The Compiled Swarm: The Language the Armory Is Migrating To

TI-2026-075L · The Armory, Part L Confidence: HIGH — direct honeypot HASSH coordination + multi-source corroboration Classification: TLP:WHITE

A different generation of tool

Most of the census is old, in the way software ages. The bulk of the attacking population carries C-based clients — the libssh and libssh2 library fleets — or Python scripts built on Paramiko and AsyncSSH. These are the established generations of SSH tooling: mature, ubiquitous, and, in the library fleets, slowly fading.

One HASSH stands apart from them, and it is not fading. 16443846184eafde36765c9bab2f4397 is the signature of Go's x/crypto/ssh package — the SSH library maintained by the Go team at Google, and the engine of the zgrab2/zmap lineage of internet-scale scanners. It spans 468 distinct IPs across 8,722 sessions, first seen in March and still firing on the day this was written in July 2026. It is the third-largest tool population the census recorded. And unlike the legacy library fleets, it is growing.

That growth is the point of this letter. The Go swarm is not just another scanner to catalogue; it is evidence of a tooling-generation shift in progress — the offense migrating to Go for exactly the reasons the legitimate cloud industry did. The census has, until now, been a snapshot of what attackers carry. This is a snapshot of what they are switching to.

Why an attacker chooses Go

You do not write a Go SSH scanner by accident. Go's x/crypto/ssh is production-grade library code, reviewed and maintained by professionals; reaching for it is a deliberate engineering decision that says something about the builder. And what it says is that they think about deployment — because Go's three defining advantages are precisely what an industrial scanner wants.

A single static binary. Go compiles to one self-contained executable with no runtime dependencies. It does not need an interpreter installed, does not need libraries present, does not need a matching version of anything. You drop it onto a host — any host — and it runs. For an operator seeding a scanner across a fleet of rented and compromised machines, that is the difference between a deployment that works everywhere and one that breaks on the first box with the wrong Python version.

Goroutines. Go's lightweight green threads let a single modest process hold thousands of concurrent SSH connections open at once, each scheduled cooperatively, with minimal memory per connection. A C scanner can approach this with careful async I/O; a Python scanner strains under it. Go gives it away for free in the language design. This is why the swarm can scan at the rate it does: concurrency is the native idiom, not a hand-built feature.

Cross-compilation. From one build machine, Go produces binaries for any operating system and any architecture — GOOS=linux GOARCH=arm and you have an ARM router build; change two words and you have an x86 server build. One codebase, every target. The operator writes the scanner once and ships it to the whole heterogeneous zoo of internet hardware.

These are not hacker tricks. They are the exact virtues — deployment simplicity, massive concurrency, portability — that made Go the language of modern cloud infrastructure, of Docker and Kubernetes and half the backend internet. The offense adopted Go for the same reasons Google did, because it is genuinely the right tool for running many network operations at scale. (The Go-versus-libssh ecosystem was mapped in depth from the toolmaker's angle in TI-2026-050A, "The Other Swarm"; the Armory frames it here as the census's migration frontier.)

The swarm's own traces confirm the builder

You do not have to take the language choice on faith that it signals sophistication — the swarm's behaviour confirms it, in tells no commodity botnet leaves.

It raises the file-descriptor limit with ulimit -n 1020000 — a request for a million open file handles. Nothing does that except a program that expects to hold an enormous number of concurrent sockets; it is the operational signature of the goroutine concurrency described above, made visible in a single command. A botnet spraying factory defaults never needs it. A concurrency engine built to hold tens of thousands of connections open cannot function without it.

It probes the shell with echo SHELL_TEST — a deliberate confirmation that command execution actually works before the operator proceeds, the mark of a tool designed to verify its foothold rather than blindly fire.

And its credential magazine is not the IoT default table of the residential botnet (075H) or the generic top-ten spray. It is a developer-and-database list: postgres:postgres, oracle:oracle, git:git, dev:dev, ubuntu:ubuntu, trader:trader, and the distinctive marker root:ankurkudintzi. This is ammunition assembled by someone who thinks in terms of servers, databases, and CI pipelines — the professional's target set. Where the AsyncSSH botnet hunted routers and cameras, the Go swarm hunts infrastructure. The magazine names the prey (as 075J argued it always does), and this prey is the backend.

Global reach, industrial rhythm

The Go swarm does not live in one carrier's address space the way the residential botnet does. Its 468 IPs span the map — the Netherlands, Italy, Luxembourg, Great Britain, the United States, Vietnam, Chile, Mexico, France, Poland, Korea, India, Singapore — the footprint of rented and compromised infrastructure worldwide, the same disposable substrate the infrastructure letters mapped.

