The Key Ring: The Signal That Names the Hand

TI-2026-075U · The Armory, Part U Confidence: HIGH — direct honeypot SSH-key analysis + multi-source corroboration Classification: TLP:WHITE

The needle the haystack exists to find

The Version Fleets (075P) delivered the series' most important caution: a HASSH cohort is a shared compiled artifact, not a shared operator. libssh_0.9.6's 1,312 IPs are everyone running that library — a crowd far too large to be one hand. The tool fingerprint puts an attacker in the right cohort and stops there. It cannot, by itself, name an individual.

This letter is about the signal that can. The honeypot has catalogued 3,735 SSH client keys offered by attackers. The overwhelming majority — 3,425 — are unique, seen from a single source and telling you nothing about who else is out there. But 284 are classified actor_reuse: the identical key presented from many distinct IPs. Twenty-five more are shared_infrastructure keys, and one is a botnet_key seen across a whole fleet.

Those 284-plus reused keys are the whole point, because a key offered from many addresses is one hand wearing many faces. It is the exact thing a dispersed fleet is built to hide — and it is given away for free. If the HASSH is the weapon, the reused key is the hand that holds it, and this letter is about how a single unrotated key turns an anonymous flood into a named operator.

Why the key names the hand and the HASSH does not

The distinction is precise and it is the reason the two signals do different jobs. A HASSH is determined by the library a tool was built against — libssh 0.9.6 negotiates one way, 0.11.x another — so it is shared by everyone who linked that library, regardless of who they are. It is a property of the toolchain, not the person.

An SSH client key is the opposite. It is generated by, and belongs to, the operator who built the toolkit — a secret they created and baked into their client. When the same key appears from a hundred addresses, those hundred addresses are not "a hundred people who happened to use the same library." They are one person's toolkit, cloned and deployed a hundred times, carrying the one personal artifact its author put inside it. The library is common property; the key is not. So the HASSH says these are the same tool, and the key says these are the same operator — and only the second is attribution.

This is the two-layer model the entire series has quietly used. Cluster first on the HASSH to find the cohort; then cluster on the key to find the hand inside it. The tool over-clusters (thousands per fingerprint); the key under-covers (only the operators careless enough to reuse). Neither alone is enough. Layered, they convert a census of weapons into a map of operators.

A free error

Here is what makes the reused key such a gift: avoiding it costs nothing.

Generating a fresh SSH key for every host is a single command that runs in milliseconds. An operator who wanted each of their hundred nodes to carry a different key could have it for free, with no loss of function whatsoever. Reusing one key across the whole fleet buys them nothing except convenience — the toolkit was built once, cloned, and pushed everywhere with the same key already inside. The reuse is not a capability; it is laziness, or habit, or the simple failure to imagine that anyone is looking.

The Key That Didn't Lie (TI-2026-021B) framed this exactly: every key reuse is an opsec budget decision, and the operators who reuse have decided — consciously or not — that nobody correlates keys across providers. The honeypot correlates keys across providers. Each of the 284 reused keys is a standing bet that this correlation would never happen, made by an operator who could have won the bet for free by typing one more command and chose not to. Attribution, at this layer, is simply the collection of everyone who lost that bet.

It collapses the dispersion the operator paid for

The most striking demonstration is what the reused key does to the most expensive obfuscation in the whole series. The Tenant of Fifty-Six Networks (075G) spent real money — 56 hosting relationships across 15 countries — to spread 124 nodes so thin they would read as a crowd of unrelated strangers. The entire architecture was a machine for manufacturing anonymity through dispersion. And a single reused SSH client key collapsed all 124 nodes back to one hand in an instant. The operator paid for a crowd; the key delivered a name.

The Two-Handed operator (075C) fell the same way — a shared authorised key binding a scanner arm and a botnet arm that otherwise looked like two separate operations into one operator running both. The pattern is the series' deepest recurring lesson, and it generalises far beyond SSH: attribution rarely comes from breaking the strong obfuscation. It comes from following the cheap shared thing underneath it. The dispersion, the rented networks, the geographic spread — all of it was defeated not by cracking any of it, but by noticing the one artifact the operator forgot to vary. The reused key is the archetype of that cheap shared thing: the free error at the bottom of the expensive disguise.

The one identity that cannot be cheaply rotated

There is a final property that makes the reused key uniquely valuable to defenders, and it is about durability. Everything else in an operation is disposable by design. The IP address rotates for free — the operator abandons it the moment it is blocked. The banner can be edited in a text field. Even the hosting is rented by the hour. The whole apparatus is built to be thrown away and replaced.

The reused key is the exception. Changing it is not free, because it means rebuilding and re-deploying the toolkit that made the fleet cheap to run in the first place — the very automation and convenience the operator built their operation on. So the key is stable across every provider change, every geography, every IP rotation. It survives the disposability of everything around it.

That stability is exactly what a defender wants. An IP blocklist is obsolete the moment the operator re-rents; a key blocklist survives, because the operator cannot cheaply change the thing being listed. Match on the reused key and a crowd of disposable addresses resolves into one durable, trackable, shareable identity — a cross-victim IOC that follows the operator from provider to provider and from month to month. The key is the one part of the operation the operator cannot make cheap to change, which is precisely why it is the one part worth building your intelligence around.

Reading the key ring — for defenders

• Attribute in two layers. HASSH for the tool cohort, reused client key for the operator inside it. Never stop at the fingerprint; the reused key is what makes an individual findable in a cohort of thousands.
• Hunt the operator's economy, not their obfuscation. A reused key is free to avoid and devastating to reuse, so the operators who reuse are the ones you can catch. Look for the cheap shared artifact under the expensive disguise.
• Treat reused keys as durable IOCs. Unlike IPs, they survive rotation. Blocklist and share key fingerprints in threat intelligence — they cluster operators across victims better than any address.
• Catalogue keys as core infrastructure. SSH-key collection is not a curiosity; it is the layer that converts every tool cohort in your telemetry into operator-level attribution. It is what makes the census a route to people.

The whole series has been a catalogue of weapons — what the attackers carry, how it is built, how it lies. This letter is about the one thing that is not a weapon at all: the small, personal, unrotated artifact an operator leaves inside every copy of their toolkit, the thread that runs beneath all the disposable machinery and ties it, quietly, back to a single hand. The tool census exists to be narrowed. The key ring is what narrows it — the needle the whole haystack was built to make findable.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-075P — The Version Fleets — the cohort the reused key resolves an operator out of.
• TI-2026-021B — The Key That Didn't Lie — key reuse as an opsec budget decision.
• TI-2026-075G / 075C — The Tenant / Two-Handed — dispersed and dual-arm operators collapsed by a reused key.
• TI-2026-048C — Identity Without an Address — the key as the identity that survives address rotation.
• TI-2026-075I — The Weapon Is Never the Point — the synthesis: the weapon is shared, the key names the hand.

This dossier documents observed adversary attribution signals for defensive purposes. Reused-key indicators are published to help defenders cluster operators across victims. TLP:WHITE.