At 19:00 UTC every night, something wakes up. Not one machine โ 292 of them, spread across 30 countries, moving in lockstep. They authenticate, verify credentials still work, and go silent again. They never execute a command. Never download a file. They just check the locks.
Three nodes sit at the center: one in Sweden, one in Poland, one in Switzerland. Between them, they hold 388 temporal synchronization links. They are the watches that keep the swarm on time.
I. The Temporal Map
A temporal correlation is not a guess. It is a mathematical assertion: two IPs from different autonomous systems, different countries, different subnets โ attacking the same honeypot within a 10-minute window at a frequency that exceeds random probability. When this happens once, it is coincidence. When it happens 1,616 times across 344 source IPs, it is coordination.
The entity_links database records these correlations as forensic relationships. They cannot be forged. They cannot be denied. They are the timestamps left behind by an operation that forgot โ or didn't care โ that clocks don't lie.
II. The Three Hubs
๐ธ๐ช 185.246.128.133 โ The Primary Clock
Five thousand six hundred eighteen authentication attempts. Five thousand three hundred seventy-seven successes. Zero commands executed. Zero files downloaded. This is not an attacker โ it is a validation service. It confirms that credentials still work, then moves on. Its HASSH fingerprint: 57e4cc8ee36c3d78 โ paramiko_script. A Python script running on schedule, touching every node in the network.
w1n Ltd registered the ASN in 2017 via RIPE NCC. PeeringDB confirms it as a legitimate web hosting provider. But one IP on its network has synchronized its activity with 184 other malicious IPs. The hosting provider may be complicit, compromised, or simply never monitoring what happens at the edges of its allocation.
๐ต๐ฑ 87.251.64.176 โ The Fresh Build
ASN 200730 was allocated on February 20, 2026. Eight weeks later, it appeared in our honeypot data coordinating attacks. This is not infrastructure that was slowly compromised โ it was built for this purpose.
Registered to "ISAEV Igor" in Kazakhstan via VIA-REGISTRY-MNT, but hosting from Poland. The jurisdiction mismatch is deliberate: Kazakhstan's NIC won't respond to European abuse reports, and Poland's hosting providers process the actual packets. Three IPs on the /24 subnet (.176, .145, .144) generated 4,985 combined hits. The .176 address uses SSH-2.0-Go โ a Go-based scanner, different tooling from the primary hub's Python. Same operation, compartmented infrastructure.
๐จ๐ญ 179.43.139.58 โ The Bulletproof Node
Seven thousand nine hundred sixty-three sessions. Seven thousand nine hundred ten successes. A success rate of 99.3% โ meaning this node almost never fails an authentication. It knows the credentials before it arrives. It is validating, not guessing.
Private Layer INC is registered in Panama but operates from Swiss data centers. It is a known bulletproof hosting provider appearing in abuse reports for years. This node also carries 6 shared_malware_family relationships and 4 shared_passive_dns links โ it is connected to the malware distribution layer we documented in Series 052. The coordination hub is also a malware relay.
III. The Nocturnal Pattern
Hourly Activity Distribution (90 days, UTC)
19:00 UTC. That's 21:00 in Central Europe. 03:00 in Beijing. 15:00 in New York. The peak cannot serve all timezones equally โ it is optimized for one. Someone in the CET/EET timezone starts their evening shift, and 292 nodes wake up.
The business-hours ratio confirms it: weekday 08:00-17:00 UTC generates only 7,449 sessions. Off-hours generate 16,234 โ more than double. This is an operation that runs while the legitimate internet sleeps. Not because automation needs darkness, but because the operator works evenings.
| Day | Sessions | Pattern |
|---|---|---|
| Monday | 3,068 | Low โ recovery from weekend push? |
| Tuesday | 6,278 | High โ mid-week operational peak |
| Wednesday | 6,029 | High โ sustained |
| Thursday | 3,387 | Lowest weekday |
| Friday | 4,921 | Moderate โ pre-weekend ramp |
| Saturday | 4,033 | Active |
| Sunday | 6,713 | Highest overall โ the operator's main working day |
Sunday highest. Thursday lowest. This is not a business operation โ it's someone who works a day job during the week and runs their credential validation network on evenings and weekends. The anti-business pattern is a fingerprint as distinctive as any HASSH hash.
