The Tenant of Fifty-Six Networks

TI-2026-075G · The Armory, Part G Confidence: HIGH — direct honeypot operator-clustering (124 nodes, one reused key) + multi-source corroboration Classification: TLP:WHITE

One hand wearing fifty-six gloves

In The Cloud Contractor (TI-2026-075B), the honeypot watched the offense do the lazy, rational thing: concentrate. It rented the whole pentest arsenal on one hyperscaler, Google Cloud, and trusted the platform's respectability to launder the traffic. The lesson there was that disposability, not shelter, is what the attacker actually buys — the brand on the ASN is not a packet-level trust signal.

This dossier is that lesson read backwards.

The honeypot's operator-clustering engine has resolved its single largest shared-key group: 124 distinct source IPs, spread across 56 autonomous systems, in 15 countries, all bound together by one signal — a reused SSH client key, presented identically from every node. Between 21 May and 16 June 2026 this fleet threw 2,466 recorded hits at the sensor, at an average threat level of 74.5 and a peak of 100. It is bigger than the dual-arm libssh operator of Part C. And where The Cloud Contractor concentrated everything in one place, this operator has done the exact opposite. It has scattered itself as thinly as it possibly can.

The largest single provider in the fleet — OVH — holds just ten of the 124 nodes. Eight percent. After OVH the distribution falls away into a long, flat tail: Hetzner with eight, Internap with eight, Multacom with eight, HostPapa with seven, then a procession of fives, fours, threes, and dozens of providers contributing a single IP each. Fifty-six legally-distinct hosting companies, in fifteen jurisdictions, and not one of them holds enough of the operation to matter on its own.

That is not an accident of growth. It is an architecture. This is what a fleet looks like when its designer's first priority is not efficiency but survival — when the operator has looked at how takedowns actually happen and built a body that no single takedown can kill.

The economics of not being killed

To understand why an operator would pay 56 separate hosting bills when one would do, you have to think like the person on the other end of an abuse report.

A botnet built from compromised home routers is free to assemble but fragile in a specific way: it lives at the mercy of the ISPs whose customers it has infected, and those ISPs can — and periodically do — clean house. A fleet concentrated on one commercial provider is efficient to manage but fragile in a different way: it lives at the mercy of that one provider's abuse desk. Send enough complaints to a single company and, sooner or later, an account gets suspended and a large chunk of the operation blinks out at once.

Dispersion defeats both failure modes by refusing to give any one party enough leverage to act decisively. Suspend the ten OVH nodes and you have removed eight percent of the fleet; the operator notices in the morning, shrugs, and re-rents. There is no single abuse desk, no single provider, no single national CERT, and no single court that can reach across 56 independent legal entities in 15 jurisdictions fast enough to matter. Each provider sees only a handful of its own IPs behaving badly — a routine, low-priority nuisance, not an emergency. The operation's total size is invisible from inside any one network. Only a sensor that sees all of it at once — a honeypot correlating across providers — can perceive the whole animal.

This is the deliberate trade the operator has made: the convenience of concentration, surrendered, in exchange for the survivability of dispersion. And it was not free. Every one of those 56 footholds is a rented, invoiced, paid-for server — OVH, Hetzner, Internap, DigitalOcean, Scaleway, Contabo, M247, NovoServe, Psychz, ReliableSite, FDCservers, and forty-five more. There is not a single residential broadband line or mobile-telco address anywhere in the cluster. This is not a botnet of hijacked victims. It is a fleet of purchased machines, assembled with money rather than seized by force — a business expense, chosen precisely because paid disposability is more reliable than stolen capacity.

The substrate, in other words, is the same ordinary commercial cloud that The Cloud Contractor profiled. Concentration and dispersion are not different worlds; they are two strategies played on the same board. The board is invoiced hosting, and its defining property — the one the offense keeps returning to — is that it is disposable.

The crack: one key the operator was too efficient to rotate

Here is the irony at the centre of this operation, and it is worth sitting with.

The operator spent real money — 56 hosting relationships across 15 countries — for the express purpose of making the fleet unattributable. The entire point of the dispersion is that the 124 nodes should read, to any observer, as 124 unrelated strangers: different providers, different countries, different flags, no visible thread between them. The architecture is a machine for manufacturing the appearance of a crowd.

And a single, free, milliseconds-of-effort choice collapses all of it.

