Beyond the industrial operations โ the 628-IP scanners, the 1,313-IP exploiters โ lies a different world. Twenty micro-campaigns. Three to six IPs each. Written in .NET, Rust, Java, Go, Python, and languages that have no name. Each one a different person with a different keyboard, a different idea about how to break things. The long tail. Where the real diversity lives.
The ecosystem is not a factory. It's a bazaar.
I. The Population
The large operations documented in 055A through 055D use C libraries. They are compiled, optimized, industrial. The small cells are something else entirely. They are written by people who code in whatever language they know best. A .NET developer uses Renci.SshNet. A Rust programmer uses russh. A Java developer reaches for Ganymed. Each tool choice is a signature โ not of sophistication, but of origin.
II. Five Archetypes
๐ฅ๏ธ The .NET Developer
Uses ? and ls โ exploratory, interactive. Average session 23.8 seconds (the longest active session among small cells). This person is looking around. Not running scripts. Not deploying payloads. Just browsing, like someone who wandered into a building and is checking the rooms. The .NET library implies a Windows desktop environment โ a developer repurposing enterprise tools for something they probably shouldn't be doing.
๐ฆ The Rust Engineer
Command: echo 1 > /dev/null && cat /bin/echo. This reads the actual binary content of /bin/echo. Why? To detect honeypots. A real Linux system has a real ELF binary at /bin/echo. A honeypot might return simulated output. By reading the raw binary, the operator verifies they're on a real system before proceeding. Rust + binary analysis = systems programmer. Someone who understands what's real at the byte level.
๐ต๐ฑ The Polish Aggressor
Four IPs, all Polish. Average threat score 87.5 โ the highest of any small cell. 721 hits across 126 sessions in 84 days. Wrote their own SSH client from scratch (sshcustom_0.1). Targets "support" accounts. This is not a hobbyist โ this is someone with the skill to implement the SSH protocol and the audacity to operate entirely from their home country. No proxies. No geographic distribution. Pure aggression.
๐ The IoT Hunter
Credential: pi:raspberry. The default password on every Raspberry Pi ever shipped. After login: cd /tmp && chmod +x ZUeBIApv && bash -c ./ZUeBIApv. Download malware, make executable, run. The 92% success rate means most Pis with SSH exposed still use default credentials. And the tool runs FROM a Raspbian system โ this is a worm. Each compromised Pi becomes a scanner for more Pis. Self-propagating.
๐ป The Java Ghost
Zero successes. But 120-second average session duration โ ten times longer than any other small cell. The tool connects, attempts "root:Google1986." (with the period), and then... waits. For two full minutes. Either it's performing a timing-based side-channel attack (measuring authentication response delays), or it's waiting for a specific response pattern that the honeypot doesn't provide. The "Google1986." credential is not random โ it's targeted at a specific system type. The Java library suggests an Android or enterprise Java environment.
III. The Language Map
| Language | Tool | Campaigns | IPs | Implied Operator |
|---|---|---|---|---|
| Go | Various go_scanner | 6 | ~29 | Cloud/DevOps engineer |
| Python | Paramiko | 4 | ~15 | Script writer / pentester |
| C#/.NET | Renci.SshNet | 1 | 6 | Windows developer |
| Rust | russh | 1 | 5 | Systems programmer |
| Java | Ganymed | 1 | 6 | Enterprise/Android dev |
| Custom/C | sshcustom, OpenSSH | 5 | ~20 | Protocol-level expertise |
| C (IoT) | Raspbian OpenSSH | 2 | ~8 | IoT botnet operator |
Go dominates the small cells just as it dominates modern cloud tooling. Python (Paramiko) is the script kiddie's choice โ easy to write, easy to modify. But the outliers are the interesting ones: a .NET developer, a Rust systems programmer, a Java ghost. Each one chose SSH attack tooling in their native language because the barrier to entry is that low. If you can program, you can write a scanner.
IV. The Anti-Detection Arms Race
Independent Evolution
Three different small cells, three different anti-honeypot techniques, developed independently:
- Rust operator: Reads /bin/echo binary โ checks if binaries are real ELF files
- Custom operator: Logs in but runs zero commands โ avoids behavior-based logging
- Java operator: 120s timeout โ measures authentication timing characteristics
Same evolutionary pressure (honeypot detection), different solutions. This is convergent evolution โ like how dolphins and sharks independently developed the same body shape for different reasons.
V. Read Between the Lines
The Raspberry Pi Problem
A self-propagating worm targeting pi:raspberry has a 92% success rate. That means 92% of Raspberry Pis with SSH exposed to the internet still use the default password. Millions of devices. Each one is a recruitment target for botnets, cryptominers, and proxy networks. The Pi was designed to teach programming. It's teaching something, but not what was intended.
Custom Tools as Attribution Signal
The Polish operator wrote sshcustom_0.1 and operates exclusively from Poland. The Rust operator built their own binary checker. Custom tools are harder to attribute (no known signatures) but easier to fingerprint (unique HASSH values). The paradox: writing your own tool makes you invisible to signature-based detection but creates a unique behavioral fingerprint that identifies you across sessions.
VI. The Thread Forward
Next: The High-Threat Triad
Three actor clusters with average threat scores above 74: the most dangerous actors in the dataset. Not the largest. Not the most persistent. The most threatening. What makes an actor dangerous isn't size โ it's what they do with what they have.
Continuity
โ TI-2026-055D "The Persistent Watcher" โ the monitoring layer above these cells
โ TI-2026-050A "Written in Go" โ the Go scanner ecosystem these cells extend
โ TI-2026-055F "The High-Threat Triad" โ the most dangerous actors