Follow the Operator · 07 — The Bespoke Wordlist: The Dictionary a Hand Brings

Follow the Operator — Case 07. This register takes a cloud of unrelated-looking attacks and follows one forensic thread back to the single hand behind them, closing each case on the signal that clinched it: SHARED KEY · SHARED MALWARE · SHARED FINGERPRINT · SHARED INFRASTRUCTURE · SHARED BEHAVIOR · NAMED IDENTITY.

The previous case read what an operator does after he is in — the routine he runs on the machine he has taken. This case reads what he brings before he is in: the list of credentials he tries at the door. Every attacker who guesses his way onto a machine arrives with a wordlist, a dictionary of username and password pairs he sprays at the login in the hope one fits. That wordlist is a possession — the operator assembled it, or downloaded it, or curated it over time — and, like the routine, he brings the same one to every door. So the wordlist is a behavioral fingerprint of the pre-access phase, the twin of the post-access routine: not what he does inside, but what he carries to the threshold, captured pair by pair by a sensor that records every guess.

The honeypot records this at enormous scale, which is what makes wordlist attribution possible. It has captured 33,977 unique username:password pairs — drawn from 3,497 distinct usernames and 23,474 distinct passwords — each logged with the source IP that tried it. That corpus is the reference against which any one operator's wordlist can be measured: given the pairs a fleet sprays, the sensor can ask which other IPs sprayed the same pairs, in the same shape, and find the fleets that share a dictionary. The wordlist an operator brings is not a vague impression; it is a specific, recorded set of guesses, and two scattered fleets that bring the same specific set are tied by the dictionary they share.

But the wordlist, like the routine, attributes only in its uncommon parts, and the case must be as disciplined here as it was there. The top of every wordlist is the same: admin:123456, admin:admin, root:root, the handful of pairs that lead every public list and every attacker's dictionary, tried by essentially everyone. A shared common pair is the credential equivalent of shared stock OpenSSH — it ties the whole population together, which is to say it ties no one to anyone. Identity does not live in the head of the credential distribution, where everyone crowds; it lives in the tail, among the 23,474 passwords, where the rare, curated, target-specific entries are — the low-probability strings a public list would not contain and coincidence would not reproduce. Linkage signal: SHARED BEHAVIOR — read on the rare tail, never on the common head.

1. The Wordlist as a Possession

Begin with what a wordlist is, because understanding it as a curated possession is understanding why it attributes. An attacker's credential wordlist is not generated fresh each time; it is a file, a resource he carries from operation to operation, loaded into his brute-forcing or stuffing tool and sprayed at every target. Where it came from varies: he may have downloaded a public list (rockyou, the SecLists collections, a leaked combo dump), he may have assembled one from his own past successes, he may have curated one for a specific kind of target — but whatever its origin, once he has it, it is his working dictionary, and he brings it to every door because rebuilding it per target would be pointless. The wordlist is a stable possession, and stable possessions, reused across a fleet, are exactly what the register attributes on.

The honeypot captures the wordlist in use, pair by pair, which is what makes it evidence rather than inference. When an operator sprays his dictionary at the honeypot's login, the sensor records each attempt — the exact username, the exact password, the source IP, the timing, the order. So the wordlist is not reconstructed from side effects; it is observed directly, the operator's actual dictionary read off his actual attempts, entry by entry, in the sequence he tried them. And because he brings the same wordlist to every one of his machines, the sensor sees the same dictionary sprayed from scattered unrelated IPs — the signature of one operator's list replayed across his fleet, exactly as the command-routine case saw one operator's routine replayed across his.

What makes the wordlist a rich signal, richer in some ways than the routine, is that it has structure at multiple levels, each potentially individuating. There is the content — which pairs are in the list — but there is also the ordering, the sequence in which the operator tries them, which reflects his own prioritization and is often as distinctive as the content itself. There is the shape — how the list combines usernames and passwords, whether it pairs them specifically or sprays every password against every username. And there is the composition — the mix of common and rare, generic and targeted, that reflects how the operator built or curated the list. Two fleets can share a wordlist at any of these levels, and the more levels they share — same rare entries, same ordering, same shape — the stronger the tie, because coincidence would have to reproduce not just a set but a structured, ordered, curated artifact.

2. The Tail Is the Signature

Now the central discipline, which is the credential version of convention-versus-authorship: the attribution lives in the tail of the distribution, not the head, and confusing the two is the way this signal fails. The head — the most-tried pairs — is universal. Every operator tries admin:123456 because it works often enough to be worth trying; every public list leads with it; the honeypot's own most-attempted credential is exactly this. So the head is pure convention: shared by everyone, individuating no one, and clustering on it gathers the entire attacking population into one meaningless blob. An analyst who attributes two fleets to one operator because they both tried root:root has learned nothing, because both fleets, and every other fleet, tried root:root.

