I. The Largest Operation

Of the 14 actor clusters in our honeypot dataset, actor-0d9fdff8bb3d is the largest by an order of magnitude. 269 IPs sharing a single SSH key, expanding to 628 IPs in the broader libssh2_1.11.0 campaign. Forty-eight countries. One hundred seventy-three autonomous systems. One job: find every SSH server on the internet that accepts an empty root password.

This is not credential stuffing (one credential, not a list). Not brute-forcing (no password variations attempted). Not exploitation (zero post-auth activity). It is cartography. The operation maps the topology of misconfigured SSH infrastructure. The map has value. To whom?

II. The Single Key

A shared SSH key is the strongest possible attribution signal. It means every one of these 269 machines was provisioned from the same deployment pipeline — the same Ansible playbook, the same Docker image, the same Terraform template. One person (or one team with shared credentials) set up all 269 instances with the same key pair.

This eliminates the possibility that these are independent actors coincidentally using the same tool. Independent operators would generate unique keys. A shared key is a signature of ownership. These 269 machines belong to one entity.

III. The Hosting Landscape

The hosting selection reveals the procurement strategy: maximize geographic diversity while minimizing cost. No single provider hosts more than 7% of the fleet. This distribution means no single abuse report can take down more than a fraction of the operation. It also means the operator has accounts (and payment methods) at 20+ different hosting providers.

The cost: $3,000-6,000 per month for a 26-day scan. This is not a hobby. Someone is funding a multi-thousand-dollar monthly infrastructure bill to generate a list of SSH servers with empty root passwords. The list must be worth more than the cost to produce it.

IV. The Credential: root:''

This specificity is itself intelligence. The operation isn't looking for weak passwords (password123, admin, etc.). It's looking for a very specific misconfiguration: SSH servers where root login is enabled and the root account has no password. This is more common than it should be — in Docker containers exposed to the internet, in hastily deployed IoT devices, in development environments accidentally made public.

The empty-password root server is the perfect target: full control immediately, no brute-force detection to evade, no credential replay risk. One connection. One authentication. Root access. The list of such servers is a premium product in the access brokering market.

V. The Timeline

Twenty-six days. Then nothing. This matches the 30-day rotation cycle from 054E precisely. The scanner fleet was part of the broader coordination network — launching on the same May 21 activation day that we observed across all campaigns. It retired slightly early (day 26 rather than 30-35), possibly because abuse reports accumulated faster for a fleet this large.

VI. The Business Model

This is the first layer of the attack supply chain documented in 052E "The Invisible Supply Chain". The scanner doesn't exploit. The exploiter doesn't scan. Specialization creates deniability: the scanner can claim "we never accessed any system." The exploiter can claim "we didn't scan — we just happened to try this IP." Together, they accomplish what neither admits to individually.

VII. Read Between the Lines

VIII. The Thread Forward

Continuity

← TI-2026-052E "The Invisible Supply Chain" — the economic model this operation feeds

← TI-2026-054E "Waves and Tides" — the 30-day rotation cycle this operation follows

← TI-2026-054B "Geography of Command" — the Tier 2 operational layer this fleet represents