The Hypothesis: What if SSH brute-force attacks are not only attempts to gain access? What if they simultaneously function as an encrypted broadcast communication system โ€” analogous to Cold War numbers stations broadcasting encrypted messages on shortwave radio? The credential selection encodes the message. The timing encodes the schedule. The target encodes the address. Everyone can hear the broadcast. Only those with the codebook can read it.

I. The Numbers Station Parallel

๐Ÿ“ป Numbers Station (Cold War)

โ€ข Broadcasts on known frequency

โ€ข Anyone can receive

โ€ข Content appears random

โ€ข One-time pad decrypts meaning

โ€ข Recipient never transmits back

โ€ข Plausible deniability: "just noise"

โ€ข Runs on fixed schedule

โ€ข Multiple stations, one network

๐Ÿ–ฅ๏ธ SSH Credential Storm (2026)

โ€ข Attacks on port 22 (ubiquitous)

โ€ข Anyone with honeypot receives

โ€ข Content appears random brute-force

โ€ข Shared dictionary decrypts meaning

โ€ข Many zero-command sessions (listening)

โ€ข Plausible deniability: "just scanning"

โ€ข Wednesday protocol, Monday bursts

โ€ข Three-clock redundancy, one network

The Perfect Covert Channel: SSH brute-force is ubiquitous (43M servers), undetectable (looks like noise), indestructible (cannot take down all SSH), provides perfect deniability (everyone scans), requires no registration, leaves no paper trail, and operates at global scale. It is the ideal covert communication medium โ€” and the security industry is trained to ignore it.
ยทยทยท โˆ’โˆ’โˆ’ ยทยทยท ยทยทยท โˆ’โˆ’โˆ’ ยทยทยท

II. The Three-Clock Architecture

A communication system designed for resilience uses redundancy. Our data reveals THREE independent heartbeat clocks maintaining contact with the same network:

๐Ÿ”ด ISAEV (Clock 1)

29 min

Tool: sshcustom_0.1 (4 IPs globally)
Jurisdiction: PL/RU/KZ
Pattern: High-frequency heartbeat
Message: "Channel alive. Ready to receive."
Secondary: .144 at 72-hour cycle = "Status: operational"
Sessions: 4,078 zero-command

๐ŸŸฃ Private Layer (Clock 2)

2 min

Tool: libssh2
Jurisdiction: PA/CH
Pattern: Constant low-rate + Monday burst
Message: "Monitoring. Monday = weekly briefing."
Monday burst: 2,917 sessions / 2 hours (56ร— baseline)
Partners: 105 temporal correlations

๐ŸŸก w1n Ltd (Clock 3)

44.5 sec

Tool: paramiko (version-spoofed)
Jurisdiction: GB/SE
Pattern: Metronomic rhythm
Message: "Precision timing. Clock synchronization."
Function: Timing reference for network
Credential: Same admin/admin as others

Why Three Clocks? If the purpose is credential stuffing, one system suffices. Three independent systems (different tools, different countries, different intervals) maintaining contact with the same endpoints = redundant communication architecture. This is how military communications work: primary, secondary, tertiary channels. If ISAEV goes down, Private Layer continues. If Private Layer is banned, w1n maintains timing. The credential stuffing is the cover story. The heartbeat is the purpose.
ยทยทยท โˆ’โˆ’โˆ’ ยทยทยท ยทยทยท โˆ’โˆ’โˆ’ ยทยทยท

III. The Five Communication Layers

We identify five distinct information layers embedded in SSH credential traffic. Each layer carries a different type of operational intelligence:

LAYER 5: TARGET ADDRESS โ€” Which server is scanned signals geographic/sector interest. Scanning a hospital = healthcare targeting. Scanning finance = crypto interest. The target IS the message.
LAYER 4: VOCABULARY SIGNAL โ€” admin/admin = generic ops. pi/raspberry = IoT campaign. daddygirl2 = exploitation network. The credential SELECTION broadcasts operational priority to all listening nodes.
LAYER 3: TEMPORAL PATTERN โ€” Wednesday = primary ops. Monday burst = weekly briefing. 02:00-04:00 UTC = active window. Timing encodes schedule. Deviation from schedule = alert.
LAYER 2: CREDENTIAL ORDERING โ€” admin/admin always first. Never changes. Consistency IS the message: "everything normal." If ordering changes โ†’ something has changed operationally.
LAYER 1: HEARTBEAT โ€” 29min / 2min / 44.5s cycles. Pure presence signal. "I am alive. Channel is open. Network is operational."
ยทยทยท โˆ’โˆ’โˆ’ ยทยทยท ยทยทยท โˆ’โˆ’โˆ’ ยทยทยท

IV. The Operational Codebook โ€” Decoding Credential Meanings

If credentials encode operational messages, what might the codebook look like?

