On May 21, 2026, at approximately 00:00 UTC, a wave began. For the next 62 hours, 86% of all time slots exceeded normal thresholds. Then silence โ five weeks of maintenance-level activity. Then on June 30, at 19:00 UTC, another wave. The operation breathes. It expands and contracts. It launches and rests. It rotates and renews.
The daily clock shows a person. The weekly clock shows a habit. The monthly clock shows a business.
I. The Three Phases
Every operation has a lifecycle. The coordination network's lifecycle is now visible across 90 days of observation:
| Phase | Dates | Duration | Peak Rate | Character |
|---|---|---|---|---|
| Launch | May 21-23 | 3 days | 322/hour | Campaign activation โ sudden, intense, manual |
| Steady State | May 24 - Jun 28 | 35 days | 12-43/day | Automated maintenance โ low, consistent, cron-driven |
| Rotation | Jun 29 - Jul 1 | 3 days | 780/hour | New infrastructure โ burst activation, old retires |
II. The Launch: May 21-23
Anomalous Hours by Day
3,220 sessions in a single 10-hour wave on May 23 โ an average of 322 per hour, sustained. This is the libssh_0.11.x campaign going live: 1,313 IPs across 84 countries activating in sequence. The campaign cluster was formally detected at 13:55 UTC on May 21, but the activity preceded detection by hours.
A campaign launch of this scale requires pre-positioning. The 1,313 IPs didn't appear from nowhere on May 21. They were provisioned over the preceding weeks (ISAEV Igor's ASN was allocated February 20 โ three months of lead time). The launch is the moment the switch is flipped, not the moment the infrastructure is built.
III. The Steady State: 35 Days of Patience
| Week | Daily Attempts | Unique IPs/Day | Success Rate | Character |
|---|---|---|---|---|
| Jun 1-7 | 14-34 | 7-16 | ~0% | Slow scan, testing defenses |
| Jun 8-14 | 12-43 | 6-22 | ~0% | Variable cadence, peak Jun 14 |
| Jun 15-21 | 16-32 | 8-16 | ~0% | Consistent maintenance |
| Jun 22-28 | Minimal | Low | N/A | Wind-down before rotation |
After the launch burst, the campaign settles into a pattern that would be invisible without the preceding context. Twelve to forty-three attempts per day. Six to twenty-two unique IPs. Zero successful authentications against this specific honeypot (the credentials have rotated, or this endpoint isn't in their inventory).
This is not failure โ it's reconnaissance maintenance. The campaign is cataloguing what's still accessible across thousands of targets. Our honeypot is one of many. The steady state is optimized for breadth, not depth.
IV. The Rotation: Jun 29 - Jul 1
The TechTies Burst
At 19:05 UTC on June 30 โ within the identified human operator's evening window โ a TechTies IP that had never appeared before executed 762 authentication attempts in 45 minutes. Twenty succeeded. This is not scanning โ this is a new node joining the coordination network and validating its credential inventory against live targets.
The Follow-Up
The next day, a second TechTies IP activated. Same prefix (91.92.40.0/24 โ the weaponized block from 054C). 143 sessions in half an hour. The rotation is staged: not all new infrastructure activates simultaneously. It comes online in sequence, node by node.
Simultaneously, ISAEV Igor's infrastructure (87.251.64.176) stopped appearing after June 21. The old guard retires. The new guard activates. The hand-off is deliberate: old infrastructure accumulates abuse reports over 30-40 days until blocking becomes widespread, then new infrastructure โ freshly provisioned, not yet on any blocklist โ takes over.
V. The Procurement Timeline
| Event | Date | Lead Time |
|---|---|---|
| ASN 200730 allocated (ISAEV) | Feb 20 | T-90 days before launch |
| First ISAEV activity observed | Apr 21 | T-30 days before launch |
| Campaign launch burst | May 21 | T=0 (activation day) |
| ISAEV last seen | Jun 21 | T+31 days (retirement) |
| TechTies activation | Jun 30 | T+40 days (rotation) |
The timeline reveals a 90-day planning horizon. Infrastructure is acquired months before use. It's tested for weeks before campaign launch. It's operated for ~30 days before rotation. And new infrastructure is ready to take over seamlessly.
This is not reactive. This is not ad-hoc. This is operations planning at a level that implies either experience (the operator has done this before) or guidance (someone taught them the rotation doctrine).
VI. Read Between the Lines
The 30-Day Abuse Window
Why 30-40 days per rotation? Because that's approximately how long it takes for abuse reports to propagate through blocklists, reputation databases, and automated defenses. The operator knows the response timeline of the defensive ecosystem and operates just inside it.
Launches Are Decisions
Both observed launches happened at 19:00 UTC โ the human's evening. This means launches are manual decisions, not scheduled automation. Something triggers the decision to activate: perhaps a new batch of stolen credentials to validate, a market demand signal, or the completion of infrastructure provisioning. The operator decides when to press the button.
The Defense Implication
If infrastructure rotates every 30-40 days, IP-based blocklists older than one month contain only historical data. Detection must be behavioral: HASSH fingerprints survive rotation (same tools, different IPs). Credential patterns survive (same passwords, different sources). Timing patterns survive (same schedule, different infrastructure). The IOC is dead. Long live the TTP.
VII. The Thread Forward
Next: The Conductor
We've mapped the clock from hours (054A) through days (054D) to weeks (054E). The final article synthesizes everything: what does temporal analysis tell us about the person behind the operation?
In 054F โ "The Conductor", we assemble the complete temporal profile. The timezone. The schedule. The habits. The planning horizon. The infrastructure doctrine. From 1,616 correlations and 90 days of observation: the portrait of an operator who thinks they're invisible because they change IPs โ but forgot that they cannot change their clock.
Continuity
โ TI-2026-054D "The Working Day" โ the daily circadian pattern driving these waves
โ TI-2026-049F "The Hive Mind" โ the swarm structure whose lifecycle we've mapped
โ TI-2026-054F "The Conductor" โ the complete temporal profile synthesis