I. The Skeleton Key
On June 3, 2026, our honeypot captured a sequence of commands that tells a complete story in six lines:
Read this as a military operation order:
chattr -ia .ssh removes the immutable (-i) and append-only (-a) extended attributes from the .ssh directory. These are defensive hardening measures โ some administrators set them specifically to prevent SSH key modification. The operator expects this defense. The lockr command is a custom tool achieving the same on non-standard Linux distributions.
rm -rf .ssh && mkdir .ssh โ don't just modify the existing authorized_keys file. Destroy everything. Remove any other keys, any known_hosts, any config. Start fresh. This tells us: the operator doesn't care about preserving the target's legitimate SSH configuration. They're not sharing access โ they're taking it.
mdrfckr is appended to authorized_keys. From this moment forward, whoever holds the corresponding private key has passwordless, unrestricted root access to this system. Forever. Or until someone manually removes it.
chmod -R go= ~/.ssh removes all group and other permissions. This isn't just operational security โ it's functional requirement. SSH refuses to use authorized_keys if the permissions are too permissive. The operator knows the protocol specification.
II. The Locksmith's Signature
The key comment mdrfckr is not accidental. In the SSH key ecosystem, the comment field is cosmetic โ it has no cryptographic function. But it serves as a brand. The mdrfckr family has been documented in IoT botnet research since 2019, primarily targeting Raspberry Pi and embedded Linux devices. What we observe here is evolution: the same operators (or their tools) now targeting general-purpose SSH servers.
This key was deployed from 3 different source IPs over a 7-day window:
Three IPs deploying the same key means the private key is shared. In cryptographic terms, this is the equivalent of giving three people copies of your house key. You don't do that with strangers. This is an organization.
III. The HASSH Attribution Vector
Every SSH client, when connecting to a server, announces its capabilities in a specific order: key exchange algorithms, encryption algorithms, MAC algorithms, compression algorithms. The order and selection of these algorithms forms a fingerprint called HASSH โ the MD5 hash of this negotiation string.
HASSH is to SSH what a browser User-Agent is to HTTP โ except it's much harder to fake. Changing your HASSH requires recompiling your SSH client with different algorithm preferences. Most operators never bother.
eff4c24daffc8532c160e86e5f006e53This fingerprint is shared across 5 IPs in 4 countries. This is not a coincidence. This is not a popular SSH client version. This is one specific compiled binary, distributed to multiple operators.
4,066 admin/admin attempts
99 temporal correlations
Credential specialization
Same binary, different targets
Division of labor pattern
Identical negotiation order
Shared RDAP org with ISAEV
Same binary = same supplier
Same HASSH fingerprint
3rd country in the toolchain
Confirms distribution pattern
2 recipients in BG alone
IV. The CIA Parallel โ Codex and System Fingerprinting
The CIA's Codex framework defines "system fingerprinting" as the primary collection methodology for implant operations. The specification describes how to generate "a concise value" that uniquely identifies a system's configuration โ algorithm support, protocol versions, negotiation preferences.
This is exactly what HASSH does. The difference? HASSH is defensive โ we fingerprint their tools. The Codex specification fingerprints targets. Same technique, inverted perspective. The mathematical operation is identical: reduce complex protocol negotiation to a single hash that becomes an identity anchor.
The Codex specification was classified SECRET//SI. Its concepts are now implemented in open-source defensive tools. The arc from classified intelligence methodology to commodity attribution tool took approximately 6 years (Codex leaked 2017, HASSH published 2018). This compression of the classified-to-commodity pipeline is itself a finding: state-level tradecraft becomes criminal defense within a single software generation.
V. The NSA Precedent โ Persistent Access as Doctrine
The NSA's ANT catalog describes CM-II: a hardware implant providing "software persistence capability, in-field re-programmability, and covert communications" over USB. The implant communicates with the STRAITBIZARRE software through a "covert channel implemented on the USB".
The SSH key we observe in our honeypot is the software equivalent at zero hardware cost: persistence (key survives reboots), re-programmability (any command can be executed via the SSH session), and covert communications (SSH traffic is encrypted end-to-end, invisible to network monitoring that doesn't perform TLS inspection).
echo "ssh-rsa ..." >> authorized_keys command is a $0 implant that provides: (1) persistent access surviving reboots, (2) encrypted covert channel, (3) ability to execute arbitrary commands, (4) no hardware footprint. The only thing missing is hardware-level rootkit capability โ which the malware deployment phase (observed in our 051B analysis) immediately addresses.
VI. The Economics of Keys vs. Passwords
| Attribute | Password Access | SSH Key Access | Advantage |
|---|---|---|---|
| Persistence | Requires re-auth each session | Infinite sessions, zero re-auth | ๐ Key: โx |
| Survives rotation | Dies on password change | Survives password changes | ๐ Key: immune |
| Audit visibility | Logged in auth.log | Logged but appears legitimate | ๐ Key: stealth |
| Sharing cost | Risk increases with each share | Private key = unlimited operators | ๐ Key: O(1) |
| Revocation detection | Owner notices lockout | Owner never knows key exists | ๐ Key: invisible |
| Multi-system scaling | One password per system | One key for all systems | ๐ Key: O(n) |
The economic logic is overwhelming. A password gives you one session. A key gives you all sessions forever. The initial investment (gaining password access to deploy the key) is a one-time cost. The return (permanent access) is infinite. In financial terms, this is a trade with infinite ROI.
VII. The Attribution Chain
We can now construct a multi-vector attribution chain that does not depend on any single indicator:
Convergent Attribution โ Three Independent Vectors
When four independent attribution vectors converge on the same actor group, the probability of coincidence approaches zero. This is not correlation. This is identification.
VIII. The Deeper Pattern โ Infrastructure as Memory
Consider what an SSH key represents at the systems level: it is a persistent memory embedded in the target infrastructure. Unlike a password (which exists in the attacker's brain and the target's hash database), a key creates a bilateral relationship โ the public key lives on the target, the private key lives with the attacker. Neither party can forget the other exists.
This has profound implications for the threat landscape:
IX. From Lock Pick to Master Key โ The Evolution
This series has traced an evolution across four letters:
| Letter | Stage | Asset Created | Persistence |
|---|---|---|---|
| 051A | Credential Discovery | Username/password pairs | Until rotation (~never) |
| 051B | Post-Auth Exploitation | System fingerprints, malware | Until reboot/cleanup |
| 051C | Coordinated Stuffing | Access at scale, temporal cover | Per-session |
| 051D | Key Deployment | Permanent backdoor access | Infinite (until manual removal) |
Each stage builds on the previous. The password gets you in the door. The exploitation maps the terrain. The coordination provides cover. The key ensures you never need the door again. You've built your own entrance.
X. Investigative Continuity
The HASSH fingerprint eff4c24daffc8532c160e86e5f006e53 becomes our next investigative thread. Every new connection bearing this fingerprint adds to the map. Every new IP with this signature extends the known distribution network of the tool supplier.
The mdrfckr RSA key becomes a global indicator. Any organization that finds this public key in their authorized_keys file can now be certain: they are compromised by the same group our honeypot attracted. The key is not just evidence of compromise โ it is evidence of membership in a victim class.
Next: Letter E will examine how these harvested credentials and deployed keys feed into dark market economies โ the Telegram channels where access is priced, traded, and arbitraged. The key you just saw deployed is worth money. The question is: how much, and to whom?
Evidence Items: 5 | Actors: 3 | Infrastructure Nodes: 5 | Connections: 4
Attribution Vectors: HASSH + Temporal + Credential + SSH Key = CONVERGENT
Next Letter: TI-2026-051E "The Telegram Market"