Twenty-three sessions. Twenty-three successes. Zero failures. This actor never guesses. It already knows. When it connects, it's not testing credentials โ it's evaluating assets. Container or bare metal? How many cores? What filesystems are mounted? Each answer determines what a compromised server is worth on the market.
The scanner maps. The exploiter plants the key. This one decides what it's all worth.
I. Perfect Accuracy
In the entire honeypot dataset โ 9,928 IPs, tens of thousands of sessions โ no other campaign achieves 100% authentication success across all attempts. The scanner fleet (055A) succeeds 0%. The exploitation fleet (055B) succeeds 2.1%. This one succeeds every time.
This is not brute force. This is verification. The credentials are already known before the connection is made. The session's purpose is not authentication โ it's evaluation.
II. The Evaluation Protocol
๐ The Command Sequence
Five commands. Each answers a specific question:
| Command | Question Answered | Monetization Impact |
|---|---|---|
bash --help | Is bash available? Which version? | Determines payload compatibility |
ls /proc/1/ | Container or bare metal? | Containers = ephemeral, bare metal = persistent access |
cat /proc/1/mounts | What filesystems? Overlayfs? NFS? | Storage access, lateral movement potential |
cat /proc/cpuinfo | How many cores? What architecture? | Cryptomining value, compute rental price |
echo __TIMESTAMP | Session tracking marker | Correlates results to scan job |
The answers create a value profile: A 64-core bare-metal server with NFS mounts is worth vastly more than a 1-vCPU container with ephemeral storage. The validator sorts compromised assets into tiers.
III. The Nanosecond Clock
Timestamp Markers Decoded
The echo markers are not random strings. They are Unix nanosecond timestamps:
__1777998079878558612โ May 5, 2026 16:21:19 UTC (18:21 CET)__1778088221198072728โ May 6, 2026 17:23:41 UTC (19:23 CET)__1778496376103600599โ May 11, 2026 10:46:16 UTC (12:46 CET)
Nanosecond precision. Not second, not millisecond โ nanosecond. This level of precision comes from time.Now().UnixNano() (Go), System.nanoTime() (Java), or clock_gettime(CLOCK_REALTIME) (C). The orchestration system is not a shell script โ it's a compiled application with nanosecond-resolution job scheduling.
The timestamps align with CET afternoon/evening hours (12:46, 18:21, 19:23 CET). The same operator profile identified in 054F: evening CET worker. The validator operates in the same timezone window as the broader coordination network.
IV. The Geography of Discretion
| Property | Scanner Fleet | Exploitation Fleet | European Cell |
|---|---|---|---|
| IPs | 628 | 1,313 | 16 |
| Countries | 48 | 84 | 2 (NL, FR) |
| ASN concentration | Distributed (300+ ASNs) | Asian (UCloud, AS4811) | 94% single ASN (215125) |
| Success rate | 0% | 2.1% | 100% |
| Tool | libssh2 library | libssh library | OpenSSH client |
| Behavior | Probe all targets | Exploit valid targets | Evaluate owned targets |
| Sessions/day | ~924 | ~24.5 | ~0.28 |
The progression is clear: as you move up the supply chain, operations become smaller, more focused, more geographically concentrated, and harder to detect. The scanner generates noise. The exploiter generates some signals. The validator is nearly invisible โ 0.28 sessions per day, using a legitimate SSH client, from a small EU hosting provider.
Sixteen IPs on a single Dutch ASN (AS215125). One IP on a French ASN (AS213873). This is a single hosting account with perhaps a failover in another jurisdiction. The operator chose small European providers specifically: (1) GDPR complicates abuse investigations, (2) EU-to-EU traffic avoids intelligence sharing triggers, (3) low latency to EU targets suggests the primary victim pool is European.
V. The Three-Stage Pipeline
Supply Chain Architecture โ Confirmed
| Stage | Role | Actor | Product |
|---|---|---|---|
| 1. Map | Scanner | 055A (628 IPs, 0% success) | List of servers accepting root:'' |
| 2. Compromise | Exploiter | 055B (1,313 IPs, 2.1% success) | SSH key implanted on 41+ servers |
| 3. Evaluate | Validator | 055C (16 IPs, 100% success) | Asset profile: CPU, storage, container status |
| 4. Monetize | Customer | Unknown | Cryptomining, DDoS, proxy, storage |
Each stage has different infrastructure requirements. The scanner needs many IPs (to avoid IP-based blocking). The exploiter needs moderate IPs with diverse geography (to reach targets globally). The validator needs few IPs with high reliability (to maintain long-term access without abuse reports). The customer โ whoever finally uses the compromised servers โ needs none of this infrastructure at all. They simply SSH in with the planted key.
VI. Read Between the Lines
The 19.9-Second Session
The average session duration of 19.9 seconds is telling. The exploitation fleet averages 4.15 seconds (plant key, disconnect). The validator spends 5ร longer because it waits for command output. It reads the results. The CPU info, the mount list, the /proc/1 contents โ these take time to return and parse. This is someone (or something) that processes the output, not just fires and forgets.
Why So Few Sessions?
23 sessions in 81 days. Less than one every three days. Either: (1) the validator only evaluates high-value targets (most compromised servers aren't worth validating), or (2) the honeypot only caught a fraction of the validator's activity (it targets real servers, not traps), or (3) validation is slow and methodical by design โ rushing creates noise. All three are probably true simultaneously.
VII. The Thread Forward
Next: The Persistent Watcher
Actor-e00eca62479f: 12 IPs, still active as of June 29, 2026 โ the only actor active THIS WEEK. While we analyze historical data, this one is still working. What does an active, ongoing operation look like from the inside?
Continuity
โ TI-2026-055B "The Sixty-Nine" โ the exploitation fleet feeding this validator
โ TI-2026-054F "The Conductor" โ the CET evening operator profile this actor confirms
โ TI-2026-055D "The Persistent Watcher" โ the actor still active today