One Hand, Two Doors: The Cross-Vector Operator

TI-2026-077C · The Laundered Vector, Part C Confidence: MEDIUM-HIGH — cross-vector coordination documented; single-operator count inferred Classification: TLP:WHITE

The question this letter has to earn

Parts A and B established that an attack was laundered through a VPN and that you cannot block the pipe. But they left a claim un-proven, and it is the claim that turns two piles of alerts into one story: that the web attack and the SSH attack are the same operation — one hand reaching through two doors — rather than two unrelated strangers who happened to rent exits from the same VPN.

That is not a claim to assert; it is a claim to earn, with evidence, and to bound honestly where the evidence runs out. This letter does both. It builds the case that the two vectors are coordinated, and then it says plainly where the VPN erases the proof of exactly how coordinated — because the same laundering that hides the attacker's origin also hides how many hands are on the keyboard.

The anchor: one address in both sensors

The single hardest piece of evidence is an address we have already met: 5.183.101.141.

It is not merely on this network. It is in both sensors at once. The web-threats layer recorded it. And the SSH honeypot recorded it too — 18 Cowrie sessions, carrying HASSH 14b2ddda386a4d10, which is libssh2_1.11.0: the same SSH-client fingerprint that identifies the scanner fleet operating across this ASN. Its reputation is severe and comes from outside our own sensors: an AbuseIPDB score of 100 across 454 reports, and a GreyNoise classification of "suspicious." And it carries the pipe signature from Part B — geolocation scattered across Sweden, Denmark, and the United States.

Think about what a dual-sensor hit means. Geography can be laundered (the VPN does it). Reused keys can be erased (we will see the VPN does that too). But an address appearing in two independent sensors, watching two different protocols, carrying the same tooling is not something a pipe can fake or smear. It is direct, physical co-location: the same source reached the web door and the SSH door. One address, both doors, the same tool in its hand. That is the spine of the whole case, and it is the kind of evidence that does not wash out — which also makes 5.183.101.141 a durable IOC, worth pinning and sharing precisely because it survives the VPN's geographic smear.

The sharpest hand on the web

If 5.183.101.141 proves co-location, the web side proves seriousness — that what is coming through these doors is a complete intrusion, not idle scanning.

The standout is 149.22.81.216, and its CrowdSec ban record reads like the table of contents of a break-in. It was autobanned for four distinct intents, and the order tells the story:

• api_enum:5 and admin_hunt:1 — mapping the target: probing the API, hunting for the admin panel.
• credential_harvest:14 — stealing: fourteen attempts to capture login credentials.
• shell_upload:1 — persisting: an attempt to plant a webshell, a backdoor script that would give lasting control.

Independent attack-pattern detection scores its credential-harvesting at 21 events, high confidence. This is not one trick repeated. It is reconnaissance, then theft, then an attempt at persistence — the full opening sequence of a web intrusion, run from a single laundered VPN exit. One hand, doing the whole job, behind a rented flag.

The doctrine that rhymes across protocols

Co-location and seriousness are strong. But the evidence that lifts this from "two attacks on one network" to "one operation on two protocols" is that the two vectors follow the same doctrine — the same operational grammar, expressed in two different languages.

On the web, the sequence is fingerprint, then attack. First the target is identified: cms_detect (84.17.43.213 fifteen times, 178.132.109.237 twenty-seven times) to learn which content-management system is running, and vhost_enum (143.244.47.86) to learn which sites the server hosts. Then it is breached: credential_harvest and shell_upload. Know the target, then hit it.

On SSH, the sequence is scan, then exploit — the exact same shape. First the door is found: libssh2_1.11.0 and libssh2_scanner sweeping for reachable SSH. Then it is worked: a root:blank login attempt, and the TI-2026-005 history-theft worm reading the victim's shell history to exfiltrate it. Find the door, then work it.

Reconnaissance followed by exploitation, on both doors. This is the point often missed in cross-vector analysis: it is not only the infrastructure that is shared (the VPN) but the method — the same recon-then-exploit doctrine playing out in two protocols. Shared infrastructure could be coincidence; two strangers can rent the same VPN. Shared doctrine is much harder to wave away, because it means the two vectors think the same way. The rhyme across protocols is behavioural corroboration that the co-location is coordination.

The graph that ties it together

Underneath the addresses sits the ASN's entity graph: 112 links across 72 peers, tying the attacking IPs together through shared BGP upstreams and common registration — every attacking address announced_by and belongs_to AS212238, and the ASN's routing binding it to a web of upstream providers.

An honest analyst has to weight these correctly. Shared-upstream links are weak on their own — the graph itself rates them around 0.4 confidence — because thousands of unrelated networks share upstreams. They do not, by themselves, prove anything. But that is not the claim. The claim is that the graph is the connective tissue that, combined with the dual-sensor anchor and the shared doctrine, completes a coherent picture: a set of exits on one provider, presenting one behavioural doctrine, at one time, with one address bridging both protocols. No single thread carries the weight; the weave does.

