The Version Fleets: When the Build Number Is the Cohort

TI-2026-075P · The Armory, Part P Confidence: HIGH — direct honeypot HASSH clustering + multi-source corroboration Classification: TLP:WHITE

The biggest thing in the census has no name

The letters so far have profiled named tools — Hydra, PuTTY, Nmap, Paramiko, the Go swarm. But the largest populations in the census are not named utilities at all. They are raw library versions. And they are enormous.

libssh_0.11.x — HASSH 03a80b21afa810682a776a7d42e5e6fb — spans 1,341 IPs across 84 countries, the single biggest tool population the honeypot has recorded. libssh_0.9.6 — f555226df1963d1d3c09daf865abdc9a — spans 1,312 IPs. libssh2_1.11.0 adds 671; libssh_0.12.0 adds 616. Put the libssh-family fleets together and they are the heaviest slice of the entire attacking population — thousands upon thousands of addresses, each fleet bound by nothing more than the exact version of the SSH library its tool was compiled against.

That binding — a build number holding thousands of unrelated IPs together into a coherent cohort — is the subject of this letter, and it is worth dwelling on, because it explains what a HASSH cluster actually is, and just as importantly, what it is not.

Why a version becomes a fingerprint

The mechanism is simple and unavoidable. A HASSH is a hash of the exact order in which an SSH client offers its algorithms at connection time — key-exchange methods, then ciphers, then MACs, then compression. That order is not something the attacker chooses. It is baked into the library they built their tool on. libssh 0.9.6 offers its algorithms in one specific order; libssh 0.11.x offers them in a slightly different one, because the library changed between releases. The version fixes the handshake.

So everyone on earth who compiled a scanner against libssh 0.9.6 produces the identical HASSH — no matter who they are, no matter where they connect from, no matter what they are trying to do. The version is a cohort marker of extraordinary tightness, and it binds along an axis that has nothing to do with the attacker's identity and everything to do with their toolchain. One libssh_0.11.x build unites 1,341 addresses across 84 countries into a single, coherent tool population. The addresses are scattered across the globe and lie about everything; the compiled library is the same in every one of them and cannot lie at all.

This is why the whole series clusters on fingerprint rather than geography. The version is a real boundary — a genuine cohort of tools built the same way — while the country is noise, an accident of where the operator happened to rent or hijack an address. A defender who deduplicates their attack surface by HASSH sees the true fleet count. One who buckets by country sees an illusion, splitting one build across 84 flags and imagining 84 problems where there is one.

The version splits scanner from botnet

The version fleets do not all behave the same, and — this is the useful part — the way they split tracks the build number itself. libssh_0.9.6 classifies dominantly as botnet. The newer builds — libssh_0.11.x, libssh_0.12.0, libssh2_1.11.0 — classify as scanner. Same library family, different versions, different roles.

That means the build number carries intent information, not just identity. An operator running an old 0.9.6 build is statistically more likely to be enrolling hosts into a botnet; a current-build fleet is more likely to be mapping and credential-testing. It is a weak predictor — a prior, not a rule — but it is a free one, readable from the handshake before a single credential is fired. The version is a role hint stamped into the negotiation, and a defender gets it for the cost of logging the fingerprint they were logging anyway.

Why the split exists is itself interesting: old-build botnets are often abandoned autopilot, seeded once and left to enrol whatever they find, while current-build scanners are the maintained, actively-run reconnaissance operations. Which brings us to the deepest thing the version encodes.

The version is a timestamp

A library version is also a date. libssh 0.9.6 is an old release; 0.11.x and 0.12.0 are recent. So a fleet's build version tells you, roughly, when its tooling was assembled — and whether anyone has touched it since.

Read the census's version spread this way and it becomes a stratigraphy of the offense: geological layers, each one a generation of tooling. The recent builds are the live surface — current operations, maintained, capable of adapting. The old 0.9.6 layer is the fossil record — tooling set loose long ago and never updated, still firing today only because the operator who released it never came back to turn it off. The oldest fleets are running on pure inertia, and their inertia is itself a finding: a fleet on an abandoned build will never change its behaviour, because there is no one left steering it.

For a defender, that distinction is operationally valuable. A shrinking old-build fleet is abandoned autopilot — predictable, static, safe to model as a fixed pattern. A growing current-build fleet is a maintained operation — adaptive, worth watching for changes. The version distribution, tracked over time, tells you which of your attackers are alive and which are ghosts still knocking on the door.

One artifact, not one actor — the essential calibration

The version fleets deliver the single most important calibration for the whole series, and it is a caution against over-reading every other letter. When 1,312 IPs share the libssh_0.9.6 HASSH, that is not one operator with 1,312 machines. Nor is it 1,312 independent, unrelated actors. It is everyone, worldwide, running a tool built on that one library version.

A HASSH cohort, in other words, is a shared compiled artifact, not a shared hand. It is the first and coarsest layer of clustering — it tells you which tools are the same, not which operators are the same. To resolve an individual operator inside a version fleet, you need a second, finer signal layered on top: a reused SSH key that appears from many of the fleet's addresses (the subject of The Key Ring, 075U), a shared credential magazine (075J), tight temporal coordination. The library version alone unites a crowd far too large to be any single actor, and mistaking the crowd for the actor is the one error the version fleets exist to prevent.

This is why the operator letters of this series — the Two-Handed operator (075C), the Tenant (075G) — always rested on a second signal beyond the tool: the tool put them in the right cohort, but a reused key or credential is what pulled the individual out of it. The version fleet is the haystack. The finer signal is the needle. Confusing the two turns a tool census into a false attribution, and the version fleets — 1,341 IPs of one build across 84 countries — are the standing reminder of exactly how big the haystack is.

Reading the version fleets — for defenders

• Cluster and count by HASSH, not country. The library version is the true cohort boundary; geography splits one build across dozens of flags. Deduplicate your attack surface by fingerprint to see the real fleet count.
• Never read a shared HASSH as one operator. It is a tool cohort, possibly thousands strong. To attribute an individual, layer a finer signal — reused key, shared credential magazine, temporal coordination — on top of the version.
• Use the version as a free role-and-liveness prior. Old builds skew botnet and are often abandoned autopilot (static, predictable); current builds skew scanner and are maintained (adaptive). The build number, read as a timestamp, tells you which attackers are alive.
• Watch the version distribution over time. A rising current-build fleet is a maintained operation worth close attention; a fading old-build fleet is a ghost. The stratigraphy is a trend line for the offense's tooling.

The named tools got their own letters because they are legible — a person chose Hydra, a person opened PuTTY. The version fleets are the opposite: the vast, faceless bulk of the armory, thousands of addresses bound not by a choice but by a compile-time accident of which library they linked against. They are the biggest thing in the census, and they teach the humblest lesson in it — that the fingerprint names the tool, and only the tool, and that the hand behind it is always one signal deeper than the crowd.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-075A — The Armory: What 12,000 Attackers Carry — the census whose largest tier is these fleets.
• TI-2026-071H — H is for HASSH — the fingerprint primitive that makes a version a cohort.
• TI-2026-048C — Identity Without an Address — one artifact across many addresses.
• TI-2026-075U — The Key Ring — the finer signal that resolves operators inside a version fleet.
• TI-2026-075C / 075G — Two-Handed / The Tenant — operators pulled out of the cohort by a second signal.

This dossier documents observed adversary tooling for defensive purposes. libssh and libssh2 are legitimate, foundational SSH libraries; their version numbers are cohort markers by nature of the protocol, not by any fault of the projects. TLP:WHITE.