The scanner fleet knocks. This one walks in. Forty-one times across 1,963 attempts, it succeeded. And in those 4.15-second sessions, it did one thing: delete the existing SSH keys, create a fresh .ssh directory, and plant its own public key. A permanent backdoor. A skeleton key that survives password changes, system updates, and security audits that don't check authorized_keys.
The scanner makes the map. This one uses it.
I. The Second-Largest Operation
If actor-0d9fdff8bb3d (055A) is the cartographer, actor-6285990cc704 is the colonizer. Same ecosystem. Different role. Where the scanner fleet found 628 IPs to map targets with zero exploitation, this fleet uses 1,313 IPs to exploit those targets โ and succeeds 41 times.
II. The Key Injection
๐ The Payload
Three commands. Four seconds. Permanent access.
cd ~โ navigate to the user's home directoryrm -rf .ssh && mkdir .sshโ destroy existing SSH configuration (including any legitimate keys)echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr..."โ inject the attacker's public key
After this, the attacker can log in with their private key at any time. No password needed. No password change will lock them out. The only remediation is to manually inspect ~/.ssh/authorized_keys โ something most administrators never do after initial setup.
This is the most efficient persistence technique in SSH: one command, permanent access, survives credential rotation. The 41 successful injections represent 41 servers where this key now grants root access to anyone holding the corresponding private key.
III. A Different Geography
| Metric | Scanner Fleet (055A) | Exploitation Fleet (055B) |
|---|---|---|
| Total IPs | 628 | 1,313 |
| Countries | 48 | 84 |
| Top hosting region | US (43%) | China/HK (26%) |
| Tool | libssh2_1.11.0 | libssh_0.11.x |
| Credential | root:'' (empty) | 345gs5662d34:345gs5662d34 |
| Success rate | 0% | 2.1% |
| Commands | 0 | 774 |
| Downloads | 0 | 72 |
| Active window | 26 days | 80 days |
| Shared signal | SSH key (same key) | SSH key (same key) |
Every metric differs. Different tools. Different credentials. Different hosting. Different active windows. Different success rates. These are not the same operation โ they are different roles in the same ecosystem.
The geographic shift is particularly telling: the scanner fleet uses US/EU commodity hosting (fast provisioning, disposable). The exploitation fleet uses Chinese/HK cloud (UCloud 73 IPs, AS4811 64 IPs). Different procurement networks. Different payment methods. Different operator geographies.
IV. The Specialized Credential
345gs5662d34:345gs5662d34
This is not a default credential. It's not in any public password list. It appears on 44 of the 69 tight-cluster IPs โ meaning it's operationally shared within the cluster but not publicly known. Two possibilities: (1) it's a credential harvested from a specific target and reused across the operation, or (2) it's an internally-generated access token used as a marker/signal within the exploitation infrastructure.
The credential's structure (alphanumeric, 12 characters, same for username and password) suggests machine generation rather than human choice. If it was harvested from a compromised system, every server using this credential was compromised from the same original source. If it's an internal token, it functions as an authentication signal between nodes in the exploitation network โ a way for one node to verify another belongs to the same operation.
V. The Supply Chain Confirmed
| Role | Actor | Tool | Action | Product |
|---|---|---|---|---|
| Scanner | 055A (269-628 IPs) | libssh2_1.11.0 | Test root:'' everywhere | List of vulnerable servers |
| Exploiter | 055B (69-1,313 IPs) | libssh_0.11.x | Log in, inject SSH key | Persistent backdoor access |
| Customer | Unknown | Any SSH client | Use injected key to access | Full server control |
The two-stage supply chain theorized in 052E is now confirmed with concrete evidence. The scanner runs first (narrow window, high volume, zero exploitation). The exploiter runs second (long window, selective targeting, active exploitation). The customer โ whoever holds the private key matching the injected public key โ can access the 41 compromised servers at any time.
The exploiter started EARLIER than the scanner (March 28 vs May 21) and ran LONGER (80 days vs 26). This means the exploiter receives target lists from multiple scanner generations โ not just the one we observed. The scanner fleet we documented in 055A was one of perhaps many feeding this exploitation pipeline.
VI. Read Between the Lines
The 80-Day Patience
Why does the exploiter run 3ร longer than the scanner? Because exploitation generates less noise. One successful login every 48 sessions (2.1% rate) is far less conspicuous than 24,054 failed attempts. The exploiter can afford to persist because each IP does so little individually.
Who Holds the Private Key?
The injected public key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr...) corresponds to a private key held by... someone. Not necessarily the exploitation fleet operator. The key could have been provided BY the customer to the exploitation operator: "inject THIS key into every server you compromise." The private key holder is the final beneficiary. They may never have touched the honeypot directly.
VII. The Thread Forward
Next: The European Cell
Actor cluster actor-635f93aca759: 17 IPs, exclusively Germany/France/Netherlands. Small, focused, Western European. Unlike the globally distributed scanner and exploitation fleets, this cluster operates entirely within EU jurisdictions. Different scale. Different geography. Different intent?
Continuity
โ TI-2026-055A "Two Hundred Sixty-Nine" โ the scanner fleet feeding this exploitation pipeline
โ TI-2026-052E "The Invisible Supply Chain" โ the economic model now confirmed
โ TI-2026-055C "The European Cell" โ the focused EU operation