The tail is where authorship lives. With 23,474 distinct passwords in the corpus, the vast majority are rare — tried by one IP, or a few, strings that are not on the leading edge of any public list. These rare entries come in flavors that are especially individuating: vendor- or application-specific default credentials (the factory password for a particular router, camera, or database, which only an operator hunting that device would carry); vanity or campaign strings (a password that is a handle, a slogan, a date, an inside reference — authorship in the most literal sense); product-specific accounts (usernames tied to a particular software the operator targets); and simply idiosyncratic passwords that reflect one person's curation. A rare tail entry shared by two scattered fleets is strong evidence they share a wordlist, because the tail is not public convention but private curation — the operator's own additions, which coincidence does not reproduce and a generic public list does not contain.

And the tail's power compounds with quantity, which is the statistical heart of the case. One shared rare entry could be coincidence — two operators independently added the same unusual password. But two fleets sharing many rare tail entries, in the same order, is not coincidence; it is the same list, because the probability of independently converging on a dozen identical low-frequency strings in the same sequence is vanishingly small. This is why the register attributes on the rare tail plus the ordering rather than on any single entry: a single rare match is a lead, a set of rare matches in sequence is a shared dictionary. The analyst subtracts the universal head, examines the rare tail, and clusters on fleets that share not one uncommon guess but a curated, ordered set of them — the signature of one operator's dictionary, worn identically across every address he sprays it from.

3. The Wordlist Maps Intent

Now a property that distinguishes the wordlist from every prior signal and gives it a second payload: it does not only identify the operator, it reveals what he was hunting. A key, a tool, a routine tell you who; a curated wordlist also tells you what for. Because credentials are target-specific — a router's default password is for routers, a database's default account is for databases, a particular application's credential is for that application — the composition of an operator's wordlist is a map of his intended targets. An operator whose tail is thick with IoT-device defaults is hunting IoT devices; one whose list carries database and application credentials is hunting servers; one with credentials specific to a vendor or a region is hunting that vendor or region. The wordlist is a statement of intent, curated by the operator to match his prey, and reading it reads his target set.

This dual payload — identity and intent in one artifact — makes the wordlist unusually valuable, because it connects the attribution to the operation's purpose in a way the other behavioral signals do not. When the register attributes a fleet to one operator on a shared bespoke wordlist, it learns not just that the fleet is one hand's but what that hand is trying to get into, which is exactly the context that makes an attribution actionable — it tells defenders of the targeted class of device that they are in this operator's sights, and it tells analysts what the operation is for. The command routine reveals what the operator does with a machine once he has it (mine it, conscript it); the wordlist reveals what machines he is trying to get in the first place. Together they bracket the operation's intent at both ends — what he hunts and what he does with the catch.

The intent-mapping also sharpens the attribution itself, because a target-specific wordlist is rarer, and rarer is more individuating. A generic wordlist (common pairs plus a public list's tail) is widely shared and weakly attributive. But a wordlist curated for an unusual target — a specific industrial system, a particular application, a niche device — is carried by few operators, because few hunt that target, so sharing it narrows the field sharply toward one hand. The most individuating wordlists are the most specialized ones, precisely because specialization implies curation and curation implies authorship. So the register looks hardest at the operators whose wordlists reveal specific intent, because those are both the most attributable (rare curation) and the most consequential to warn about (specific targets) — identity and intent reinforcing each other in the same rare tail.

4. SHARED BEHAVIOR — The Dictionary Beneath the Disguise

The linkage signal is SHARED BEHAVIOR, the same as the command routine, and the register groups them deliberately because both are the operator's behavior — his working method — rather than his equipment, one before access and one after. Together they define what behavioral attribution is: the recognition that an operator's method, the structured way he does the work, is an invariant beneath his surface disguises, and that it carries his authorship in its uncommon parts. The wordlist is the pre-access half of that method (how he gets in), the routine the post-access half (what he does inside), and an operator who shares both a bespoke wordlist and an idiosyncratic routine with another fleet is very strongly one hand — two behavioral invariants agreeing, each covering a phase the other does not.

On the shareability axis, the wordlist sits where the routine sits — MEDIUM, above shared infrastructure and below the bespoke key — and for the same reason: a wordlist is behavior, and behavior can be copied. A rare, curated, well-ordered wordlist is hard to reproduce by coincidence, which lifts it well above the shareability of a mere tool or a landlord; but it is a file, and files are copied, downloaded, traded, and leaked, which keeps it below the near-unshareable bespoke key. The confidence lives, as always, in the specifics: a wordlist shared only in its common head is worth nothing; a wordlist shared in a rich, rare, ordered tail is worth MEDIUM on its own and more in convergence with the routine and the key. The register scores the shared wordlist by the rarity and structure of what is shared, discounted by the copyability that keeps behavior below credentials.

