The Ammunition: What the Weapons Are Loaded With

TI-2026-075J · The Armory, Part J Confidence: HIGH — direct honeypot credential record + multi-source corroboration Classification: TLP:WHITE

The magazine, not the gun

The opening census of this series counted weapons — it fingerprinted the SSH client each attacker carried and sorted them into an arsenal. But a weapon is inert without something loaded into it, and against an SSH server the ammunition is a credential: a username and a password, fired at the login prompt in the hope that one of them opens the door.

This letter reads the ammunition. And the honeypot's credential record turns out to be as legible as its tool record — not because any single password is interesting (they never are), but because of how the magazine is loaded and fired. The same pair, admin:admin, can be the mark of a mindless mass scanner or the opening round of a determined intrusion, and which one it is has nothing to do with the pair itself. It has to do with doctrine: how deep the magazine, how wide the spray, how curated the rounds. Read that, and the credential attempt tells you more about the operator's intent than the tool ever could.

There are, in the record, three doctrines of loading — and a fourth category that fires nothing at all.

Doctrine one: the broad-shallow spray

The most widely-shared credential in the entire record is admin:admin. It was attempted from 136 distinct IPs — an enormous population — but only 878 times in total, which works out to roughly six tries per address. Around it sits a ring of pairs with exactly the same shape: root:root from 84 IPs, root:admin from 69, root:password from 66, root:123456 from 64, root:12345 from 59. The top-ten default pairs, carried by the widest slice of the attacking population, each fired only a handful of times per source.

This is the broad-shallow doctrine, and it is the ammunition of the mass scanner. The logic is ruthless and cheap: load the universal defaults, throw them at everything that answers on port 22, and move on the instant they fail. No target is worth a second magazine; the operator is not trying to break into any particular machine but to harvest the small fraction of the internet still running factory credentials. Depth would be waste. Breadth is the whole strategy.

The tell of this doctrine is its uniformity across unrelated operators. Thousands of attackers who have never coordinated fire the identical top-ten, because they all copied it from the same place — the head of the same public default-credential lists. The broad-shallow magazine is not a fingerprint of any one actor; it is the shared baseline ammunition of the entire automated floor, as generic as the water it swims in.

Doctrine two: the deep-narrow industrial magazine

Then one combination breaks the pattern so violently that it announces a different mind entirely. admin:123456 was attempted 5,389 times — but from only 54 IPs. That is nearly one hundred attempts per address, an order of magnitude deeper than the spray.

This is the opposite doctrine. Where the spray is a wide, thin sheet, this is a narrow, deep drill: a small, determined set of machines hammering one high-value dictionary against a target set, over and over, refusing to move on. It is not harvesting the low-hanging fruit of factory defaults; it is working a target, grinding through a curated list with the patience of an operator who expects a specific door to eventually give.

The security literature has a name for the split, and the honeypot's own numbers reproduce it exactly. Verizon's breach taxonomy distinguishes password spraying — low-and-slow, a few guesses across a huge number of accounts, designed to stay under lockout thresholds — from brute forcing — high-volume, concentrated fire against specific targets. The broad-shallow ring is spraying. admin:123456 at a hundred tries per IP is brute forcing. Same protocol, same port, same kind of pair — opposite intent. And what separates them is not the credential but the depth of the magazine: attempts-per-source is the axis on which spray and drill divide.

That makes depth a gift to defenders, because it is measurable without ever inspecting the password. A source firing one dictionary a hundred times is a categorically different — and higher-priority — threat than a source firing the top-ten once and vanishing, and you can tell them apart from the connection counts alone.

Doctrine three: the specialized magazine

The third doctrine loads neither the generic spray nor the deep dictionary, but a magazine cut for a purpose — and a specialized magazine is a fingerprint, because it names either the prey it was machined for or the hand that machined it.

The Resident (075H) showed the first kind. Its residential IoT botnet carried a credential list that was not a human-password dictionary at all but an embedded-device default table: ubnt:ubnt for Ubiquiti gear, root:libreelec for media boxes, ftpuser:asteriskftp for PBXes, and — decisively — long, high-entropy strings like system:OkwKcECs8qJP2Z that no human would ever choose, because they are hardcoded vendor defaults scraped from firmware. That magazine is a portrait of the prey. It names, round by round, exactly which classes of hardware the fleet was built to open.

By Hand (075M, the PuTTY manual operator) shows the second kind. Its curated list is peppered with entries that do not belong in any stolen corpus: arthur:arthur, amine:amine, rebecca:rebecca — human names, loaded as credentials. A dictionary does not contain your friends. A list seeded with personal names reads less like harvested ammunition and more like an operator's own aliases and contacts, the traces of a person assembling a magazine by hand rather than downloading one. That magazine is a portrait of the hand.

