The Chain

Five articles. Five layers. Now the synthesis:

The Developer

The developer compiles once. One binary — a8460f44 — serves 81 nodes across 28 countries for 71 days without modification. This isn't software engineering. This is industrial manufacturing: design it once, stamp it out infinitely.

Compare with legitimate software: even the simplest daemon receives patches within 71 days. The Outlaw developer either can't or won't update. The evidence suggests won't — the binary works, detection doesn't affect the target demographic, and each recompilation risks introducing bugs. In the criminal economy, if it generates revenue, don't touch it.

The polymorphic counterpart (24 unique sshd binaries) reveals a second developer with a different threat model. This developer must recompile per target. Their toolchain includes build-time randomization — different enough for unique hashes, functionally identical. This is a more sophisticated developer serving a different market segment.

The Distributor

Distribution infrastructure documented in TI-2026-052B reveals three parallel channels:

The dominant Outlaw distributor uses the compromised SSH session itself as the delivery channel — no external infrastructure needed. The cost is zero. The reliability is terrible (40% failure during peak load). But at zero cost, a 40% failure rate simply means trying twice. The economics work because failed downloads cost nothing.

The GCP and GitHub channels serve different actors with different risk profiles: they pay for reliability with forensic exposure. A registered GCP account leaves billing records. A GitHub repository leaves commit history. The Outlaw method leaves nothing but a failed TCP connection.

The Operator

82 IPs in 28 countries. The operator doesn't own these machines — they own access to them. Each IP is a compromised system repurposed as both scanner and miner. The operational protocol (052C):

1. Kill competing processes (rm -rf /tmp/secure.sh; kill -9 auth.sh)
2. Verify elimination (ps -ef | grep '[Mm]iner')
3. Fingerprint host (uname -s -v -n -r -m)
4. Deploy payload (SFTP transfer of binary named "sshd")
5. Begin mining + continue scanning for new targets

The operator is the middle manager of cybercrime. They don't write malware. They don't run mining pools. They run access: maintaining a fleet of compromised machines, deploying payloads from upstream, feeding hashrate to downstream. Their value is scale — 82 machines mining simultaneously generate revenue that one machine never could.

The May 11-18 spike (39 new infections in two weeks) suggests the operator received either fresh credential lists or fresh scanning infrastructure. The subsequent crash suggests the campaign achieved saturation in accessible target space — or the operator hit a law enforcement tripwire.

The Resource Manager

The family partitioning system revealed in TI-2026-052A is supply chain management at its core:

Zero IP overlap between families. Unified cleanup protocol. This is resource allocation: capable hardware gets RedTail (optimized for hash rate), commodity hardware gets XMRig (generic), IoT devices get Mirai (different monetization entirely). One operator, multiple revenue streams, infrastructure allocated by capability.

The Customer

The customer is invisible in network telemetry. They never touch the compromised machines. They receive value through the blockchain:

As documented in TI-2026-025N:

• XMRig configured with HashVault mining pool credentials
• Monero rewards flow to privacy-preserving wallets
• Zero-cost base makes any revenue pure profit
• Victim costs (electricity, hardware degradation) externalized entirely

The supply chain terminus is mathematically untraceable. Monero's ring signatures prevent blockchain analysis. The mining pool aggregates hashrate from thousands of sources, making individual attribution impossible. The customer — whether it's the same entity as the operator or a purchasing party — exists only as a wallet address that cannot be linked to an identity.

The Economics

A supply chain with zero marginal cost is structurally indestructible through economic pressure. You cannot bankrupt an operation that spends nothing. You cannot outbid an operator whose infrastructure is free. You cannot price them out of a market where electricity theft IS the product.

The only disruption vector is access disruption: credential rotation on victim machines, SSH key hardening, network segmentation. But 82 machines across 28 countries in residential ISPs, university networks, and small businesses — the coordination required to simultaneously patch all victims exceeds the coordination available to any single defender.

The Parallel Economy

Map this against the legitimate semiconductor supply chain:

The criminal supply chain has one structural advantage: no inventory. TSMC must forecast demand, build fabs, manage wafer starts. The malware developer compiles a binary that costs nothing to copy infinitely. The distributor stores nothing — the binary lives on compromised hosts. The operator maintains nothing — the fleet is self-sustaining as long as SSH credentials exist.

Zero inventory means zero supply chain disruption risk. No chip shortage. No shipping delays. No tariffs. The only bottleneck is the credential supply — and the scanning fleet generates its own.