The Cross-Vector: One Operator, Many Protocols

TI-2026-075X · The Armory, Part X Confidence: MEDIUM-HIGH — honeypot entity graph + web-threats correlation Classification: TLP:WHITE

The census has been looking through one window

Every letter of The Armory has read a single vector: the SSH handshake. The whole census — the tools, the fleets, the operators, the fingerprints — is built from what crosses port 22. It is a rich picture, but it is a picture taken through one window, and this letter is about what the other windows show.

Because the offense does not specialise by protocol. The honeypot's entity graph carries a distinct relationship class — multi_vector_operator — that links SSH attackers to a separate attack surface: the web-application layer. The homelab runs two independent sensors. One is the Cowrie SSH honeypot that has generated this entire series. The other is a Layer-7 web-threats record — Traefik access logs joined with CrowdSec decisions — that watches HTTP. They monitor different protocols, and by default they would produce two unrelated pictures of two unrelated sets of attackers.

Except they don't. The same addresses appear in both. And when they do, they reveal something the SSH census alone could never show: that an operator the series has been profiling as an SSH attacker is, from another window, also a web attacker — one hand, working more than one protocol.

Two sensors, one hand

The concrete overlaps are the point. Rented Netherlands and Seychelles nodes — the same TechTies-hosted addresses that appear at the sharp edge of the SSH census (075R), brute-forcing port 22 and hosting their own C2 — also surface in the web-threats record, probing exposed paths and login endpoints over HTTP. 45.156.87.204, seen in the honeypot firing SSH credentials, appears in the web layer testing the doors of web applications. The same IP. The same rented network. The same operator, wielding a credential tool against port 22 and an exploit-probing tool against port 443.

Each sensor sees only half of this. The SSH honeypot sees a credential attack and records an SSH brute-forcer. The web sensor sees the same address probing /.git/config and login pages and records a web scanner. Two sensors, two records, two apparently-separate small nuisances — and neither sensor, alone, contains the fact that binds them: that they are the same coordinated operation seen from two angles. The operator is not one thing the SSH census failed to fully describe. The operator is a larger thing the SSH census could only ever see one face of.

The seam between the sensors

The multi-vector operator is a specific kind of blind spot, and it is worth naming precisely because it is a blind spot of organisation, not of technology.

Most defence is structured by protocol. There is an SSH posture and a web posture; often there are different teams, different tools, different dashboards, different alert queues. Each is competent within its lane. And the multi-vector operator falls exactly into the seam between the lanes — appearing in each queue as a minor, unremarkable event, never assembled into the single, larger, coordinated threat it actually is. The SSH team blocks an SSH brute-forcer; the web team rate-limits a web scanner; both close their ticket; and the operator, who was one hand running a diversified operation, is recorded as two solved nuisances and continues.

The operator is not hiding. There is no cleverness required to be a cross-vector actor — you simply attack more than one protocol, which most serious operators do anyway. The invisibility is entirely on the defender's side, a product of watching each protocol in isolation. The attacker gets cross-protocol coverage for free; the defender pays for the seam every time they fail to look across it.

The same toolkit, applied across the boundary

The good news is that resolving the cross-vector operator requires no new technique. What binds an operator across protocols is the same set of signals the series has already developed to bind them across addresses within a single protocol.

Shared infrastructure: the same rented ASN hosting both the SSH and the web activity — the TechTies network carrying both vectors. Reused keys and credentials: the operator's personal artifacts, appearing on both sides. Coordinated timing (075W): the same activity windows across both protocols. A node that brute-forces SSH and probes web apps from the same address, in the same windows, on the same rented network is one operation by every measure this series has built. Cross-vector correlation is not a new discipline; it is the existing attribution toolkit — HASSH cohorts, reused keys, temporal coordination, shared hosting — applied across the protocol boundary rather than only within it. The defender already owns the primitives. What they need is a joined dataset: SSH and web telemetry read together, so the clustering that already works can reach across the seam.

Vantage, in a second dimension

This is where the cross-vector operator connects to the deepest thesis of the series. The Weapon Is Never the Point (075I) argued that the defender's real edge is not a better weapon but a better vantage — a sensor positioned to see the whole animal when every provider, CERT, and blocklist sees only a sliver. A dispersed fleet (075G) is invisible to any single provider and visible only from a vantage that sees all its addresses.

The cross-vector operator extends that thesis by one dimension. Where the dispersed fleet demanded a vantage across addresses, the multi-vector operator demands a vantage across protocols. Single-protocol vision is just another kind of sliver — the SSH sensor is to the web sensor what OVH's abuse desk is to Hetzner's, each seeing a true but partial fragment of one operation. And the remedy is identical: correlate across the boundary. The whole operator emerges only when the SSH sensor and the web sensor are read as one, exactly as the whole fleet emerged only when all 56 providers' slivers were read as one. The edge was never a sharper tool. It was always a wider field of view — and now that width is in two dimensions, address and protocol.

For the defender, the practical upshot is a capability signal as well as a detection method. An operator who diversifies across protocols is more capable and more committed than the single-protocol commodity floor. Cross-vector presence — the same hand in both sensors — is therefore an escalation trigger: not two low-priority events to close separately, but one higher-priority operation to investigate together.

Reading the cross-vector — for defenders

• Correlate telemetry across protocols. An IP appearing in both your SSH and web sensors is one operator. Treat cross-vector presence as an escalation signal, not two unrelated low-priority events.
• Join the datasets and reuse your clustering. Cross-vector correlation needs no new technique — join SSH and web telemetry on shared IP/ASN/timing and apply the attribution primitives you already have.
• Close the organisational seam. The blind spot is structural: protocol-siloed teams each see half. Build a shared view across protocols so no operator is filed as two separate nuisances.
• Weight multi-vector operators higher. Protocol diversification marks capability and commitment. The same hand in two sensors is a broader operation than either sensor shows alone.

The Armory spent twenty-three letters reading one protocol in extraordinary depth. This letter is the reminder that the protocol was a window, not the whole house — that the operators inside it have other faces, visible from other windows, and that the fullest picture of any of them comes not from looking harder through one pane but from looking through several at once. The weapon says what; the key says who; the clock says when; and the cross-vector says where else — that the SSH attacker you have been watching is, from the next window over, doing something you would only recognise as the same hand if you were watching both.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-075I — The Weapon Is Never the Point — vantage extended from cross-address to cross-protocol.
• TI-2026-075U — The Key Ring — the shared signals that stitch the vectors together.
• TI-2026-075W — The Clock — coordinated timing across protocols.
• TI-2026-075R — The Sharpest Edge — the same self-hosting nodes seen in both sensors.

This dossier documents cross-protocol operator correlation for defensive purposes; cross-vector attribution is stated at medium-high confidence, resting on shared infrastructure and timing rather than a single decisive artifact. TLP:WHITE.