⚙️ The Org Chart

Complete Organizational Map of a Multi-National Cyber-Criminal Enterprise

Published: 1 July 2026 Sources: Series 058A–D Synthesis, 30+ Prior Investigations Related: TI-2026-056A–F (The Codebook), TI-2026-050D (The Machinery)

I. The Complete Picture

Across four letters (058A–D), one series (056A–F), and thirty prior investigations, we have mapped a single coordinated enterprise operating across 12 countries, 4 programming languages, 8 tool families, 6 shell companies, and 3 named individuals. This is the organizational chart.

OPERATIONAL STATISTICS (102 Days Observed)

Metric	Value
Total SSH sessions	14,040
Unique source IPs	326+
Countries represented	30+
Active days	102 (21 Mar – 1 Jul 2026)
admin:admin transmissions	14,664
Wednesday traffic share	77.3%
Tool families identified	8
Shell companies confirmed	6
Named individuals	3
Malware delivery mechanisms	4

II. The Hierarchy

ORGANIZATIONAL STRUCTURE


╔══════════════════════════════════════════════════════════════════╗
║                    COMMAND & COORDINATION                        ║
║                    (Unidentified — issues Wednesday orders)      ║
╚═══════════════════════════════╦══════════════════════════════════╝
                                ║
        ┌───────────────────────╬───────────────────────┐
        │                       │                       │
        ▼                       ▼                       ▼
┌───────────────┐    ┌──────────────────┐    ┌──────────────────┐
│ SIGNAL DIVISION│    │ RECONNAISSANCE    │    │ DELIVERY DIVISION│
│               │    │ DIVISION          │    │                  │
│ ISAEV Igor    │    │                   │    │ w1n Hunter-Killer│
│ (KZ/PL)      │    │ Go Machine (22)   │    │ (Anastasiia, UA) │
│               │    │ TechTies (SC/NL)  │    │                  │
│ SOLDATOV A.   │    │ Omegatech (SC/DE) │    │ Chinese C2 Net   │
│ (KZ/BG)      │    │ DMZHOST (GB/NL)   │    │ (CN cloud infra) │
│               │    │ UNMANAGED (GB/RO) │    │                  │
│ Private Layer │    │                   │    │ Meow Worm        │
│ (PA/CH)      │    │ w1n recon (5)     │    │ (GCP France)     │
│               │    │ Anastasiia (UA/GB)│    │                  │
│ Function:     │    │ Sia Nano IT (LV)  │    │ Sshd Propagator  │
│ Timing beacon │    │                   │    │ (CN backbone)    │
│ Mode encoding │    │ Nmap fleet (25+)  │    │                  │
│ Heartbeat     │    │ Google Cloud (BE) │    │ Function:        │
│               │    │                   │    │ Payload delivery  │
│               │    │ AsyncSSH (2)      │    │ Worm propagation │
│               │    │ Viettel (VN mil)  │    │ Territory seizure │
│               │    │                   │    │                  │
│               │    │ Function:         │    │                  │
│               │    │ Target discovery  │    │                  │
│               │    │ Asset valuation   │    │                  │
│               │    │ Persistence       │    │                  │
└───────────────┘    └──────────────────┘    └──────────────────┘
        │                       │                       │
        └───────────────────────┼───────────────────────┘
                                ▼
                    ┌──────────────────────┐
                    │   PROXY / LAUNDERING │
                    │                      │
                    │ LATAM compromised    │
                    │ (MX, BR, CL, CO)    │
                    │ Chinese vocabulary   │
                    │                      │
                    │ Academic (U. Chile)  │
                    │ Conscripted nodes    │
                    │                      │
                    │ Function:            │
                    │ Geographic laundering│
                    │ IP reputation abuse  │
                    └──────────────────────┘

III. The Named Individuals

CONFIRMED INDIVIDUALS

1. ISAEV Igor

Role	Signal Division — Primary Transmitter
ASN	200730 (ISAEV)
Registration	Kazakhstan
Operations	Poland (87.251.64.x)
Domain	novahost.kz
RDAP	ru-avm-1-mnt (Russian)
Volume	4,141+ admin:admin signals
Tool	SSH-2.0-Go (HASSH eff4c24d)
Evidence strength	HIGH — named in RIPE ASN registration

2. SOLDATOV Alexey Valerevich

Role	Signal Division — Backup Transmitter
ASN	209702 (SOLDATOV-AS)
Registration	Kazakhstan
Operations	Bulgaria (80.66.66.x), Netherlands
RDAP	soldatov-av-mnt
Volume	198 admin:admin signals
Tool	Identical Go binary to ISAEV (same HASSH)
Evidence strength	HIGH — named in RIPE, same binary as ISAEV

3. "Anastasiia" (AA39751-RIPE)

Role	Reconnaissance + Delivery — Hunter-Killer
Organization	w1n ltd (ORG-WL303-RIPE)
ASN	42237 (w1n)
Phone	+380502309318 (Ukrainian mobile)
Address	Dept 302, 43 Owston Road, Carcroft, Doncaster DN6 8DA (UK mail drop)
Operations	Sweden (185.246.128.x, 193.105.134.x), Latvia (31.170.22.x)
Volume	3,512+ admin:admin + reconnaissance + malware hosting
Tool	libssh2_1.11.1 (HASSH 57e4cc8e)
Evidence strength	HIGH — RIPE handle, phone, dual-use confirmed

