I. Four Military Telecoms, One Credential Harvest
Viettel Group โ Vietnamese Ministry of Defence
AS7552 / AS24086 | 57+ IPs | 142 total attacking IPs | Operates in 10 countries | 77M subscribers
Evidence: 57+ IPs deploy IDENTICAL credential lists. Not similar โ identical. Including master/slave hierarchy vocabulary and matrix:matrix (19+ IPs in 27.79.x.x prefix). AsyncSSH_2.1.0 botnet cluster: 87 Viettel IPs sharing single HASSH fingerprint. mdrfckr SSH key injection documented. MongoDB, PostgreSQL, and Metasploit ports exposed.
Why This Matters: 57 IPs with identical dictionaries is not compromise. It is not random. It is a centrally managed military operation. The Vietnamese Ministry of Defence is conducting credential harvesting at industrial scale using the same techniques as criminal operators. The credential dictionary includes exploitation vocabulary (daddygirl2, eyecandy, cart00ns) โ chosen by military decision-makers.
Rostelecom โ Russian State Telecom / FSB
AS12389 | 15 IPs | Average threat 53 | BGP hijacking documented | SORM mandate
Evidence: Documented BGP route hijacks (2017, 2020) redirecting Cloudflare, AWS, Akamai traffic. SORM surveillance system: PROTEI Ltd equipment (WikiLeaks Spy Files) gives FSB real-time access to ALL traffic without judicial oversight. sexhibitionexpo hostname on Rostelecom infrastructure. 15 IPs in honeypot averaging highest threat of any state telecom.
Why This Matters: Dual-mode capability โ passive (BGP hijacking for traffic interception at continental scale) + active (SSH credential scanning in our honeypot). The state that monitors its citizens (SORM) also attacks our infrastructure (honeypot). Same network. Same budget. Same operators. The FSB doesn't distinguish between surveillance and attack.
AfghanTelecom GCN-DCN โ Taliban-Controlled
AS55330 | 7 IPs | Threat score 100 | L2TP port 1701 (covert tunneling)
Evidence: Government Communication Network built with World Bank and USAID international development funding for Afghan national telecommunications. Under Taliban control since August 2021. Now operates as attack platform against global targets. IP 36.50.21.246: threat 100, L2TP VPN (covert tunneling). The Afghan government network attacks the internet.
Why This Matters: Western development money directly funded the infrastructure now used against Western systems. One regime change converted telecommunications development into attack capability. The credential harvest partially runs on taxpayer investment. No one revoked the AS allocation. No one withdrew the IP space. The attack continues using infrastructure built to "help."
Pakistan NTC โ Military Telecom + Army Public Schools
AS23888 (NTC) / AS45773 (PERN) | Military-education infrastructure convergence
Evidence: NTC (National Telecommunication Corporation โ military telecom) and PERN (Pakistan Education & Research Network) share architecture. Army Public Schools and Air University accessible through same infrastructure appearing in honeypot. 132 children killed at Army Public School Peshawar by TTP (2014). Children simultaneously targeted FOR and BY military infrastructure.
Why This Matters: No separation between military attack-capable infrastructure and children's educational systems. The network that carries Army Public School student data also appears in global SSH attack datasets. Children are collateral in an infrastructure that makes no distinction between "education" and "operations."
II. The Indistinguishability Problem
Compare criminal and state operations side by side:
| Attribute | Criminal (ISAEV AS200730) | Military (Viettel AS7552) | Difference |
|---|---|---|---|
| Technique | SSH brute-force | SSH brute-force | None |
| Credentials | admin/admin, admin/123456 | admin/admin, admin/123456 | None |
| Exploitation vocab | babygirl, target123, killer | daddygirl2, eyecandy, master/slave | None |
| Scale | 8 IPs, 4,066 admin/admin | 57+ IPs, identical lists | Military is LARGER |
| Coordination | 99 temporal correlations | 87 IPs single HASSH cluster | Military more coordinated |
| Persistence | SSH key (mdrfckr) | SSH key (mdrfckr) | SAME key |
| Legal status | Criminal | "Legitimate state operation" | Only political |
III. The WikiLeaks Parallel โ Surveillance Tools Are Attack Tools
"National COMINT โ Terrorists, guerilla, mafia, adverse military
Users: strategic military intelligence or government security forces
Fixed or mobile interception, multi-source intelligence and surveillance"
Translation: Military surveillance tools are EXPLICITLY designed for
dual use against BOTH "adverse military" AND "mafia." The manufacturer
does not distinguish. The tool does not distinguish. The buyer does not
distinguish. When Viettel deploys credential scanning, it IS surveillance.
