The Final Premise: Over five previous letters, we dissected a machine. We watched credentials enter one end and tradeable access tokens emerge from the other. We identified the operators, mapped their coordination, decoded their tools, traced their persistence mechanisms, and located their markets. Now we step back and see the whole: not a collection of malicious activities, but a coherent economic system โ a distributed corporation with annual revenue measured in billions, zero formal registration, no headquarters, and operations spanning 50+ countries simultaneously.
13,991
Total SSH sessions captured by one sensor on one IP in 102 days
I. The Corporation's Organizational Chart
Based on 102 days of continuous observation, we can now construct the org chart of the credential harvesting enterprise that targets our infrastructure:
๐ด AS51852 โ Private Layer Inc. (Panama/Switzerland)
5,479 admin/admin attempts | Largest single-ASN contributor (37.4%)
Role: PRIMARY SCANNER โ Highest volume, broadest target selection
Jurisdiction: Panama registration, Swiss infrastructure โ dual-shield design
Role: PRIMARY SCANNER โ Highest volume, broadest target selection
Jurisdiction: Panama registration, Swiss infrastructure โ dual-shield design
๐ด AS200730 โ ISAEV Igor (Poland/Russia/Kazakhstan)
4,066 admin/admin attempts | Second largest (27.7%)
Role: SPECIALIZED SCANNER โ HASSH-linked cluster, division of labor by credential type
Cross-border tool distribution: PL โ BG โ RU (same compiled binary)
99 temporal correlations prove coordinated fleet operation
Role: SPECIALIZED SCANNER โ HASSH-linked cluster, division of labor by credential type
Cross-border tool distribution: PL โ BG โ RU (same compiled binary)
99 temporal correlations prove coordinated fleet operation
๐ AS42237 โ w1n Ltd. (UK/Sweden)
3,678 admin/admin attempts | Third largest (25.1%)
Role: HIGH-FREQUENCY SCANNER โ UK-registered, Sweden-hosted
Combined with AS51852 and AS200730: 90.2% of all admin/admin volume from 3 entities
Role: HIGH-FREQUENCY SCANNER โ UK-registered, Sweden-hosted
Combined with AS51852 and AS200730: 90.2% of all admin/admin volume from 3 entities
๐ฃ AS202412 โ Omegatech LTD (Seychelles/Netherlands/Ukraine)
714 admin/admin + presence across ALL credential types
Role: UNIVERSAL INFRASTRUCTURE โ Jurisdictional arbitrage layer
Three-country architecture (SC/NL/UA) maximizes law enforcement friction
Role: UNIVERSAL INFRASTRUCTURE โ Jurisdictional arbitrage layer
Three-country architecture (SC/NL/UA) maximizes law enforcement friction
The 90% Rule: Three ASNs produce 90.2% of all admin/admin credential stuffing against our sensor. This is not a distributed internet phenomenon. This is not "background noise." This is three entities operating a coordinated industrial process. The remaining 9.8% is divided among 323 other IPs โ the market's long tail of smaller operators and compromised botnets.
โฌฅ โฌฅ โฌฅ
II. Revenue Model โ From Our Sensor to Global Estimate
Production Economics
Infrastructure
$16K/mo
326 IPs ร $50 VPS
$16K/mo
326 IPs ร $50 VPS
โ
Production
14,662 attempts
per target, 102 days
14,662 attempts
per target, 102 days
โ
Validation
~1% success
real-world estimate
~1% success
real-world estimate
โ
Revenue
$50K-500K/mo
at $10-100/access
$50K-500K/mo
at $10-100/access
| Variable | Conservative | Moderate | Aggressive |
|---|---|---|---|
| Scanning IPs (observed) | 326 | ||
| Monthly infra cost (@$50/VPS) | $16,300 | ||
| IPs scanned per day per scanner | 10,000 | 50,000 | 200,000 |
| Total IPs scanned/day (fleet) | 3.26M | 16.3M | 65.2M |
| Success rate (real-world) | 0.01% | 0.1% | 0.5% |
| Validated accesses/day | 326 | 16,300 | 326,000 |
| Average sale price | $10 | $25 | $50 |
| Daily revenue | $3,260 | $407,500 | $16.3M |
| Monthly revenue | $98K | $12.2M | $489M |
| Annual revenue | $1.2M | $146M | $5.9B |
| ROI (monthly) | 6:1 | 750:1 | 30,000:1 |
Calibrating the Estimate: The moderate scenario is most plausible. CrowdStrike documents "thousands" of access broker advertisements, Verizon confirms 31% of breaches involve stolen credentials, and FinCEN records $590M in ransomware payments in just 6 months. For the credential supply chain to support a $1.2B/year ransomware market, it must produce access at the $100M+ annual scale. Our moderate estimate of $146M/year for ONE actor group (of hundreds globally) is consistent with this macro-data.
