🇮🇩 TI-2026-058L: The Indonesian Amplifier

Series: The Operators | Letter L: Why Indonesian Infrastructure Hits 11.4× Per IP While Others Average 3.9

Inside the compromised ISP nodes and Chinese-operated cloud instances turning Southeast Asia's largest archipelago into an attack amplification platform.

The Anomaly

In our honeypot's 102-day observation window, Indonesia presents a statistical outlier that demands explanation. While most countries contribute a handful of hits per IP — scanning, probing, moving on — Indonesian infrastructure persists. It comes back. Again and again.

The Three Amplification Layers

Layer 1: The Compromised ISP Nodes

Layer 2: The ByteDance Platform

Layer 3: The Multi-Tool Arsenal

What makes the Indonesian amplification unique is the tool diversity deployed from a single region:

Five different SSH client fingerprints from a single country. Indonesia isn't hosting one campaign — it's hosting all of them simultaneously. This is what amplification looks like: a single geographic region serving as a convergence point for the entire enterprise's tool portfolio.

The TikkerAI Connection

Why Indonesia?

The amplification effect has structural causes:

The SSH Key Injection

Among the shared commands from BytePlus infrastructure, one stands out:

This is persistence establishment. After successful login (6 confirmed successes on BytePlus alone), the attacker:

1. Deletes existing SSH keys (rm -rf .ssh)
2. Injects their own public key
3. Removes immutable attributes (chattr -ia) to prevent lockout
4. The compromised host becomes a permanent staging node

This is how the amplification cycle perpetuates: compromise → inject key → use as scanner → compromise more hosts → repeat. Indonesia's network topology (dense, under-monitored, cheap) makes it the perfect amplification medium.

The Shared Credential Network

Across BytePlus's 51 attack IPs, 15 credential pairs are shared between multiple IPs:

Seven IPs sharing "socks:socks" — they're hunting for proxy infrastructure. The enterprise doesn't just want to compromise hosts; it wants to compromise proxies that it can chain for further anonymization. Every compromised SOCKS proxy becomes another layer in the jurisdictional maze documented in 058K.

The Verdict

Read Between the Lines

ByteDance operates TikTok — used by 1.5 billion people. BytePlus is their enterprise cloud division. On that same cloud infrastructure, Chinese-speaking threat actors run SSH brute-force scanners with credentials like "董事长" (Chairman of the Board). The abuse contact is bd_abuse@bytedance.com. One wonders how many reports have been sent to that address. One wonders how many have been actioned.

PT Telekomunikasi Indonesia is 52% state-owned. Seven of its IP addresses in our dataset are actively participating in a global SSH attack campaign. The Indonesian government — through its state telco — is an unwitting infrastructure provider to transnational cybercrime. Not through negligence of policy, but through the structural impossibility of monitoring 170 million subscribers for compromise indicators they were never designed to detect.

210.210.155.71 attempted to log into our honeypot 155 times over 26 days. Every 4 hours, on average. The machine that owns that IP — likely a router or NAS in someone's apartment in Jakarta — is a zombie. Its owner pays their internet bill every month. They watch Netflix. They have no idea their connection is part of a 269-node international worm cluster. This is the human cost of amplification: not the victims of the attack, but the unknowing participants.

Next: TI-2026-058M — "The Worm's DNA" — Deep dive into the libssh 0.11.x propagation chain: what commands it executes, how it spreads, and what it leaves behind.