Every one of the 124 nodes presents the same SSH client key. Generating a fresh key for each host costs nothing and takes no time; it is one command. The operator chose not to. Perhaps out of habit, perhaps because the tooling was built once and cloned, perhaps because it never occurred to them that anyone was correlating keys across providers. Whatever the reason, that one reused artefact hard-links all 124 addresses into a single attributable hand. The key is the thread the dispersion was supposed to hide, and the operator wove it through every node themselves.

This is the recurring shape of opsec failure, and this series has now seen it from several angles: the reused password marker in Part F, the shared HASSH client build across the whole census in Part A, and here the reused key. The pattern is always the same. The expensive, deliberate layer of obfuscation — the money, the dispersion, the flags — is defeated not by cracking it but by a small convenience the operator granted themselves underneath it. Attribution rarely comes from breaking the strong wall. It comes from the weak, shared thing the operator forgot was shared.

There is a structural reason this failure is so common, and it is worth naming because it predicts where to look next time. Obfuscation costs the operator effort in proportion to how much of it they do; reuse saves effort in proportion to how much they share. Those two pressures pull in opposite directions across every layer of an operation — the addresses, the credentials, the keys, the tooling, the payloads — and the operator resolves the tension differently at each layer depending on where they feel watched. This tenant felt watched at the network layer and spent lavishly there: 56 providers, 15 countries, maximal spread. It did not feel watched at the cryptographic layer and economised completely: one key, everywhere. The gap between where an operator spends and where an operator saves is exactly where attribution lives. Find the layer they thought no one was looking at, and you find the thread.

For a defender this inverts the whole problem. You cannot block your way out of a 124-node fleet by chasing IPs — the operator controls the addresses and re-rents them faster than you can list them. But you can match on the key. The reused SSH client key is a cluster fingerprint and a blocklist seed at once: recognise the handshake, and 124 disposable addresses resolve into one durable identity that survives every re-rental. Attribution beats address-blocking because the operator owns the address and cannot easily change the handshake without rebuilding the thing that made the fleet cheap to run.

One guess, made everywhere: root with a blank password

The key is the first binding signal. The credential is the second, and it is just as uniform.

Across all 124 nodes, the honeypot recorded a single credential pattern: username root, password blank — attempted 6,815 times. Not a dictionary. Not a rotating list of common passwords. One guess, fired everywhere, by every node.

That uniformity is itself diagnostic — 124 independent actors do not spontaneously converge on the empty-password attempt; a fleet that makes the same single guess everywhere is one campaign, with one configuration, run by one hand. But the choice of that guess also tells you exactly what the operator is hunting. The empty root password targets a specific and genuinely dangerous misconfiguration: an SSH daemon that permits passwordless root login. It sounds absurd, but it is a real and recurring failure mode — hastily-imaged cloud instances, appliances shipped with defaults never changed, IoT gateways whose vendors left PermitRootLogin open with no password required. The operator is not trying to crack anything. It is sweeping the internet for the doors that were left unlocked, and it has built a 124-node fleet to do the sweeping in parallel, from too many directions to block.

The defensive reading is exact. Passwordless-root SSH is the single weakness this fleet exists to harvest. Disabling root SSH login by default, refusing empty passwords, and requiring keys are not abstract hardening recommendations here; they are the precise countermeasure to an operation the honeypot has watched run 6,815 times. And the single-credential uniformity is a detection signal in its own right: many IPs, one blank-root attempt, is the shape of one dispersed operator wearing 56 gloves.

No single point of failure — the fleet hosts itself

There is one more property that completes the design, and it is what makes this operation genuinely resilient rather than merely spread out.

The 124 nodes do not all do the same job. Behavioural classification splits the fleet into roles: 27 scanners mapping the ground, 30 exploit-attempters pushing on the doors, 49 in general abuse, and — the detail that matters most — 18 nodes flagged as C2 infrastructure. A seventh of the fleet is not attacking outward at all. It is hosting the operator's own command-and-control. GreyNoise, entirely independently, flags 17 of the nodes as malicious.

This is self-containment. The operator does not rent scanning capacity from one place and buy C2 hosting from another, leaving an external dependency a defender could sever. The reconnaissance, the intrusion attempts, and the control plane all live on the same 56-network fleet. There is no upstream C2 host whose takedown would decapitate the operation, because the C2 is the fleet — 18 of its own members. Cut any node and the function it served reappears on another rented server by the next billing cycle.