โฌฅ โฌฅ โฌฅ
III. The Global Market โ Macro Context
๐ FinCEN Advisory โ Ransomware Financial Trends 2021
$590 million in ransomware-related transactions in the first 6 months of 2021. Annualized: ~$1.2 billion/year in direct ransomware payments alone. This doesn't include: business disruption costs (est. 10x), insurance payouts, incident response costs, regulatory fines. Total economic impact: $10-20 billion annually.
๐ Sophos State of Ransomware 2024
Average ransomware payment for $5B+ revenue organizations: $2 million. 85% of victims pay less than demanded. 29% pay the exact demand. 18% pay more than demanded. The market has price discovery mechanisms โ victims negotiate, attackers price according to victim revenue. This is a mature, rational market.
๐ Europol โ Cryptocurrency Tracing Report
Hydra marketplace (Russia-language, largest before seizure) demonstrated the viability of dark market infrastructure at scale. Crypto transaction analysis reveals annual revenue in hundreds of millions. The credential access market operates on the same infrastructure model โ just different product listings.
Where Our Data Fits: Our honeypot observes the bottom of the pyramid โ the raw credential stuffing that produces the initial access. But this bottom layer supports the entire structure above it. Without credential harvesting, access brokers have no inventory. Without inventory, ransomware operators have no entry points. Without entry points, there's no $590M in payments. Our 14,662 admin/admin attempts are the foundation of a billion-dollar economic pyramid.
โฌฅ โฌฅ โฌฅ
IV. The Series Synthesis โ Six Letters, One Machine
051A
The Password Is the Product
Raw material extraction. 14,662 attempts. Power-law distribution reveals industrial structure, not chaos. Three entities = 90% of volume.
051B
The Shopping List
Quality control. 5-phase post-auth pipeline: fingerprint โ assess โ clear โ persist โ deploy. The meow botnet. Chinese C2. Anti-forensics prove professional operation.
051C
The Stuffing Machine
Manufacturing. 99 temporal correlations. ISAEV subnet division of labor. Viettel residential delegation. This is coordinated production, not independent scanning.
051D
Keys to the Kingdom
Product assembly. mdrfckr RSA key deployed by 3 IPs. HASSH proves shared toolchain across 4 countries. The SSH key IS the product โ permanent, transferable access.
051E
The Telegram Market
Distribution. Access broker market growing 20% YoY. Telegram as market infrastructure. Seychelles jurisdictional arbitrage. The product meets the buyer.
051F
The Economy of Access
Macro-synthesis. $146M+ annual revenue (moderate estimate). ROI 750:1. 90% concentration proves corporate structure. Global market: $10B+ ecosystem.
โฌฅ โฌฅ โฌฅ
V. The Distributed Corporation โ Organizational Analysis
Traditional corporations have legal structures: CEO, board, shareholders, employees. The credential harvesting enterprise we've documented has functional equivalents without any of the legal scaffolding:
| Corporate Function | Traditional Corp | Credential Enterprise |
|---|---|---|
| R&D | Product development | GoSSH tool development, HASSH-fingerprinted binary compilation |
| Manufacturing | Production line | 326 IPs scanning 24/7, automated credential testing |
| Quality Control | Product testing | Post-auth validation pipeline (051B) |
| Sales | Market access | Telegram channels, dark forums, access broker listings |
| Logistics | Supply chain | Bulletproof hosting, VPN chains, Tor routing |
| Finance | Treasury, banking | Crypto wallets, mixers, DeFi laundering |
| Legal | Compliance, IP | Jurisdictional arbitrage (SC/NL/UA/PA/CH) |
| HR | Recruitment | Forum recruitment, affiliate programs, botnet delegation |
The Key Insight: This is not a gang. This is not a hacker collective. This is a corporation without incorporation โ achieving organizational coherence through shared tooling (HASSH proves same binary = same supplier), shared timing (temporal correlations prove coordination), and shared economic incentives (the market rewards production). No employee contracts needed when the market itself coordinates behavior. No HR department needed when crypto payments are automatic. No legal department needed when jurisdictional arbitrage eliminates prosecution risk.
