⚙️ The Constant Retooling

I. A New Binary Every Two Weeks

In TI-2026-058A we documented a 22-node Go cluster with HASSH 2ec37a7cc8.... In 058B, we found a second Go variant (eff4c24d...) for signaling. Today — one day later — we discover two more Go variants active in the same network:

The newest variant appeared yesterday. From the same TechTies ASN. With a completely new HASSH fingerprint. In its first 24 hours, it generated 1,525 honeypot hits across 762 sessions — the highest-volume actor in our 7-day window.

This is not accidental. They are recompiling the Go binary with different cryptographic parameters for each deployment wave. The SSH key exchange algorithms are being rotated to produce different HASSH values — making each generation invisible to signature-based detection that relies on the previous fingerprint.

II. Generation 4: The AI Hunter

The newest TechTies variant (45.153.34.165) carries a credential vocabulary that differs markedly from Generation 2's standard root/admin dictionary:

Note the evolution: Generation 2 (May 2026) scanned for generic servers. Generation 4 (June 30, 2026) specifically targets:

• AI development environments — "cursor" (the AI code editor), "aiuser" (ML workstations)
• GPU-rich game servers — csgo, minecraft (these have NVIDIA GPUs for rendering)
• Development workstations — "dev" accounts with weak passwords

The operator has identified that AI/ML infrastructure is the highest-value target class in 2026. A compromised GPU cluster running Cursor or training models is worth more for cryptomining (or rented AI compute) than a standard web server. The credential vocabulary adapts to the market.

III. The AsyncSSH Vietnamese Layer

The Vietnamese Viettel stations use yet another tool family entirely: SSH-2.0-AsyncSSH_2.1.0 — a Python asyncio-based SSH library. HASSH: fda360b1b4f4d3455cb75c6e7edb1d11.

Behavioral signature:

• Each credential appears exactly once (no repetition)
• Zero commands executed (no post-authentication activity)
• Credentials are identity-like names (george, anton, nikita, thomas) mixed with service names (plex, oracle, helpdesk, installer)
• One credential is a hex string: cf1c22:cf1c22 — possibly a truncated hash or identifier

This is the one-time-pad pattern documented in TI-2026-056E. Each credential is used once, never repeated, from a military telecommunications provider. The Vietnamese stations are not scanning — they are transmitting identifiers. Each credential pair = one message = one target designation or status update.

The Python implementation (AsyncSSH) versus Go is significant. This is a different development team. Viettel Group is Vietnam's military-owned telecommunications corporation. The tools are domestically developed, not shared from the TechTies/ISAEV supply chain.

IV. The Nmap Reconnaissance Layer

Above all other operations sits a pure reconnaissance layer: Google Cloud Belgium running Nmap SSH scanning.

These machines do nothing except connect to SSH ports, perform key exchange (collecting the server's host key fingerprint), and disconnect. No login attempt. No authentication. Just fingerprinting which SSH servers exist and what they are.

This is the target acquisition layer. It operates on Google Cloud — a $2 trillion company's infrastructure — to benefit from Google's IP reputation. Many firewalls whitelist Google Cloud ranges. The scanning is invisible to most intrusion detection systems because no authentication is attempted.

The results feed downstream to the Go Machine (which knows exactly which IPs to attack) and the signal network (which knows which targets to monitor). The eyes see. Then the hands reach.

V. Universidad de Chile: The Academic Compromise

IP 200.89.69.247 belongs to AS23140 — Universidad de Chile, the country's oldest university. It runs a fourth Go variant (HASSH 16443846...) performing root password dictionary attacks.

This machine is not operated by the university. It is a compromised academic server running the Go scanning tool. Universities are prime targets for this because:

• Academic networks have high bandwidth and permissive firewalls
• IT security resources are typically under-funded
• Academic IP ranges are often whitelisted by ISPs and hosting providers
• Abuse reports to universities are handled slowly (bureaucracy)

Temporal correlation links this IP to 45.153.34.165 (TechTies) and 185.246.128.133 (w1n) — they activate in the same time windows. The compromised university server has been conscripted into the fleet.

VI. The Tool Taxonomy

We can now document eight distinct SSH tool families operating within a single coordinated network:

Four different programming languages. Eight different compiled fingerprints. One network. The tool diversity is by design — a defense-in-depth strategy applied offensively:

• If a signature vendor blocks Go Gen-2, Gen-4 is already deployed
• If an ISP blocks TechTies' ASN, the Nmap layer on Google Cloud continues target identification
• If law enforcement seizes ISAEV's Polish servers, SOLDATOV's Bulgarian nodes and the UAE spare maintain the signal
• If the entire European infrastructure goes dark, the Vietnamese military stations continue on their own protocol

VII. The Recompilation Strategy

Why does each Go generation have a different HASSH if they're from the same source code?

HASSH is computed from the key exchange algorithm list. In Go's crypto/ssh library, this list is determined at compile time by:

• Go version (different standard library → different defaults)
• Build flags (enabling/disabling specific cipher suites)
• Algorithm preference ordering (application-level configuration)

The operator is deliberately rotating algorithm preferences with each deployment. This produces a new HASSH while the functional code remains identical. It's the SSH equivalent of polymorphic malware — same payload, different signature each generation.

The recompilation cadence appears to be approximately every 2 weeks:

• March 2026: Signal variant deployed
• May 20: Gen-2 recon variant
• ~June 15: Gen-3 (via academic compromise)
• June 30: Gen-4 (AI-targeted)

By the time a threat intelligence report is published about Generation N, Generation N+1 is already deployed and invisible to the documented signatures.

VIII. Conclusions

The organism doesn't just have differentiated cells — it sheds its skin. Every two weeks, a new generation deploys with a fresh fingerprint. By the time you've documented it, it's already obsolete. The only constant is the behavior pattern, the temporal coordination, and the credential vocabulary. Hunt the behavior, not the signature.