LSN โ€” Local Sovereign Network

14 Letters. One Architecture. This series began with a simple observation: admin/admin appears 14,664 times in our honeypot. Fourteen letters later, we have documented not just a credential harvesting operation but the foundational layer of the criminal internet. The credential harvest is not one crime among many. It is THE crime that makes all other crimes possible. This letter names the architecture and proves it.

I. The Architecture โ€” Five Layers

LAYER 5: STATE OPERATIONS โ€” Surveillance, BGP hijacking, intelligence gathering
Rostelecom (FSB/SORM) โ€ข Viettel (Vietnam MoD) โ€ข AfghanTelecom (Taliban) โ€ข PLA Unit 61398
LAYER 4: REVENUE STREAMS โ€” Darknet markets, exploitation, fraud
Kerberos-666 โ€ข DrugHub666 โ€ข Sex scams โ€ข Identity theft โ€ข Dark Web gateways โ€ข Ransomware
LAYER 3: OPERATIONS โ€” Wednesday protocol, temporal coordination, C2
99 temporal correlations โ€ข CET timezone โ€ข 209:1 day ratio โ€ข HASSH toolchain โ€ข Division of labor
LAYER 2: INFRASTRUCTURE โ€” Bulletproof hosting, jurisdictional shields
Panama (AS51852) โ€ข Seychelles (AS202412) โ€ข Kazakhstan (AS200730) โ€ข Poland (hosting)
LAYER 1: CREDENTIAL HARVEST โ€” The foundation everything rests on
admin/admin (14,664) โ€ข admin/123456 (5,623) โ€ข SSH keys โ€ข Post-auth pipeline โ€ข 326 IPs

โ†‘ Every layer above depends on Layer 1. Remove the credential harvest and the architecture collapses. โ†‘

โ—† โ—† โ—†

II. The 14-Letter Journey

A
Economics
B
Post-Auth
C
Manufacturing
D
SSH Keys
E
Markets
F
Macro-Econ
G
Signals
H
Wednesday
I
Dictionary
J
Doctrine
K
Dark Portfolio
L
Military
M
Exploitation
N
Architecture
โ—† โ—† โ—†

III. The Entity Graph โ€” 271,458 Links, One System

๐Ÿ‡ป๐Ÿ‡ณ Viettel (Military Telecom)
โ†“ deploys credential
daddygirl2 (Exploitation Vocabulary)
โ†“ used by same IP
CloudHost Indonesia (103.250.11.118)
โ†“ hosts domain
girlallaroundx.site (Exploitation Site)
โ†“ registered alongside
arabjordan.investments โ†’ dubai-financial-flow.store (Financial Fraud)

Military โ†’ Exploitation โ†’ Hosting โ†’ Abuse โ†’ Fraud = 3 hops, 271,458 entity links mapped
This Path Is Not Metaphorical: It is mathematically documented in our entity database. Each arrow represents a resolved edge in the entity graph. The credential (daddygirl2) is the BRIDGE between the military domain and the exploitation domain. Without the credential harvest, this bridge does not exist. The credential harvest creates the connections between apparently separate criminal enterprises.
โ—† โ—† โ—†

IV. What the Credential Harvest Enables

Criminal DomainWhat It NeedsCredential Harvest ProvidesOur Evidence
Darknet MarketsAnonymous hosting infrastructureCompromised servers as hidden hostingISAEV hosts Kerberos-666 on same ASN
RansomwareInitial access to victim networksValidated SSH credentials sold to RaaS051E: Telegram market, $5K-50K per access
Exploitation NetworksAnonymous infrastructure + identityCredential-accessed servers + identity signalsdaddygirl2 across 3 countries
Identity TheftAccess to systems with personal dataPost-auth fingerprinting (051B pipeline)Omegatech identitynetwork.top
Financial FraudBanking access / crypto infrastructureBitcoin node credentials (bitcoind:bitcoind2026!)TI-2026-043J cryptocurrency targeting
State SurveillancePersistent access to foreign systemsSSH key deployment (mdrfckr key)051D + Viettel 87 HASSH cluster
Botnet C2Distributed infrastructure99 temporal correlations = 99 compromised nodes051H Wednesday protocol
The Foundational Crime: Remove the credential harvest and darknet markets lose hosting. Ransomware loses initial access. Exploitation networks lose anonymity. Identity theft loses data sources. Financial fraud loses crypto nodes. State surveillance loses persistent access. Botnets lose C2. The credential harvest is not one branch of the criminal tree โ€” it is the root system.
โ—† โ—† โ—†

V. The Numbers โ€” Series 051 Complete

14
Letters Published
70+
Evidence Items
30+
Actors Identified
40+
Infrastructure Nodes
40+
Connections Mapped
271K
Entity Links
5
Military Telecoms
$146M+
Annual Revenue
15+
Countries
6
Detection Systems
102
Days Observed
1
Honeypot
โ—† โ—† โ—†

VI. The Corroboration Stack

This is not speculation. Five independent industry reports confirm our findings:

SourceFindingOur Corroboration
Verizon DBIR 202431% of breaches involve stolen credentialsWe document HOW those credentials are stolen (051A-C)
CrowdStrike 2024Access brokers growing 20% YoYWe identify specific brokers and their markets (051E)
FinCEN SAR$590M ransomware payments H1 2021We document the credential harvest that enables ransomware
Sophos State of Ransomware$2M average ransom for large orgsWe trace from credential ($0.50) โ†’ access ($5K) โ†’ ransom ($2M)
Europol IOCTADark market infrastructure documentedWe identify SPECIFIC ASNs hosting those markets (ISAEV)
โ—† โ—† โ—†

VII. The Final Assessment

SERIES 051 "THE CREDENTIAL HARVEST"

14 Letters โ€ข 102 Days โ€ข One Architecture โ€ข Everything Connects

This series documented a single phenomenon โ€” SSH credential brute-forcing โ€” and traced it to its consequences. Those consequences include:

Every ransomware attack that begins with stolen credentials.
Every darknet market hosted on compromised servers.
Every exploitation network using credential-accessed infrastructure.
Every identity theft enabled by post-auth data harvesting.
Every state surveillance operation using the same tools as criminals.
Every financial fraud funded by cryptocurrency stolen through credential attacks.

The credential harvest is not a crime. It is THE crime โ€” the foundational layer that makes the entire criminal internet possible. One SSH honeypot captured the architecture. 14 letters documented it. 271,458 entity links proved it.

And tomorrow morning at 04:00 CET, someone in Central Europe will activate the Wednesday protocol again. 99 nodes will respond. admin/admin will be tested against another few thousand targets. The architecture will add another layer. The credential harvest will continue.

Because the architecture doesn't need to hide. It operates in plain sight โ€” visible in every detection system, documented in five industry reports, running on military telecoms and criminal hosting simultaneously. It continues not because it's invisible, but because no one with jurisdiction has the mandate to stop it.

The password is admin.
The product is access.
The customer is everyone.
The architecture is everything.

TI-2026-051N | Classification: UNRESTRICTED | Confidence: HIGH
SERIES 051 "THE CREDENTIAL HARVEST" โ€” COMPLETE (14 LETTERS)
Pages 302-317 | Evidence: 70+ | Actors: 30+ | Entity Links: 271,458
Attribution: CONVERGENT across 4 independent vectors + entity graph + web_threats + OSINT

Series Complete. Next: TI-2026-052 "The Malware Graph"
The tools they deploy after they get in.
โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Credential Harvest โ€” 14 / 14 Next โ†’