TI-2026-064E — Preponderance: When Weak Signals Become Proof, and When They Only Look Like It

Classification: HIGH · Forensic threat intelligence · Methodology · Published 2026-07-07 · Series: ⚖️ Circumstantial

Four weak signals, four rungs: coincidence in time (A), corroboration from outside (B), the accident of a disagreeing map (C), the geography of the address space (D). Each, alone, is a lead and not a verdict. This final part asks the question the whole series was built to reach: when do weak signals add up to a strong claim — and how do you tell real convergence from the illusion of it? The answer is the difference between intelligence and confirmation bias, and it comes down to one rule about which signal is allowed to go first.

1. The Shape of the Graph

Of the 192,395 edges in the entity graph, only a sliver are the strong same-operator proofs:

Everything else — the ~180,000 remaining edges — is the circumstantial layer this series dissected: same_prefix, shared_otx_pulse, shared_geo_pattern, temporal_correlation, and their kin. The strong evidence is rare. The weak evidence is the ocean it floats in. Attribution is the craft of using the ocean without drowning in it.

2. How Real Convergence Looks

The strongest cluster in the entire dataset — the Outlaw/Shellbot fleet of TI-2026-008B, 81 machines sharing one planted authorized_keys entry — is not strong because of the weak signals. It is strong because of the key (0.90). But look at what surrounds that key on the same 81 nodes: they also share the Outlaw cleanup command (shares_commands, hash a7aa36c3), also present the libssh-swarm HASSH set (shared_hassh), also co-occur in time and space. The weak signals are all present — and they are corroboration, not foundation. The claim would stand on the key alone; the weak layer thickens it into certainty.

That is what genuine convergence is: independent signals of different kinds pointing at the same pair, anchored by at least one strong one. A backdoor key and a command signature and a client fingerprint on the same two IPs is overdetermined — no single innocent explanation covers all three. This is why the platform's confidence does not simply average. Two 0.35 geo-patterns do not make a 0.70; but a 0.90 key with a 0.75 command and a 0.80 HASSH stacked on one pair is a different logical object entirely — multiple independent locks, all opened by the same hypothesis.

3. How the Illusion Looks

Now the failure mode, and it is subtle because it uses the same graph. Start from a suspicion — "these two IPs feel related" — and go collect edges between them. You will always succeed. The circumstantial layer is dense enough that any two busy attackers share something: a time bucket (A), an OTX dump (B), a cloud region (C), a transit provider (D). Assemble four 0.4-ish edges, and an untrained eye reads "four independent signals — must be the same actor." It is not. It is the birthday paradox wearing a lab coat.

The tell that separates the two cases is not the number of weak edges. It is which signal came first.

• Intelligence: a strong signal (key, malware, command) establishes the pair; weak signals are then found corroborating it. Hypothesis first from strength, weak evidence confirms.
• Confirmation bias: a hunch establishes the pair; weak signals are then hunted to justify it. Hypothesis first from suspicion, weak evidence manufactured to fit.

The evidence collected can look identical. The epistemics are opposite. Weak signals may corroborate a hypothesis born from a strong signal; they may never originate the hypothesis themselves. Break that rule and the graph will confirm anything you already believe — which is the same as confirming nothing.

4. Structure Without an Origin

There is a cleaner way to say it, borrowed from geometry. The weak signals give you affine structure — they tell you how nodes sit relative to one another: parallel, adjacent, contemporaneous, co-reported. What they cannot give you is an origin — a fixed point that says this is where the operator is. You can know that two IPs are near each other on every axis and still not know they are the same hand. Only a strong signal — a key someone planted, a binary someone compiled — fixes the origin. The circumstantial layer is a coordinate system with no zero. Attribution is choosing the zero honestly, from evidence that can bear the weight, and then reading the structure the weak signals describe around it.

Get that order right and 180,000 weak edges become a map. Get it wrong and they become a mirror.

5. Alternative Interpretation

Steelman: "This is a counsel of paralysis. Real attribution — from Mandiant's APT1 to the FBI's indictments — routinely rests on accumulated circumstantial evidence with no single 'smoking gun.' Demanding a strong anchor before any weak signal counts sets a bar that working intelligence never actually clears."

Why the rule survives the objection:

• Accumulation is real — with independence and a prior. APT1-style cases work because the circumstantial strands are independent in kind (infrastructure + tooling + language + timezone) and are weighed against an explicit base rate, not because suspicion was retrofitted with edges. That is precisely §2's "convergence," not §3's illusion.
• The rule is about order, not quantity. It does not forbid attribution on circumstantial evidence; it forbids letting the hypothesis be born from the weak layer it is then "confirmed" by. A prior formed from strength — even a weak strong-signal like a partial command match — is a legitimate zero. A prior formed from a hunch is not.
• The honeypot itself proves the danger. With 192,395 edges over ~11,500 IPs, the graph is dense enough to "connect" almost any pair. A method that finds a link between everything has told you nothing about anything. The anchor rule is what keeps the graph falsifiable.

What is not claimed: that circumstantial evidence is unusable (this entire series is about using it), or that a strong signal is infallible (a shared kit-default key can mislead — see 008B's own caveat). Confidence: HIGH that convergence anchored by an independent strong signal is sound attribution, and that weak signals assembled to justify a pre-formed hunch are not — regardless of how many are stacked.

6. Defense Response

• Anchor, then expand. Act on strong signals — grep the key, hash the binary, match the command. Then walk the weak layer outward to scope the operator's footprint. Never the reverse.
• Count kinds, not edges. Ten temporal_correlation edges are one kind of evidence ten times. One key + one command + one HASSH is three independent kinds — worth far more. Weight convergence by diversity of signal type, not raw edge count.
• Price every weak edge by base rate (Part D's discipline, generalised): a signal you can find between any two nodes contributes nothing until it is rare enough to discriminate.
• Audit your own order of operations. Before you write "same actor," ask which signal came first. If the answer is a hunch, you have built a mirror. If it is a key, you have built a case.
• The free, decisive move is still the strong one. For every campaign in this corpus, the action that ends the incident is the strong-signal check — the shared key, the malware hash — not the accumulation of weak ones. Circumstantial evidence scopes the response; it does not, by itself, justify it.

7. Investigation Metadata

Cristian Lișneanu · shuffle-on.com · Threat Intelligence