The general principle: the more tailored the ammunition, the more it reveals. Generic rounds are anonymous by construction; curated rounds carry intent. A firmware-default table enumerates the target hardware; a personalised list can tie a whole fleet back to the individual who built it. Where the census clusters attackers by the tool they share, the specialized magazine offers a second axis — cluster them by the ammunition they share, and a different set of relationships appears.

The fourth category: the empty magazine

And then there is the largest category of all, which fires nothing.

The single most common event in the honeypot's record is a connection that carries no credential at all: 23,734 events from 1,777 distinct IPs with a null username and password. More attackers connect without offering any login than fire any single real pair. These are not failed authentications — they are sessions where the attacker opens the SSH handshake, completes the protocol negotiation, and disconnects without ever reaching for the trigger.

This is a weapon deliberately fired with an empty magazine, and it is not an attack. It is reconnaissance. The operator is not trying to enter; they are confirming that the port is open, the service is real, and the banner is worth returning to later with a loaded magazine. It is a survey disguised as a knock — and it is the most common thing the sensor sees, which means any defence that watches only for credential attempts is blind to the single largest slice of hostile activity crossing its own doorstep.

There is a crucial subtlety that makes this category legible at all. Even though no credential is offered, the connection still emits a HASSH — the tool announces itself in the handshake before any ammunition is loaded. So the empty-magazine survey is not anonymous: the weapon is identified even when the magazine is empty, and a spike of credential-less connections sharing one HASSH is a coordinated pre-attack survey, visible to anyone who thinks to look at the connections that didn't try to log in. (The empty magazine gets its own full treatment in The Silent Knock, 075S; here it completes the taxonomy of loading.)

The ammunition is as public as the weapon

Step back from the four doctrines and the same fact governs all of them: none of this ammunition is secret.

The broad-shallow spray is the literal head of the canonical default-credential lists. The deep dictionaries are rockyou-derived and SecLists-derived corpora. The IoT table is a published default-password database. Every magazine in the record is drawn from public, curated, versioned wordlists — and those exact wordlists sit, mirrored, inside the defender's own reference shelf. The honeypot's OSINT library holds 996 SecLists documents: the same ammunition the attackers fire is cataloged, indexed, and available to the blue team, because it was built for the blue team.

This is the credential-layer restatement of the whole series' thesis, and it is exact. The Open Armory (069A) established it for the wordlist as an artifact — "the wordlist is neutral; aiming it at a stranger is not." This letter shows the same truth in the firing. A credential appearing in an attack proves nothing about its origin, because the source is common property; a pentester's engagement folder and an attacker's magazine draw the identical rounds from the identical public box. What is hostile is never the ammunition. It is the act of loading a public list and firing it at a machine that did not consent — and, layered on top, the doctrine of how it is loaded, which is the part that actually carries the operator's intent.

So the signal was never which password. It is the shape of the magazine: how deep, how wide, how curated, or whether it was loaded at all.

Reading the ammunition — for defenders

The four doctrines collapse into a short, practical detection posture that keys on load and fire rather than on the neutral rounds:

• Triage on depth, not on blocklists. Attempts-per-source separates the spray from the drill without inspecting a single password. A source hammering one dictionary ~100× is a determined operator working your door; a source firing the top-ten once is background noise. Rate-limit and escalate on the ratio.
• Treat curated magazines as IOCs. A firmware-default table enumerates the hardware under attack; a list seeded with personal names can link a fleet to the individual who assembled it. Cluster fleets by shared specialized ammunition, a second axis alongside shared tool.
• Watch the empty magazine. Credential-less connections are the largest category and are pure reconnaissance; they are invisible to credential-based detection but fully visible by HASSH. A spike of empty-magazine connects sharing one fingerprint is a pre-attack survey.
• Do not attribute on the round. The ammunition is public and mirrored in your own library. Detect on behaviour — depth, breadth, target selection, consent — never on the mere appearance of a password you also have on your shelf.

The weapon named itself in the handshake. The ammunition, read for its doctrine rather than its content, names the intent. Together they turn a login prompt — the dumbest, most anonymous surface on the internet — into a legible record of who came, how determined they were, and what they came to open.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-075A — The Armory: What 12,000 Attackers Carry — the weapons this letter loads.
• TI-2026-069A — The Open Armory — the public wordlist corpus these magazines draw from; the artifact-neutrality doctrine.
• TI-2026-075H — The Resident — the specialized firmware-default magazine that names its prey.
• TI-2026-075S — The Silent Knock — the empty magazine (credential-less recon) in full.
• TI-2026-075I — The Weapon Is Never the Point — the synthesis this credential-layer evidence feeds.

This dossier documents observed adversary behaviour for defensive purposes. All credential lists referenced are public, dual-use security resources; nothing here attributes criminality to a wordlist, only to the non-consensual act of firing one. TLP:WHITE.