โฌฅ โฌฅ โฌฅ
VI. Why It Will Continue โ The Structural Advantage
This enterprise has structural advantages that make disruption extremely difficult:
1. Zero Marginal Cost of Production: Once the scanning infrastructure is deployed, each additional credential attempt costs effectively nothing. The tool is free (GoSSH, open source). The credential list is free (public dictionaries). The only variable cost is bandwidth โ pennies per million packets.
2. Perfect Information Asymmetry: The attacker knows immediately whether a credential succeeds. The defender often never knows a successful authentication was illegitimate. The SSH key deployed in 051D may sit in authorized_keys for years without detection.
3. Jurisdictional Immunity: No single nation-state can disrupt the operation. The Seychelles won't extradite. Ukraine can't process LE requests during war. Russia actively protects operators targeting Western infrastructure. Panama has no cyber crime enforcement capacity. The architecture exploits international law's fundamental limitation: sovereignty creates prosecutorial gaps.
4. Market Demand Is Growing: Ransomware payments increase yearly. Access broker advertisements increase 20% YoY. The buyer side of the market is expanding faster than defenses improve. As long as organizations connect systems to the internet with default credentials, the supply side faces no scarcity.
โฌฅ โฌฅ โฌฅ
VII. The Human Cost โ What Numbers Don't Show
Behind Every Credential: Our statistics are cold โ 14,662 attempts, 326 IPs, 102 days. But each successful credential stuffing attack against a real target (not our honeypot) represents: a hospital whose patient records become leverage for extortion. A university whose research is stolen or encrypted. A small business whose data becomes permanently inaccessible. A municipality whose services stop functioning.
The $590M in ransomware payments FinCEN documents represents organizations that could pay. The uncounted victims are those who couldn't: the small clinic that closes, the nonprofit that loses its donor database, the school district that operates on paper for months. The credential we watch being tested 14,662 times is the first domino in a chain that ends with real human suffering.
The $590M in ransomware payments FinCEN documents represents organizations that could pay. The uncounted victims are those who couldn't: the small clinic that closes, the nonprofit that loses its donor database, the school district that operates on paper for months. The credential we watch being tested 14,662 times is the first domino in a chain that ends with real human suffering.
โฌฅ โฌฅ โฌฅ
VIII. What Comes Next โ Series 051 Extension
This letter concludes the original arc of Series 051 โ from raw credential to global economy. But the investigation opens new doors:
The Communication Hypothesis: Within the 14,662+ credential attempts lies a pattern that mirrors historical covert communication: repetitive transmissions from many sources, encoding meaning in the selection and timing of credential pairs. Like encrypted radio broadcasts that "everybody listens to but nobody knows what it's about" โ are some credential combinations actually messages? The temporal correlations (99 IPs in same 10-minute windows) suggest coordination that goes beyond simple scanning. Series 051G+ will investigate whether credential storms contain steganographic communication channels between operators.
Series 051 โ Final Assessment
Six letters. One machine. A distributed corporation operating without incorporation, achieving organizational coherence through shared tools, shared markets, and shared incentives. Annual revenue: conservatively $1.2M for this single group, plausibly $146M+, operating within a $10B+ global ecosystem.
What our single honeypot captured in 102 days is a window into an enterprise that has been running โ and growing โ for over a decade. The credentials will continue. The keys will continue to be deployed. The markets will continue to clear. The ransomware will continue to encrypt.
The only question remaining: what else are they saying to each other in the noise?
TI-2026-051F | Classification: UNRESTRICTED | Confidence: HIGH
Series 051 "The Credential Harvest" โ COMPLETE (6/6 original letters)
Total Evidence: 30 items | Actors: 18 | Infrastructure: 22 nodes | Connections: 21
Economic Model: $146M/year (moderate) | Market Context: $10B+ ecosystem
Extension: TI-2026-051G+ "The Signal in the Noise" โ COMING
Series 051 "The Credential Harvest" โ COMPLETE (6/6 original letters)
Total Evidence: 30 items | Actors: 18 | Infrastructure: 22 nodes | Connections: 21
Economic Model: $146M/year (moderate) | Market Context: $10B+ ecosystem
Extension: TI-2026-051G+ "The Signal in the Noise" โ COMING