That copyability is the failure mode the case must name, and it is a specific and important one: the shared public list. Public wordlists exist and are enormously popular — rockyou, the SecLists collections, leaked combo dumps — and thousands of unrelated operators load the same public list into their tools. Two fleets sharing a public list's contents share a download, not a hand, exactly as two fleets running the same leaked toolkit share a script, not an author. So a shared wordlist, on its own, is firmly evidence of a shared list and only conditionally evidence of a shared operator. The register's answer is the same as the routine's: attribute on the parts a public list would not contain — the operator's own curated additions, the vendor-specific and vanity entries, the idiosyncratic ordering — and corroborate with a less-shareable signal before concluding one hand. A shared public wordlist is a weak tie; a shared curated wordlist with rare bespoke entries, plus a shared routine or key, is a strong one, and the difference is entirely in whether the shared content is downloaded or authored.

5. Reading Dictionaries (and Curating Yours)

The register owes the analyst and the defender, and the wordlist gives the analyst a clustering method and the defender both a detection and an intent warning. For the analyst, the method mirrors the routine's: subtract the universal head (the common pairs everyone tries), examine the rare tail, and cluster fleets that share a curated set of low-frequency entries in a consistent order — weighting vendor-specific defaults, vanity strings, and target-specific accounts most heavily, because those are the operator's own curation rather than a public list's. And test the shared-list failure mode explicitly: check whether the shared entries appear in the popular public wordlists, and if the whole tie is public-list content, treat it as a shared download, not a shared hand. Corroborate with a less-shareable signal — the routine, the key — before attributing one operator. Attribute the wordlist on the curated rare entries; attribute the operator on those plus corroboration.

For the defender, the wordlist is a detection surface and, uniquely, an early-warning of intent. As detection: brute-force and stuffing attempts against your login, matched to a known operator's curated wordlist, identify that operator's script hitting you — the same behavioral detection the routine offers, moved to the pre-access phase. As intent warning: the composition of the wordlists hitting your sector tells you what the attackers are hunting, so a defender who sees his device class's specific default credentials appearing in the attempts against him knows he is being specifically targeted, not merely swept — a distinction that changes how urgently he should rotate those exact credentials. The wordlist that attributes the operator to the analyst tells the defender both who is knocking and what they came for, which is more than most signals offer.

The honest bound is the mirror lesson, and it is a real one for defenders and red teams as much as for the criminal operator: your own wordlists and credential-spray patterns are your own fingerprint, and a distinctive dictionary reused across engagements is trackable. But the deeper mirror is for the defender's own credentials: the reason the wordlist works as an attack at all is that the target-specific entries in it are real — real default passwords, real vendor accounts, real credentials that real devices ship with and real operators never change. The operator's curated wordlist is, in a sense, a catalogue of the defensive world's unrotated defaults, and the single most effective response to the whole class of wordlist attacks is to make the operator's dictionary useless by changing every credential it could contain. The register reads the wordlist as an identity and an intent; the defender should read it as a to-do list of exactly which credentials to rotate first. The vectors do not lie, and neither does the dictionary: the same rare tail sprayed from every address said one hand curated it, and the curation said what that hand came to open. We do not judge. We record. We let people judge — and we read, in the operator's own dictionary, both the author who built it and the doors he built it to open.

6. The counter-narrative, steelmanned

The strongest objection to this case is that credential wordlists are the most commoditized, most publicly-shared artifacts in the entire attack surface — everyone downloads the same handful of public lists — so attributing operators by shared wordlist is attributing by the one behavioral signal most guaranteed to be a shared download rather than a shared hand.

The argument runs like this. Wordlists, the objection notes, are public goods: rockyou has been downloaded millions of times, SecLists is on every pentester's disk, leaked combo lists circulate freely, and the whole point of a wordlist is that it is a shared resource nobody authors from scratch. So of course scattered fleets share wordlist content — they all pulled from the same public well. The rare tail the case leans on, the objection continues, is not as private as claimed: the public lists are enormous (rockyou alone has millions of entries), so even a "rare" password that seems bespoke is very likely just a deep entry in a public list that two operators independently reached, and the "curation" the case credits to the operator is really just two people using the same big file. Wordlist attribution, on this view, is the behavioral signal least likely to survive its own failure mode, and treating it as MEDIUM-confidence operator attribution is generous to the point of error.