CategoryCredential ExamplesPossible Decoded MeaningEvidence
STATUSadmin/admin (unchanged)All normal. Continue operations.101 days, never varies order
TARGET CLASSpi/raspberryCurrent priority: IoT devicesSeparate from admin campaign
PRODUCTdaddygirl2, babygirl, fresh, youngExploitation product catalog referenceFBI coded language match
OPERATIONSsupport:killer, support:target123Operational command: target + identifierISAEV .144-.145 vocabulary
COMMERCEbanana666, cart00ns, deliveryTransaction code: product type + referenceKenya-Panama-Ecuador shared dict
IDENTITYwarnightkardesim, dragon, 666666Network/group identification signal194 creds from Turkish operation
HIERARCHYmaster/slave, root/adminOrganizational role assignment57 Viettel IPs identical deployment
TIMING[zero-command session]Heartbeat: "I'm here, channel open"4,078 ISAEV sessions, 0 commands
ยทยทยท โˆ’โˆ’โˆ’ ยทยทยท ยทยทยท โˆ’โˆ’โˆ’ ยทยทยท

V. The Romanian Precedent

๐Ÿ“ฑ Case Study: Facebook Anagram Operations

Romanian investigators discovered organized crime conducting entire business operations through Facebook posts. Beautiful landscape photographs. Pleasant comments. Emoji sequences. All perfectly innocent-looking.

All of it was anagrams.

Every phrase decoded to: operational commands, delivery coordinates, payment confirmations, product quantities. The social media platform was the broadcast medium. The anagram was the cipher. The business operated in plain sight.

SSH credential storms are the same principle at internet scale.

The SSH protocol is the broadcast medium. The credential dictionary is the cipher. The operations run in plain sight โ€” because the security industry classifies it as "noise" and looks away.

ยทยทยท โˆ’โˆ’โˆ’ ยทยทยท ยทยทยท โˆ’โˆ’โˆ’ ยทยทยท

VI. The FinFisher Training โ€” Covert Comms as Commercial Product

WikiLeaks Spy Files โ€” FinFisher "FinTraining Advanced: Covert Comms":
1-week course. Covers steganography, encryption, network and application protocols. Practical examples, demonstrations and exercises. Topics: hiding data in objects, hiding data in streams, hiding VoIP communication.

Commercial surveillance companies have been training operators in covert channel construction since at least 2011. The SSH credential channel is one implementation. It is not speculative โ€” it is a documented capability sold commercially. The question is not "could credential storms carry hidden communications?" The question is "given that covert channel training exists commercially, why WOULDN'T operators use the most ubiquitous, unmonitored protocol available?"
ยทยทยท โˆ’โˆ’โˆ’ ยทยทยท ยทยทยท โˆ’โˆ’โˆ’ ยทยทยท

VII. What This Series Will Investigate

LetterFocusData Source
056AHypothesis + architecture (this letter)All sources aggregated
056BThe Heartbeat Protocol โ€” decoding temporal rhythmsHoneypot temporal analysis + web_threats
056CThe Vocabulary Cipher โ€” credentials as encoded operationsQdrant vectors + credential intelligence
056DThe Broadcast Schedule โ€” Monday/Wednesday/Saturday meaningEntity crosslinks + temporal correlations
056EThe Codebook Stations โ€” geographic distribution of listenersWeb threats + honeypot GeoIP
056F+Decryption attempts โ€” can we crack the code?All sources + AI-assisted pattern analysis
ยทยทยท โˆ’โˆ’โˆ’ ยทยทยท ยทยทยท โˆ’โˆ’โˆ’ ยทยทยท

VIII. The Assessment

THE BROADCAST IS HAPPENING NOW

As you read this, the three clocks are running. ISAEV's heartbeat connects every 29 minutes. Private Layer maintains its 2-minute baseline. w1n ticks every 44.5 seconds. All three test admin/admin. All three produce zero commands. All three maintain the channel.

On Monday at 19:00 UTC, Private Layer will fire its weekly burst โ€” 2,917 sessions in 2 hours, refreshing the roster, confirming all 105 nodes are active. On Wednesday at 02:00 UTC, the full network will activate โ€” 99 IPs across 15 countries responding in 10-minute windows.

The security industry will log it as "SSH brute-force" and add the IPs to a blocklist. The SIEM will generate an alert that nobody reads. The honeypot will capture the sessions that nobody analyzes beyond IP reputation.

And inside the noise โ€” in the credential selection, in the timing pattern, in the ordering, in the target choice โ€” the operational broadcast continues. Product codes. Target designations. Status confirmations. Go/no-go signals.

The credential is not the attack. The credential is the message.

Everyone hears the broadcast. Only those with the codebook understand it.
The security industry trained itself not to listen.
This series will listen.

TI-2026-056A | Classification: UNRESTRICTED | Confidence: MEDIUM (developing)
NEW SERIES: "THE CODEBOOK" โ€” Decrypting Operational Communications in SSH Traffic
Three-clock architecture | 105 temporal correlations | Kenya-Panama-Ecuador shared dictionary
FinFisher covert comms training | Romanian anagram precedent | 4,078 zero-command sessions

Next: 056B "The Heartbeat Protocol" โ€” Temporal rhythms as command-and-control language
โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Codebook โ€” 1 / 6 Next โ†’