Threat isn't about volume. The scanner fleet has 628 IPs and threatens nothing โ it maps. The exploitation fleet has 1,313 IPs and compromises 41 servers. But the three operations in this article are different. One has 100% success because it already owns everything it touches. One uses a human with PuTTY โ still active today. And one proves that a single actor controls 1,734 IPs across two tool versions. These are the dangerous ones.
Size measures reach. Success rate measures capability. Intent measures threat.
I. The Vietnamese Ghost Army
Ninety-two IPs. All Vietnamese. AsyncSSH 2.1.0 (Python library). Five hundred and twenty-six sessions. Every single one: successful login. Zero commands executed. Zero downloads.
This is not an attack. This is ownership verification.
When 92 systems authenticate perfectly across 526 sessions and do nothing afterward, they are already controlled. The connections are keepalive signals: "I can still reach you." The operator logs in, confirms access persists, logs out. A heartbeat across a ghost network.
The root:alpine Credential
Primary credential: root:alpine (50 uses, 47 IPs). This is the default root password on jailbroken iPhones and iPads (Cydia SSH). The operator is either testing for exposed jailbroken iOS devices in Vietnam, or (more likely) has set "alpine" as the standard password across their pre-compromised Linux fleet โ a deliberate reference to the iOS hacking community they came from.
II. The Manual Operator
PuTTY. A Windows SSH client you download from putty.org. Not a library. Not an API. A graphical application with a terminal window. Someone is sitting at a Windows computer, opening PuTTY, typing credentials, and running one command: uname -s -v -n -r -m.
One hundred and three times. Over one hundred and one days. Still active today.
This is the most patient operator in the dataset. They log in, check what OS/kernel/architecture the system runs, and log out. Every time, the same command. No exploitation. No deployment. Just identification. They are building a catalogue: which systems run which kernels, which architectures, which distributions. A human decision-maker evaluating each server individually.
| Property | Detail |
|---|---|
| Tool | PuTTY (Windows GUI SSH client) |
| Primary location | US (39 IPs), DE (5), GB (5) |
| Command | uname -s -v -n -r -m (every session) |
| Credentials | opc:opc, test:test123, user1:12345 (varied) |
| Active | March 21 - June 30 (still running) |
| Duration | 101 days (longest of any active campaign) |
III. The 1,734-IP Actor
๐ธ๏ธ actor-6285990cc704: Two Campaigns, One Operator
In 055B, we profiled actor-6285990cc704 as the 69-IP tight cluster expanding to 1,313 IPs via the libssh_0.11.x campaign. Now the same actor cluster appears controlling the libssh_0.9.6 campaign (421 IPs, 59 countries). Combined: 1,734 IPs under single-actor control.
| Campaign | IPs | Countries | Sessions | Success | Key Behavior |
|---|---|---|---|---|---|
| libssh_0.11.x | 1,313 | 84 | 1,963 | 41 | SSH key injection |
| libssh_0.9.6 | 421 | 59 | 1,732 | 24 | SSH key injection + uname + w |
| Combined | 1,734 | โ | 3,695 | 65 | Persistent backdoor |
Same SSH key injection command. Same actor cluster. Different tool versions running simultaneously. The 0.9.6 version additionally runs ls -lh $(which ls), uname -a, and w โ more thorough system evaluation before key injection. It's the evolution: the older version does more reconnaissance, the newer version is faster and leaner.
The "claude:claude" Credential
The libssh_0.9.6 campaign's most common credential: claude:claude (87 attempts, 85 IPs). Named after the AI assistant. This suggests the operator uses AI tools in their development workflow โ or named a test account "claude" while building their infrastructure. Either way, it's a cultural fingerprint: this operator is aware of and engaged with AI technology.
IV. Threat Comparison
| Operation | Why It's Dangerous | Unique Threat |
|---|---|---|
| Vietnamese Ghost Army | Already owns 92 hosts silently | Pre-positioned capability: can deploy ANYTHING instantly on 92 servers |
| PuTTY Manual Operator | Human decision-making, 101 days, still active | Adaptive: can change behavior based on what uname reveals |
| 1,734-IP Multi-Tool | Largest single actor, two simultaneous tool versions | Redundancy: blocking one campaign doesn't stop the other |
The scanner fleet (055A) is dangerous because of volume. These three are dangerous because of capability. The ghost army can deploy cryptominers, DDoS amplifiers, or ransomware staging on 92 Vietnamese servers with zero additional access effort. The manual operator can adapt in real-time to any defense. The multi-tool actor can survive detection of either campaign because the other continues independently.
V. Read Between the Lines
The PuTTY Operator Is Still Working
As of today โ June 30, 2026 โ someone is sitting at a Windows computer, opening PuTTY, logging into compromised servers, and typing uname -s -v -n -r -m. They've been doing this for 101 days. They will probably be doing it tomorrow. This is not historical analysis. This is real-time observation of an active threat actor. The question isn't what they've done โ it's what they're preparing to do with all that system information.
Why Vietnam?
92 IPs, all Vietnamese. Not scattered across countries โ concentrated in one nation. This suggests the operator is Vietnamese (operating domestic infrastructure), or specifically targets Vietnamese networks (perhaps for a Vietnamese customer base โ local language content, local banking trojans, local gaming fraud). The single-country concentration is the opposite of the globally-distributed operations. It serves a local market.
VI. The Thread Forward
Next: The Composite Portrait
We've profiled them all. The scanner, the exploiter, the validator, the watcher, the small cells, and the triad. Now: what do they look like together? What is the complete portrait of the population that attacks a single honeypot in 97 days?
Continuity
โ TI-2026-055B "The Sixty-Nine" โ the first identification of actor-6285990cc704, now expanded to 1,734 IPs
โ TI-2026-055E "The Small Cells" โ the artisans vs. these industrialists
โ TI-2026-055G "The Composite Portrait" โ the synthesis of all actors