And it fires with a rhythm that is unmistakably machine, not hand. A single Netherlands node, 91.92.40.45, logged 780 sessions in a ninety-minute window; a neighbour, 91.92.40.28, logged 773. Early nodes such as 172.104.31.246 and 46.151.182.2 each produced 703 sessions in an hour. These are not the patient, exploratory sessions of a human operator; they are the output of a concurrency engine opening connections as fast as the scheduler can hand them out. The goroutines, doing exactly what they were chosen to do.

Modern delivery, commodity payload

Here is the deflating twist, and it matters because it recurs across the whole series. For all its engineering sophistication — the static binary, the million file descriptors, the professional target list — the Go swarm hands off to exactly the same commodity payload as the crudest botnet on the floor.

Its captured command sequences include the now-familiar persistence chain: chmod 777 meowarm64, ./meow, useradd -m -s /bin/bash admin1, echo user1:modzmodz | chpasswd — the multi-architecture meow loader and the modzmodz marker documented in The Payload (075K) and The First Move (075F). The delivery engine is state-of-the-art; the thing it delivers is the same reused miner/loader everyone else drops.

This is the decoupling The Payload established, seen from the delivery side: delivery sophistication does not predict payload sophistication. They are separate weapons bought in separate markets. An operator can build or rent a professional, Go-engineered scanner and still hand the foothold to the commodity monetisation floor — and that, the evidence suggests, is the common case. Better tooling, identical outcome. The swarm's advantage is in acquiring footholds faster and more portably; what it does with them is off-the-shelf.

The armory keeps pace with the state of the art

Zoom out and the Go swarm is the series' thesis moved one generation forward.

Go's x/crypto/ssh is blameless, production-grade, defender-owned library code. Its virtues — portability, concurrency, deployment simplicity — are the virtues that make it excellent infrastructure code, which is precisely why they also make it excellent scanner code. The same qualities serve Kubernetes and the swarm equally, because it is the same library. As the legitimate toolchain evolves toward Go, the armory evolves with it, not because attackers invented a new weapon but because the armory is the legitimate toolchain, tracking the state of the art in real time.

That is why the language migration is not a new threat class to be met with a new signature. It is the open armory keeping current. You cannot ban Go, or x/crypto/ssh, or static binaries, without banning the modern internet's own plumbing. What you can do is read the migration as the maturity signal it is: a SSH-2.0-Go banner, the 16443846 HASSH, the million-descriptor ulimit, the database credential list — these mark a more engineered, higher-concurrency, infrastructure-hunting tier than the legacy fleets, and the share of the population wearing them is a leading indicator of where the whole offense is heading.

Reading the swarm — for defenders

• Treat Go as a maturity marker. A SSH-2.0-Go client (HASSH 16443846) is a more engineered, higher-concurrency operation than the C/Python legacy fleets. Monitor the Go share of your attack surface as a trend line for the offense's professionalisation.
• The engineering tells are behavioural IOCs. ulimit -n 1020000 and echo SHELL_TEST cluster the sophisticated Go tier apart from the commodity floor even without the HASSH.
• The magazine names the prey — and it is your backend. postgres, oracle, git, dev, trader, root:ankurkudintzi: this swarm hunts servers, databases, and developer infrastructure, not IoT. Defenders of that infrastructure are its specific concern.
• Decouple delivery from payload. Professional delivery + commodity payload is the norm. Detect the Go tier and the meow payload as separate weapons; do not infer one's danger from the other's.
• Do not chase the language. The armory tracks the legitimate ecosystem; banning a toolchain is incoherent. Detect on fingerprint and behaviour, which survive the generational churn.

The census froze a moment. This letter shows that moment moving — the arsenal quietly re-tooling in Go, one generation ahead of the fleets around it, for the same reasons the defenders re-tooled in Go a few years before. The frontier of the armory is not a secret weapon. It is the same weapon the whole industry is switching to, pointed the other way.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-075A — The Armory: What 12,000 Attackers Carry — the census in which the Go swarm is the third-largest tool.
• TI-2026-050A — The Other Swarm — the Go-vs-libssh engineering ecosystem in depth (toolmaker angle).
• TI-2026-075K — The Payload — the commodity meow round this modern delivery tool drops.
• TI-2026-075H — The Resident — portability solved with a portable script; here it is solved with cross-compilation.
• TI-2026-075I — The Weapon Is Never the Point — the synthesis: the armory is the legitimate toolchain, tracking the state of the art.

This dossier documents observed adversary infrastructure and behaviour for defensive purposes. Go and its x/crypto/ssh library are legitimate, dual-use software; nothing here attributes criminality to a language or library, only to the non-consensual act of scanning strangers. TLP:WHITE.