The register concedes the commodity point fully and locates the disagreement precisely on what "the rare tail" means. Yes — public wordlists are ubiquitous, rockyou and SecLists are on every disk, and a shared wordlist is, by default, evidence of a shared download; the case says exactly this and names the shared-public-list as its defining failure mode. The register does not claim the wordlist as a whole attributes an operator — it claims a specific subset does, and the objection's strongest move (that even rare-seeming entries are just deep public-list entries) is precisely why the case does not attribute on rareness alone but on a particular kind of rareness the public lists do not supply. A router vendor's specific factory default, an application-specific account, a vanity string that reads as a handle or a campaign tag — these are not deep entries in rockyou; they are the operator's own additions, curated for his targets or his identity, and they are exactly what distinguishes an authored list from a downloaded one. The case's discipline is to test that distinction empirically: check the shared entries against the popular public lists, and if the tie dissolves into public-list content, refuse the attribution as a shared download. Where the register attributes at MEDIUM is the residual case — shared entries that are NOT in the public lists, that are target-specific or vanity-specific, shared in a consistent ordering, and corroborated by a less-shareable signal (the routine, the key). The objection correctly demolishes wordlist attribution based on shared content in general; the case never rests there, resting instead on the curated non-public residue plus corroboration, and capping at MEDIUM precisely to encode the commodity risk the objection describes. The objection is the reason the confidence is MEDIUM and the public-list test is mandatory; it is not a reason the residual, corroborated attribution fails.

7. Linkage Signal — SHARED BEHAVIOR

Case 07 read the operator's credential wordlist, the pre-access twin of Case 06's post-access routine. The honeypot records every guess with its source — 33,977 unique pairs from 3,497 usernames and 23,474 passwords — so an operator's dictionary is captured pair by pair as he sprays it, and seen replayed identically across his scattered fleet. The wordlist is a possession, curated and reused, with structure at multiple levels — content, ordering, shape, composition — each potentially individuating, and the more levels two fleets share, the stronger the tie.

The linkage signal — the thread — is SHARED BEHAVIOR, at MEDIUM confidence, and it lives, like the routine, entirely in the distinction between convention and authorship. The universal head (admin:123456, root:root) attributes nothing; identity lives in the tail, among the rare, curated, target-specific entries a public list would not contain and coincidence would not reproduce — weighted by vendor-specific defaults, vanity strings, and idiosyncratic ordering. On the shareability axis the wordlist sits with the routine at MEDIUM, above shared infrastructure and below the bespoke key, because a wordlist is behavior and behavior can be copied. Uniquely, the wordlist carries a second payload: its composition maps intent, revealing what device, application, or region the operator was hunting, so it identifies the hand and its target set at once — and the most specialized wordlists are both the most attributable and the most consequential to warn about.

The failure mode is the shared public list — rockyou, SecLists, a leaked combo — that thousands load, making a shared wordlist a shared download by default; the register answers by attributing on the curated non-public residue plus corroboration, testing shared entries against the public lists, and capping at MEDIUM. For the defender, the wordlist is a detection surface and an intent warning — who is knocking and what they came for — and, most usefully, a to-do list of exactly which credentials to rotate, because the operator's curated tail is a catalogue of the defensive world's unrotated defaults. The vectors do not lie, and neither does the dictionary: the same rare tail sprayed from every address said one hand curated it, and the curation named the doors it was built to open. We do not judge. We record. We let people judge — and we read, in the operator's own dictionary, both the author who built it and what he came to unlock.

Follow the Operator — Case 07. Linkage signal: SHARED BEHAVIOR (credential wordlist). Confidence: MEDIUM — an operator's curated credential dictionary, captured pair by pair by the honeypot (33,977 unique pairs; 3,497 usernames; 23,474 passwords) and seen sprayed identically across scattered IPs, attributed on the rare curated tail (vendor-specific defaults, vanity strings, idiosyncratic ordering) rather than the universal head everyone tries, and corroborated with the routine, key, and HASSH clusters. It sits with the command routine at MEDIUM on the shareability axis — above shared infrastructure, below the bespoke key — because a wordlist is behavior and can be copied. The wordlist carries a second payload, mapping intent: its composition reveals the operator's target set. The failure mode (the shared public list — rockyou, SecLists, leaked combos — a shared download not a shared hand) is named and mandatorily tested by checking shared entries against the public lists, with attribution resting only on the non-public curated residue plus corroboration; the trap is treated directly in the split and false-flag cases. The operator cluster is kept abstract; no real individual is named, and presumption of innocence is preserved. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the author in the dictionary, and the doors the curation was built to open.