And because the C2 nodes and the scanner nodes are all bound by the same reused key, the self-containment that gives the operator resilience also gives the defender leverage. Identify the fleet by any one of its functions — catch a scanner, flag a C2 node — and the shared key exposes the other 123. The design that removes the operator's single point of failure hands the analyst a single point of attribution.

The vantage no provider has

There is a quiet asymmetry running through this entire operation, and it is the reason the fleet works — and the reason it was caught anyway.

Every party who could act against this operator sees only a sliver of it. OVH's abuse desk sees ten misbehaving IPs on OVH; to them it is a small, unremarkable nuisance, indistinguishable from the background hum of a large hosting business. Hetzner sees eight. DigitalOcean sees three. A national CERT sees whatever landed in its jurisdiction. Each of these observers, looking at their own slice, sees a handful of bad servers and files it under routine. None of them sees the animal. The operator's dispersion is, at bottom, an attack on the observer's field of view: it works by ensuring that no party with the power to act ever perceives enough of the operation to justify acting.

The one vantage that defeats this is the one the operator did not account for: a sensor that sits still and lets the whole fleet come to it. A honeypot does not see the operation from inside any single provider; it sees it from the target's end, where all 124 nodes — OVH, Hetzner, DigitalOcean, and the fifty-three others — arrive at the same door and knock with the same key. From that vantage the dispersion that hides the fleet from every provider is exactly what makes it legible: 124 addresses that would look unrelated to any one host resolve, at the point of convergence, into one operator with one handshake and one blank-root guess. The operator optimised against the observers it could see — the abuse desks, the CERTs, the providers — and never modelled the observer that simply waits.

This is the deeper defensive lesson of the dossier, and it generalises beyond this one tenant. Against a threat engineered for dispersion, the winning move is not more enforcement power at any single node — it is correlation across nodes. Shared telemetry, cross-provider threat intelligence, and honeypot networks that pool what they see are not luxuries; they are the only vantage from which a dispersed operation is even visible as a single thing. The operator bet that no one would assemble the whole picture. The bet is only as good as the defender's willingness to share.

The map that lies: fifteen countries, one shopper

A closing caution, because it is the error this architecture is built to induce.

The fleet's geography, by hosting location, runs: United States 61 nodes, Netherlands 27, Germany 10, Canada 5, France 5, Romania 4, and a thin tail through Ukraine, Singapore, Finland, Spain, North Macedonia, Bosnia, Great Britain, Czechia, and Australia. It is tempting — and wrong — to read that as a fifteen-country adversary.

It is nothing of the kind. That list is a map of where permissive VPS capacity is cheap and easy to buy: Ashburn, Amsterdam, Frankfurt, the hosting hubs of the commercial internet. It traces the operator's shopping, not the operator's location. The 15-country spread is a procurement decision, and reading it as nationality is precisely the misdirection the dispersion exists to create — to make one tenant look like fifteen countries' worth of unrelated strangers.

The honest attribution statement is narrow, and that narrowness is the point. The reused key proves one operator. The geography proves only where that operator rents. Nothing in the honeypot's evidence names a country of origin, and to supply one from the hosting map would be to lose the analysis in exactly the way the operator intends. When infrastructure geography and operator geography are conflated, the attacker has won before the first real question is asked.

That is why the defensive posture against a dispersed tenant cannot be geographic. Geo-blocking by country is nearly useless here — it would mean blocking the world's major hosting providers. Provider-level takedown does not scale — suspending ten nodes removes eight percent of a fleet that re-rents overnight. What works is what defeated the operator's own investment: cluster on the cryptographic identity, cluster on the behavioural uniformity, and ignore the flags. The 124 addresses are disposable. The hand behind them, betrayed by one unrotated key and one blank-root guess, is not.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-075B — The Cloud Contractor — the concentration pole of the same disposability axis; this dossier is its dispersion mirror.
• TI-2026-075A — The Armory: What 12,000 Attackers Carry — the census that catalogues the libssh2_1.11.0 population this operator belongs to.
• TI-2026-075F — The First Move — the reused-artefact opsec failure seen on the post-login side (the modzmodz marker); here it is the reused key.
• TI-2026-075C — Two-Handed — the other large key-bound operator; a useful contrast in binding signal (authorized-key vs client-key) and infrastructure mix.

This dossier documents observed adversary infrastructure and behaviour for defensive purposes. Attribution is stated at the level the evidence supports — one operator, proven by a reused key — and no further. TLP:WHITE.