The Mapmaker: The Tool That Measures Without Touching

TI-2026-075N · The Armory, Part N Confidence: HIGH — direct honeypot tool classification + multi-source corroboration Classification: TLP:WHITE

A weapon that never fires

Every tool the Armory has catalogued so far does something to the target. The credential fleets fire passwords; the C2 frameworks implant; the payloads mine and enrol. Even the empty-magazine recon of The Ammunition is a login attempt that happens to carry no credential. All of it is, in some sense, an attack — an action taken against the machine on the other end.

One tool in the census is different. Its HASSH — a20aced7c9824fd804f59e68dd801ad3 — belongs to Nmap's ssh2-enum-algos script, and it does not attack at all. It opens the SSH handshake, reads what the server advertises, writes it down, and disconnects. No credential is offered. No command is run. Nothing on the target changes, and nothing is broken into. The classifier, staring at roughly 52 IPs that behave this way, cannot call them attack or botnet, because they do neither. It labels them unknown, dominant behaviour scan — and that label is the whole story. This is not a weapon that misfired. It is a weapon that was never meant to fire, because its job is not to shoot but to measure.

This is the mapmaker: the surveyor's instrument of the armory, the tool that draws the terrain before any army moves. And it is worth its own letter precisely because it is the purest expression of a distinction the whole series keeps circling — the difference between reconnaissance and attack, between the hand that measures and the hand that strikes.

What the survey collects

ssh2-enum-algos harvests one specific thing: the target server's cryptographic posture. When two SSH endpoints connect, they negotiate — each side advertises the key-exchange algorithms it will accept, the ciphers it can use, the message-authentication codes it supports, the compression options it offers. Normally this negotiation is a means to an end, a preamble to an actual session. The mapmaker treats the preamble as the end. It connects only far enough to read the menu, and then it leaves without ordering.

To a planner, that menu is a map. It says what kind of server this is — a modern, hardened stack that offers only current algorithms, or an old, neglected box still advertising deprecated ciphers. It says how the SSH service was configured and roughly how long ago. It reveals whether the target exposes a known-weak primitive worth returning to with a matching exploit. And it tells the operator how to shape a later connection so that it blends into what the server expects. The survey touches nothing, changes nothing, breaks nothing — and hands the operator almost everything they need to decide whether to come back, and how to come back armed.

That is what reconnaissance is: not the break-in, but the intelligence that makes the break-in efficient. The mapmaker is the tool that gathers it, one silent handshake at a time.

The surveyor travels with the army

The mapmaker is rarely alone. The Nmap enum tier's IPs overlap the rented-cloud pentest cluster profiled in The Cloud Contractor (075B) — the same disposable-hosting substrate that carries Hydra, Ncrack, and the libssh2 scanners. And that co-location tells you the order of operations.

It is the classic sequence of any competent operation, criminal or sanctioned: survey the ground first, then move the exploitation tools in. The mapmaker enumerates the crypto posture and identifies which targets are worth the credential auditors' time; then the auditors follow, firing their magazines only at the boxes the survey flagged as promising. Finding an Nmap enumeration tool and credential-attack tools on the same infrastructure is therefore not a coincidence — it is the fingerprint of a staged operation, reconnaissance and exploitation from one toolkit, one operator, one rented shelf.

For a defender, that pairing is an opportunity. An IP that quietly enumerated your crypto today and then went silent is not finished with you; it is a candidate for tomorrow's attack, and the survey was the lead indicator you were given in advance.

The most legitimate tool in the armory

Here the series' central fact reaches its extreme. Of every instrument in the census, the mapmaker is the most purely dual-use — because it is not merely a neutral tool that defenders happen to share, it is a cornerstone of defence itself.

