WEDNESDAY 02:00 UTC โ THE BROADCAST BEGINS
I. The Wednesday Anomaly
Automated scanning tools โ cron jobs on VPS servers, botnet C2 loops, autonomous GoSSH instances โ have one defining characteristic: they don't take weekends off. A scan that runs while true; do scan; done produces roughly uniform daily distribution, modulated only by network congestion and target availability.
Our data shows something profoundly different:
II. The Numbers Station Parallel
During the Cold War, governments operated numbers stations โ shortwave radio transmitters that broadcast sequences of numbers, letters, or coded words on known frequencies at scheduled times. The broadcasts were:
๐ป Cold War Numbers Stations
- Public: Anyone with a shortwave radio could listen
- Scheduled: Same time, same frequency, every week
- Repetitive: Same number groups broadcast multiple times
- Encrypted: One-time pads made decryption impossible without the key
- Deniable: "We don't know who broadcasts those"
- Persistent: Some operated for decades without interruption
๐ Credential Storm Broadcasting
- Public: Anyone monitoring SSH traffic can observe attempts
- Scheduled: Wednesday, 02:00-04:00 UTC, every week
- Repetitive: Same credentials (admin/admin) tested millions of times
- Encoded: Timing, credential selection, and target order could encode messages
- Deniable: "It's just automated scanning"
- Persistent: 102+ days continuous operation observed
The numbers station's message isn't in the numbers themselves โ it's in the specific sequence that only the recipient with the one-time pad can decode. Similarly, the credential storm's message (if it exists) isn't in the credential itself โ it's in the timing, order, source IP, and target selection that only operators with shared context can interpret.
III. The Covert Communication Model
How could credential storms encode operational signals? Several channels exist within the protocol:
Channel 1: Temporal Encoding
The timing of scanning bursts encodes binary signals. Wednesday = active scan day. The ABSENCE of scanning on Saturday (17 sessions vs 3553) is as informative as the presence on Wednesday. In signals intelligence, this is called traffic analysis โ you don't need to read the message content when the pattern of transmission itself carries meaning.
Example: "If scanning starts at 02:00 UTC, proceed with Phase 1. If 19:00 UTC, proceed with Phase 2. If no scanning today, hold position."
Channel 2: Credential Selection
The choice of which credential pair to stuff signals target priority:
admin/adminโ General servers (14,662 attempts = "scan everything")admin/123456โ Default-configured devices (5,620 = "target fresh installs")root/rootโ Unix/Linux servers (298 = "limited, targeted")pi/raspberryโ IoT devices (419 = "build botnet capacity")ubuntu/ubuntuโ Cloud instances (79 = "low priority today")
The ORDER in which these credentials are tested โ which pair starts first, which follows โ could encode a priority sequence visible to all operators monitoring the same traffic.
Channel 3: Source IP Rotation
The 99 temporal correlations mean 99 IPs activate within the same 10-minute windows. Which IPs activate FIRST could encode identity โ "IP X goes first = Operator Alpha is leading today." Which activate LAST could confirm receipt โ "IP Y activates last = acknowledgment received."
IV. The FinFisher Precedent โ Covert Comms Are Commercially Available
"FinTraining Advanced: Covert Comms" โ a 1-week commercial training course covering:
- Steganography
- Encryption
- Network and application protocols
- Hiding data in objects
- Hiding data in streams
- Hiding VoIP communication
This is not theoretical. This is a commercial product. Governments and their contractors purchase training in hiding communication inside normal-appearing network traffic. The SSH authentication protocol โ with its predictable structure, high volume, and universal presence โ is an ideal carrier for steganographic content.
V. Historical Evolution of Covert Communication
Every era has its broadcast medium, and every broadcast medium eventually gets used for covert signaling:
| Era | Overt Medium | Covert Use | Detection |
|---|---|---|---|
| 1800s | Newspapers | Classified ads with coded messages | Pattern analysis by intelligence services |
| 1900-1940s | Telegraph/Radio | Encrypted transmissions, Morse variants | Direction finding, traffic analysis |
| 1950-1990s | Shortwave radio | Numbers stations (OTP encryption) | Monitored but unbreakable |
| 2000-2010s | Internet traffic | Steganography in images, DNS tunneling | Deep packet inspection, anomaly detection |
| 2020s+ | Credential storms | Timing/credential/IP selection as signal | Traffic analysis (this investigation) |
VI. What We Cannot Prove (Yet)
Intellectual honesty demands stating what this analysis can and cannot establish:
VII. The Deeper Reading โ What the Schedule Tells Us
Even without confirmed covert communication, the temporal pattern reveals something important about the operators:
This is the most important finding in the entire series. Behind the 14,662 attempts, behind the 326 IPs, behind the billion-dollar economics โ there is a person. A person who prefers Wednesdays. A person who wakes up before dawn. A person who takes weekends mostly off.
And that person, with their very human schedule, operates an industrial scanning operation that feeds a market worth billions. The banality of it is the finding. The credential storm that represents an existential threat to thousands of organizations worldwide is, at its source, someone's Wednesday morning job.
VIII. Investigative Continuity โ The Extended Series
This letter opens the extension of Series 051 beyond the original economic arc. The credential storm is not just a production line โ it is potentially a communication medium, a coordination mechanism, and a window into the operational rhythms of criminal infrastructure operators.
The next letters will investigate:
- 051H: Deep temporal analysis โ correlating scanning peaks with external events (CVE disclosures, geopolitical events, dark market activity cycles)
- 051I: Credential entropy analysis โ are some credential combinations information-theoretically unusual? Do they appear to encode data beyond authentication?
- 051J: Cross-sensor correlation โ comparing our temporal patterns with global honeypot networks to determine if the Wednesday pattern is local or universal
Hypothesis: Credential storms contain embedded operational signals
Key Evidence: 209:1 daily ratio | 50:1 hourly ratio | 99 temporal correlations
Historical Parallel: Numbers stations (Cold War โ Digital Age)
The signal is in the schedule. The message is in the silence.