erases the evidence of their own commands:

Four commands to disable history. Four. Two exports and two unsets. The redundancy is deliberate — it covers bash, ksh, zsh, and any other shell that might be running. The attacker doesn't know which shell they landed in, so they clear ALL of them.

But the fifth command is the masterpiece: if ! type export. This tests whether the type builtin works as expected. In real bash, type export returns "export is a shell builtin." In Cowrie (our honeypot), the implementation is imperfect — it may not handle this query correctly.

The attacker is testing whether they're in a real system or a trap.

The output string "ERROR: BADtype: export" is never displayed to us — it's checked internally by the script. If the test fails (indicating a honeypot), the script likely terminates. The commands we see are only the ones that didn't detect the deception.

The implication: For every session we observe, there may be sessions that detected our honeypot and silently disconnected. Our data contains only the survivors of the detection filter — the commands from tools that weren't sophisticated enough to identify Cowrie, or from operators who don't include the detection check.

V. Phase 4: "The Lock Changes But I Keep My Key"

Persistence is the difference between a one-time theft and ongoing access. Two techniques dominate:

The SSH key injection is elegant in its finality. The attacker doesn't just add their key — they destroy the entire .ssh directory and rebuild it from scratch. This serves three purposes:

1. Eliminates the legitimate owner's keys — preventing them from using key-based auth to investigate
2. Eliminates competitor keys — previous attackers lose their persistence
3. Creates a clean slate — no residual authorized_keys entries to detect

But the chattr -ia command tells a deeper story. The -i flag removes the "immutable" attribute. The -a flag removes "append-only." These flags can only be SET by root. Their presence means a previous attacker — who also had root — marked the .ssh directory as immutable to protect their own persistence mechanism.

This is a territorial conflict. Multiple attackers competing for the same resource, using Linux filesystem attributes as locks and lockpicks. The first attacker sets immutable to protect their key. The second attacker removes immutable to overwrite it with theirs.

The recursive irony: The very persistence mechanism that makes a compromised host valuable (key-based re-entry) makes it a target for other attackers. A system with an SSH key in authorized_keys is not just compromised — it is improved infrastructure from the next attacker's perspective. They just need to replace one key with another.

VI. Phase 5: "Delivery"

The final phase. The payload arrives. Three distinct delivery mechanisms observed:

Three delivery mechanisms, three operator profiles:

Meow (France/GCP) — The DDoS operator. ulimit -n 1020000 is the smoking gun: increasing file descriptors to one million means the binary needs to maintain a million simultaneous connections. That's a DDoS botnet. It downloads BOTH x86 and arm64 variants — wasteful but architecturally agnostic. The echo '123456' | sudo -S reveals it uses the same password for sudo escalation that worked for SSH — exploiting the probability that default passwords are reused across services.

Chinese /linux (Triple Fallback) — The resilient operator. Four C2 servers, three download methods. If curl is absent, try wget. If wget is absent, use raw bash TCP (/dev/tcp). The random filenames evade simple grep-based detection. The nohup ensures the download survives even if the SSH session is killed. This operator expects network filtering and has engineered around it.

dl600 (Latvia/BusyBox) — The IoT specialist. busybox wget targets the stripped-down environment of routers, cameras, and embedded devices. The payload name "dl600" suggests a scanner/spreader (numerical naming convention common in Mirai variants).

VII. The Contested Resource

The most human detail in the entire command set is the competition:

Read this sequence carefully. The attacker is:

1. Deleting competitor scripts (secure.sh, auth.sh — names chosen to look legitimate)
2. Killing competitor processes (force-kill, no graceful shutdown)
3. Emptying hosts.deny — removing IP blocks that a previous attacker may have set to prevent others from accessing the system
4. Killing all sleep processes — breaking timer-based persistence of competitor malware

This is gang warfare for CPU cycles. The compromised system is a contested resource, and multiple criminal operations fight over it in real-time. The attacker who arrives second must first evict the attacker who arrived first.

The echo > /etc/hosts.deny is particularly revealing. A previous attacker modified hosts.deny to BLOCK other IPs from connecting — an attempt to monopolize the compromised system. The new attacker empties this file to restore access for themselves (and anyone else). It's the digital equivalent of cutting someone else's padlock off a squat.

"A coordinated international law enforcement operation resulted in the seizure of HIVE SPIDER infrastructure and acquisition of the Hive ransomware decryption key. The U.S. Department of Justice has reportedly maintained access to HIVE SPIDER's internal infrastructure since July 2022."
— CrowdStrike Global Threat Report, 2024

Even law enforcement participates in the same dynamic: maintaining persistent access to criminal infrastructure without the criminal knowing. The DOJ was inside HIVE SPIDER for six months, observing. The same access-persistence-surveillance pipeline that criminals run against victims, governments run against criminals. And sometimes — as the Snowden documents proved — against everyone else too.

VIII. The Kill Chain Economy

The Verizon DBIR 2024 reports 5,175 System Intrusion incidents with 3,803 confirmed data disclosures. Financial motive: 95%. Espionage: 5%. The credential-to-exploitation pipeline we've documented in this letter IS that statistic — observed at the individual command level.

The full economic chain:

The entire chain — from scan to revenue — is automated, economic, and optimized. The human involvement is in the initial tool development and infrastructure management. The execution is pure machinery.

And this is just the mining path. For ransomware affiliates (documented by CrowdStrike as "Initial Access Brokers"), the validated credential is itself the product — sold for $10-$10,000 depending on the target's industry, revenue, and network size. The shopping list in Phase 2 is also a pricing inventory: more CPUs, more RAM, more value.

IX. The Thread Forward

This letter documented the shopping list — what happens after the credential works. Five phases, three delivery mechanisms, one economic logic: maximize revenue per compromised host while minimizing detection risk.

The next letter — TI-2026-051C: "The Stuffing Machine" — will examine the credential-reuse patterns that connect different IPs to the same operator. When the same username/password pair appears from 10+ different source IPs, it's not coincidence. It's a distributed workforce sharing the same input list.

They didn't break in to look around.
They arrived with a list. They checked every item.
And if the system wasn't worth their time, they left.