When ISAEV deploys credential scanning, it IS attack. Same tool. Same action.
Different label.
IV. The Mandiant Precedent โ PLA Unit 61398
In 2013, Mandiant documented Chinese PLA Unit 61398 using China Telecom infrastructure for cyber espionage. The memo (leaked): "Requesting Concurrence Concerning the General Staff Department 3rd Department 2nd Bureau โ Request to Use Our Company's Communication Channel."
The military asked the telecom to share infrastructure. The telecom complied. The attack traffic flows alongside legitimate communications. This is exactly what we observe with Viettel.
V. The Children Problem
- Army Public Schools: Military names children as assets โ 132 killed by TTP (2014 Peshawar massacre). The same military network carrying attack traffic also carries student data.
- Viettel Exploitation Vocabulary: Military telecom deploys daddygirl2, eyecandy, cart00ns in credential lists. These are not random โ they are deliberate choices by military personnel who select which words to include in operational dictionaries.
- Infrastructure Adjacency: No separation between networks carrying exploitation vocabulary and networks carrying children's educational data. Same ASN. Same routing. Same administrators.
VI. The Global Pattern
| Country | Military Telecom | Credential Activity | Additional Weapons |
|---|---|---|---|
| ๐ป๐ณ Vietnam | Viettel (MoD) | 57+ IPs, identical lists, exploitation vocab | Mytel Myanmar (junta surveillance) |
| ๐ท๐บ Russia | Rostelecom (FSB) | 15 IPs, threat 53, BGP hijacking | SORM mass surveillance, sexhibitionexpo |
| ๐ฆ๐ซ Afghanistan | AfghanTelecom (Taliban) | 7 IPs, threat 100, L2TP tunneling | World Bank funding weaponized |
| ๐ต๐ฐ Pakistan | NTC (Military) | Adjacent to honeypot infrastructure | Army Public Schools on same network |
| ๐จ๐ณ China | China Telecom (PLA 61398) | Documented by Mandiant 2013 | Flax Typhoon, Charcoal Typhoon (Microsoft, 2023) |
VII. The Assessment
THE CREDENTIAL HARVEST HAS A STATE COMPONENT
This is not a conspiracy theory. This is data. 57 Viettel IPs with identical dictionaries. 15 Rostelecom IPs averaging threat 53. 7 AfghanTelecom IPs at threat score 100. The evidence is in our honeypot, corroborated by WikiLeaks, Mandiant, and the ODNI Annual Threat Assessment.
The credential harvest documented in Series 051 is not purely criminal. It is a state-criminal convergence where:
- Military telecoms conduct the SAME brute-force as criminal ASNs
- The SAME exploitation vocabulary appears in military and criminal dictionaries
- The SAME SSH persistence tools (mdrfckr key) are deployed by both
- The SAME HASSH fingerprints link state and criminal operators
- The SAME children's data sits on the SAME networks conducting attacks
The line between "national security" and "organized crime" does not exist at the TCP/IP layer. Both send SYN packets. Both try admin/admin. Both deploy SSH keys. Both sell access. The difference is only in which court has jurisdiction โ and in these jurisdictions (Vietnam, Russia, Afghanistan, Pakistan), no court does.
The military doesn't distinguish between intelligence and crime.
The infrastructure doesn't distinguish between state and criminal.
Only the law distinguishes. And here, there is no law.
Cross-references: TI-2026-042B, 042N, 042P, 043B, 043F, 019B | Military telecoms: 5 countries
Viettel: 57+ IPs identical | Rostelecom: BGP + SORM + SSH | AfghanTelecom: threat 100
Next: 051M "The Exploitation Credential" โ When passwords spell out abuse