Nmap is the world's standard network mapper. It is taught in every security course, run daily by every blue team, the first tool most defenders reach for to understand their own estate. ssh2-enum-algos is a built-in Nmap script whose intended, documented purpose is exactly what a defender wants: check your own servers for weak or deprecated SSH algorithms before an attacker does. There is no line, at the level of the tool, between the audit and the reconnaissance. A blue team enumerating its own fleet's crypto and an attacker enumerating a stranger's fleet run the identical script and produce the identical handshake. The honeypot cannot tell them apart by the tool, because there is nothing to tell apart — it is the same tool, doing the same measurement.

So the mapmaker is not the exception to The Weapon Is Never the Point (075I); it is that thesis at its sharpest. The most defensive tool in the world and the attacker's reconnaissance instrument are one and the same program, and the only thing that separates them is consent and target — whether the estate being surveyed agreed to be surveyed, and whether it belongs to the person running the survey. Ban Nmap and you blind the defenders who depend on it far more than the attackers who can trivially rebuild the measurement. The tool cannot carry the verdict; only the act of surveying a stranger can.

Measurement is invisible — except in the handshake

The mapmaker poses a specific problem for defence, and it is the same problem the empty magazine posed in The Ammunition (075J). Because the survey never attempts a login, it is invisible to any defence built on authentication failure. It produces no bad-password events. It trips no lockout. It raises no credential alarm. A defender watching their auth logs sees nothing at all, because nothing that shows up in auth logs ever happened.

Its only trace is the handshake itself, and the HASSH within it. The tool announces itself in the negotiation — the one thing it cannot skip, because negotiation is the entire point of the connection — even though it announces itself in nothing else. This is why HASSH-based detection is not a nicety but a necessity: reconnaissance is the quietest hostile activity there is, and the tools that perform it are legible only through the fingerprint they cannot avoid emitting, never through an attack they decline to make.

And catching it matters more than its silence suggests, because reconnaissance is the earliest phase. It comes before the credential spray, before the payload, before the compromise. A defender who can see the survey is being handed a warning that precedes the attack the survey is planning. A defender who watches only for attacks sees the first thing only when it is already too late to have been the first thing.

Reading the mapmaker — for defenders

• Do not depend on authentication-failure detection. The mapmaker leaves no failed logins. Log and cluster connections that negotiate the SSH handshake and disconnect without a login attempt — a survey of your crypto posture is hostile reconnaissance even though it is not an attack.
• HASSH logging is how you see recon at all. Enumeration-only clients (Nmap ssh2-enum-algos, a20aced7) are detectable exclusively by their negotiation fingerprint. Handshake logging is the primary — often only — sensor for the reconnaissance phase.
• Correlate recon with later attack. An IP that enumerated your crypto and went quiet is a candidate for a future attack, especially if it shares infrastructure with known credential tooling. The survey is a lead indicator; treat a silent surveyor as a pending threat.
• Judge the act, not the tool. Nmap is defence's own instrument; its presence is not malicious. Detect the unrequested survey of your estate — consent and target — never the surveying tool, which you also run.

Every other letter in this series is about a tool that does something to its victim. This one is about the tool that does nothing, and learns everything — the quiet handshake that measures your defences without ever testing them, drawing the map that the louder tools will later follow. The army is easy to see. The mapmaker walked through first, and left only a fingerprint.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-075A — The Armory: What 12,000 Attackers Carry — the census's measurement tier.
• TI-2026-075B — The Cloud Contractor — the rented-cloud pentest cluster the mapmaker travels with.
• TI-2026-075J — The Ammunition / TI-2026-075S — The Silent Knock — the same credential-less, HASSH-visible reconnaissance pattern.
• TI-2026-075I — The Weapon Is Never the Point — the dual-use thesis at its extreme: defence's own tool, pointed the other way.

This dossier documents observed adversary behaviour for defensive purposes. Nmap and its NSE scripts are legitimate, cornerstone defensive tools; nothing here attributes criminality to the tool, only to the non-consensual act of surveying a stranger's estate. TLP:WHITE.