IV. The Geographic Handoff
The geo_shift data reveals what happens inside those 24 hours:
| Country | Earlier Period | Later Period | Shift | Interpretation |
|---|---|---|---|---|
| ๐ต๐ฑ Poland | 36.1% | 6.1% | โผ -30.0 | Morning operator, CET timezone |
| ๐ธ๐ช Sweden | 29.8% | 10.8% | โผ -19.0 | Same timezone cluster as Poland |
| ๐ณ๐ฑ Netherlands | 3.0% | 15.0% | โฒ +12.1 | Evening activation, same timezone |
| ๐จ๐ญ Switzerland | 17.0% | 24.3% | โฒ +7.3 | Private Layer node โ later shift |
| ๐บ๐ธ United States | 2.5% | 9.2% | โฒ +6.7 | Afternoon activation (UTC-5/-8) |
| ๐ฎ๐ฉ Indonesia | 0.5% | 2.7% | โฒ +2.2 | Night shift (UTC+7) |
| ๐ญ๐ฐ Hong Kong | 0.1% | 2.1% | โฒ +1.9 | Night shift (UTC+8) |
Poland and Sweden fire first โ the morning activation. As CET evening arrives, they fade and Netherlands/Switzerland take over from the same timezone but different infrastructure. Then the US afternoon activates. Finally, a small Asian contingent runs overnight UTC.
This is a relay pattern. Not follow-the-sun staffing (the volumes are wrong for multiple operators) โ but infrastructure rotation designed to distribute attack traffic across geographic nodes while one operator manages the schedule from CET.
V. The May 21 Burst
On May 21, 2026, the coordination network broke its own pattern. Activity surged to 7.3ร normal at 08:00 UTC โ a 14-hour continuous wave that generated 1,780 sessions across 15 hourly buckets (119 per hour vs. the 16.7 baseline).
This was not gradual escalation. It was activation. The libssh_0.11.x campaign cluster โ 1,313 IPs across 84 countries โ was formally detected at 13:55 UTC that same day. The burst preceded the detection. The swarm was already running when the sensors caught up.
What triggers a 7ร spike on a specific date? Either a new campaign launch (infrastructure going live simultaneously) or a coordination reset (all nodes re-validating credentials after a disruption). The zero-command pattern of the hubs suggests the latter: something invalidated the credential cache, and the entire network re-checked at once.
VI. Read Between the Lines
The Access Broker's Heartbeat
These three hubs don't attack. They validate. With success rates of 96-99.3% and zero post-authentication activity, they are maintaining a live inventory of working credentials. This is the heartbeat of an access brokering operation โ confirming to buyers that the product still works.
The European Evening Operator
The 19:00 UTC peak, the Sunday dominance, the CET geographic clustering โ all point to a single operator or small team in the UTC+1/+2 timezone (likely Poland/Germany/Netherlands) running operations as a side activity. The anti-business-week pattern suggests this is not their primary employment.
The OPSEC Failure
The CIA's Development Tradecraft document (WikiLeaks Vault 7) specifically warns operators to randomize timestamps. These operators didn't read it โ or didn't care. Their timezone is written in their activity pattern as clearly as if they'd left a location tag. The coordination is sophisticated. The temporal OPSEC is amateur.
VII. The Thread Forward
What the clock reveals next
The temporal correlation identifies when they coordinate. The geographic pattern suggests where from. But 4,531 shared_geo_pattern relationships and 21,960 same_prefix links remain unmapped.
In 054B โ "The Geography of Command", we follow the geographic patterns: not just which countries appear, but which countries appear together, at which times, and why the infrastructure rotates the way it does.
The clock has faces in every timezone. The next article maps which face looks where.
Continuity
โ TI-2026-051C "The Stuffing Machine" โ first identified the 99-105 IP temporal coordination pattern
โ TI-2026-056B "The Heartbeat Protocol" โ analyzed the timing layers in the communication protocol
โ TI-2026-043K "The Signal" โ the Five-Layer Protocol with Layer 4: Coordination (synchronized timing)
โ TI-2026-054B "The Geography of Command" โ geographic pattern analysis