The honest limit: what the VPN erased

Here is where forensic discipline matters most, and where this letter refuses to overclaim.

The Armory built a precise toolkit for proving that scattered addresses are one specific operator. The Key Ring (TI-2026-075U) showed that a reused SSH client key collapses a dispersed fleet to a single hand. The Clock (TI-2026-075W) showed that coordinated timing binds addresses that share nothing else. Those are the signals that turn "a coordinated operation" into "one named operator."

The VPN erases exactly those signals. The SSH key that would tie these sessions to one operator is not correlatable across the pipe's rotating exits — each exit presents differently, and the pipe stands between the honeypot and whatever consistent key the real client might carry. The timing is smeared across exit locations and the VPN's own scheduling. So the two attribution tools that would let us say "this is one person" with high confidence are precisely the ones the laundering removes.

This has a clean, almost poetic consequence: the same laundering that hides the attacker's origin also hides the attacker's count. We can document, at medium-high confidence, that this is a coordinated cross-vector operation — the dual-sensor anchor and the shared doctrine carry that. But whether it is literally one operator, or a small coordinated team, or a tight affiliate group sharing tooling, cannot be proven to high confidence, because the evidence that would settle it was washed away in the pipe. To claim a single named hand here would be to assert past the evidence, and this series does not do that. The coordination is documented. The exact headcount is inferred, and labelled as such.

Why it matters: a single sensor sees half an operator

Step back to the practical stakes, because this is why the cross-vector view is not academic.

Imagine two defence teams. One watches only the web. It sees 149.22.81.216 harvesting credentials, bans it, closes the ticket: a web attacker, handled. The other watches only SSH. It sees libssh scanners and a history worm, bans them, closes the ticket: an SSH problem, handled. Both teams are competent. Both did their jobs. And both missed the same thing: that 5.183.101.141 sits in both their datasets, that the doctrine is shared, and that they were each looking at one half of a single coordinated intrusion.

Protocol-siloed monitoring does not merely lose context. It structurally halves the operator — splitting one coordinated operation into two separate, individually-low-priority nuisances, each small enough to dismiss. The operator gets cross-protocol coverage for free; the defence pays for the silo every time it fails to look across it. This is the exact failure The Cross-Vector (TI-2026-075X) described, and here it is, live, on a real network, right now.

The fix is the one thing neither siloed team did: correlate telemetry across protocols on shared address and ASN. A source that appears in both sensors is one escalation, investigated together — not two tickets closed apart. Do that, and the half-operator becomes a whole one, and the shared doctrine that was invisible from either silo snaps into focus.

The translation, for everybody

In plain terms: someone tried to break in through the front door (the website) and the back door (the remote-login service) at the same time, hiding behind a VPN so you could not tell where they were standing. You can prove it was a coordinated job because one of their tools left the same fingerprint at both doors (5.183.101.141), and because they cased both doors the same way before trying them — looked first, then pushed. What you cannot prove, because the VPN wiped the evidence, is whether it was one burglar or a small crew working together. That is fine to admit. You do not need to know the crew's size to know it was one break-in, coordinated across two doors — and to stop it at both.

Reading the cross-vector — for defenders

• Pin dual-sensor addresses as attribution anchors and durable IOCs. An IP in two protocol sensors with the same tooling is the one cross-vector signal the pipe cannot launder. 5.183.101.141 is the anchor here.
• Compare doctrine across protocols. A shared recon-then-exploit sequence on web and SSH from one ASN is coordination evidence beyond mere co-location — method-matching clusters where infrastructure alone cannot.
• Weight the graph honestly. Shared-upstream links are weak alone (~0.4); they corroborate, they do not prove. Let the weave carry the weight, not any single thread.
• State the headcount uncertainty. The VPN erases the key and timing signals; report cross-vector coordination as documented and single-operator as inferred. Do not overclaim.
• Break the protocol silo. Correlate web and SSH telemetry on shared IP/ASN. One source in both sensors is one escalation, not two dismissible tickets.

The pipe hid where the hand came from and how many hands there were. It could not hide that the same hand touched both doors, or that both doors were cased the same way. Part D turns to the last question: why this pipe — why a reputable, midtier network is the laundering layer an operator like this reaches for.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-077A — The Laundered Vector — the attack and the dual-sensor anchor introduced.
• TI-2026-077B — The Pipe That Hides — why the origin (and here, the headcount) cannot be resolved.
• TI-2026-075X — The Cross-Vector — the operator pattern this letter catches live.
• TI-2026-075U / 075W — The Key Ring / The Clock — the single-hand signals the VPN erases.

This dossier documents a coordinated cross-vector operation laundered through commercial-VPN infrastructure, for defensive purposes. Cross-vector coordination is stated at medium-high confidence on the evidence shown; single-operator attribution is explicitly not claimed, as the laundering erases the signals that would establish it. TLP:WHITE.