IV. The Shell Company Network

CORPORATE INFRASTRUCTURE

Company	Jurisdiction	ASN	Created	Function
TechTies Inc.	Seychelles	197170	May 2026	Go Machine fleet (7+ nodes)
Omegatech LTD	Seychelles	202412	Jan 2026	Go Machine fleet (2+ nodes)
w1n ltd	UK (front)	42237	2022	Hunter-killer operations
Private Layer INC	Panama	51852	Legacy	Mode-encoding relay
TECHOFF SRV LIMITED	UK	48090	—	The Metronome + DMZHOST
UNMANAGED LTD	UK	47890	—	Romanian subnet (92.118.39.x)

The jurisdictional diversity is deliberate. Seychelles provides corporate secrecy. Panama provides data sovereignty. The UK provides RIPE membership (required for ASN allocation) with minimal beneficial ownership disclosure (until 2024 reforms). The geographic spread means a minimum of 4 simultaneous legal processes across 4 jurisdictions to merely identify the beneficial owners — before any infrastructure seizure can begin.

V. The Operational Calendar

WEEKLY ACTIVITY DISTRIBUTION (102 DAYS)

Day	Sessions	Share	Function
Monday	99	2.2%	Silence (listening)
Tuesday	516	11.2%	Setup / coordination
Wednesday	3,553	77.3%	PRIMARY TRANSMISSION
Thursday	346	7.5%	Residual / cleanup
Friday	26	0.6%	Dormant
Saturday	17	0.4%	Dormant
Sunday	39	0.8%	Dormant

The Wednesday concentration at 77.3% — down from 77.8% reported in TI-2026-056D — has remained stable across the entire observation period. This is not a botnet running autonomously. This is a scheduled operation with human operators who work a Tuesday-Thursday cycle and take weekends off.

The "working hours" nature of the operation has profound implications:

There is a team behind this, not a single actor
They operate in a time zone where Tuesday-Thursday daytime aligns with 02:00-04:00 UTC Wednesday (the peak window)
UTC+5 to UTC+6 places the operators in Kazakhstan/Uzbekistan during their work day (7:00-9:00 AM local)
This is consistent with ISAEV and SOLDATOV's Kazakhstani registrations

VI. Revenue Model

Based on the evidence across all investigations:

ESTIMATED ANNUAL REVENUE

Revenue Stream	Volume	Unit Price	Annual Estimate
GPU mining (compromised servers)	~100 hosts active	$50–200/month	$60K–240K
Residential proxy network	~500 LATAM/Asian proxies	$10/month	$60K
Telegram account sales	~50 accounts/month	$100 average	$60K
SMS verification service	~20 GSM gateways	$500/month	$120K
Access broker (selling compromised hosts)	~200 hosts/month	$50–500	$120K–1.2M
AI compute rental	~10 GPU clusters	$500/month	$60K
TOTAL ESTIMATED RANGE			$480K – $1.74M/year

Operating costs are minimal: ~$10K/year for the shell companies and hosting. The ROI is 48:1 to 174:1.

VII. What We Cannot See

For all that we have mapped, critical elements remain invisible:

The command channel: How does the Wednesday order get issued? We see the transmission but not the origin. The command layer may not use SSH at all — it could be Telegram, IRC, Tor hidden service, or dead drops.
The customer list: Who buys the compromised hosts, Telegram accounts, and SMS access? The marketplace transactions happen off this network.
The money flow: Cryptocurrency wallets connecting mining revenue to operators. We have no blockchain analysis.
The full scale: We see one honeypot's perspective. The actual network may be 10× or 100× larger than what targets our single sensor.
The Chinese principal: The Chinese vocabulary, Chinese C2 servers, and Chinese cloud infrastructure suggest a Chinese-speaking principal who commissions the Kazakhstani operators. This entity remains completely unidentified.

VIII. Series 058 Summary

WHAT WE PROVED

058A — The Go Machine: 22-node reconnaissance platform. TechTies shell company created one day before operations began. 9-phase payload including GPU detection and Telegram theft. mdrfckr operator retooled from Perl to Go.
058B — The Two Machines: Two Go variants with different functions — reconnaissance vs. signaling. ISAEV and SOLDATOV share identical binary. Private Layer operates the mode-encoding relay. Chinese vocabulary routes through LATAM proxies.
058C — The Constant Retooling: Four Go generations in six weeks. Polymorphic HASSH rotation defeats signature detection. Generation 4 targets AI/ML infrastructure. Vietnamese military operates autonomous AsyncSSH cell.
058D — The Supply Chain: Complete kill chain from Nmap discovery to malware delivery. w1n confirmed as dual-use hunter-killer. Meow worm enables exponential growth. Geographic pipeline separates EU targeting from CN delivery.
058E — The Org Chart: Three named individuals (ISAEV, SOLDATOV, Anastasiia). Six shell companies across 4 jurisdictions. Wednesday at 77.3% confirms scheduled human operation in UTC+5/+6 time zone. Annual revenue $480K–$1.74M.