Follow the Operator ยท 08 โ The Working Day: The Clock the Operator Cannot Move
Follow the Operator โ Case 08. This register takes a cloud of unrelated-looking attacks and follows one forensic thread back to the single hand behind them, closing each case on the signal that clinched it: SHARED KEY ยท SHARED MALWARE ยท SHARED FINGERPRINT ยท SHARED INFRASTRUCTURE ยท SHARED BEHAVIOR ยท NAMED IDENTITY.
The two preceding cases read the operator's behavior in what he did โ the routine he ran, the wordlist he sprayed. This case, closing the behavioral arc, reads his behavior in when he did it. Every action an operator takes happens at a time, and the honeypot records the time of every one: every connection, every credential attempt, every command, stamped to the second. Accumulate those stamps and a pattern emerges that is not about what the operator does or how, but about his clock โ the hours his operation is active and quiet, the rhythm of its campaigns, the pulse of a working life behind the automation. And that clock, it turns out, is one of the hardest things an operator can hide, because it is not a property of his machines but of himself, and he cannot rent a new self by the hour.
There are two temporal signals here, and the case treats them in ascending order of interest. The first is coordination: scattered IPs that are active in the same windows and quiet in the same windows, that campaign on the same schedule, are behaving as one operation rather than as independent hosts. The honeypot's clusters show this directly โ a cluster whose 2,466 hits concentrate in a single month is not a coincidental convergence of unrelated machines but a coordinated operation pulsing on one schedule. Coordinated timing ties a fleet together the way a shared rhythm ties an orchestra: the instruments are many, but they are playing from one conductor's beat, and the beat is visible in the timing.
The second signal is the more remarkable, and it is the reason this case closes the arc: the working-hours pattern leaks the operator's real timezone, regardless of where his addresses pretend to be. Plot an operator's activity by hour of the day, over enough days, and if there is a human in the loop, a diurnal pattern appears โ busier during his waking, working hours, quieter while he sleeps. That pattern is anchored to the operator's own local time, not his machines' locations, so it reveals the timezone he actually lives and works in, piercing the geographic disguise that scattering his IPs across the world was meant to create. He moved his addresses to fifteen countries; he did not move his bedtime. Linkage signal: SHARED BEHAVIOR, read on the clock โ the one attribute the operator carries in his body rather than in his infrastructure.
1. The Pulse of an Operation
Begin with coordination, because it is the more straightforward of the two temporal signals and the foundation for the second. When the honeypot records activity over time, it does not see a smooth constant hum; it sees structure โ bursts and lulls, campaigns that start and stop, addresses that light up together and go dark together. And that structure is attributive, because independent hosts do not coordinate. If 124 IPs were genuinely 124 unrelated attackers, their activity would be uncorrelated in time โ each on its own schedule, lighting up at random relative to the others. When instead they pulse together โ the same active windows, the same quiet windows, the same campaign start and end โ that temporal correlation is evidence they are not independent but coordinated, driven by one controller on one schedule.
The honeypot's clusters make this concrete. A cluster whose activity concentrates in a tight window โ thousands of hits across a single month, then quiet โ is showing the temporal signature of a campaign: one operation, planned and executed over a bounded period, not a permanent fixture of the landscape. The concentration in time is itself a linking signal, because the alternative (many unrelated operators who happened to all be active in exactly that month and quiet otherwise) is far less likely than one operator running one campaign. Timing, at this level, is a clustering feature like any other: fleets that share a temporal profile โ the same activity windows, the same burst structure, the same campaign schedule โ are more likely one operation than fleets whose timing is uncorrelated.
But coordinated timing, on its own, is a weak signal, and the register is clear about why: time is low-cardinality. There are only so many hours in a day, so many weeks in which a campaign might run, so many plausible schedules โ which means unrelated operators coincidentally share temporal profiles constantly. Two campaigns running in the same month is barely evidence of anything; the internet is busy, and months are not that many. So coordinated timing is used, like shared infrastructure, as a narrowing feature and a corroborator rather than a primary attribution: it strengthens a cluster already tied by a stronger signal (a fleet sharing a key that also pulses on one schedule is more clearly one operation), and it helps separate campaigns within a provider, but it does not, by itself, carry an attribution, because coincidental temporal overlap is too common. The pulse marks the operation; it does not, alone, name it.
2. The Clock in the Body
Now the working-hours signal, which is where temporal analysis becomes genuinely powerful, and it turns on a fact about the operator that no amount of infrastructure can disguise: if there is a human in the loop, that human keeps human hours. An operator does not only launch his automation and walk away; he maintains it, monitors it, troubleshoots it, updates his payloads, responds when things break, checks his takings. That work happens when the operator is awake and working, which is during his own local daytime, in his own timezone โ and it leaves a diurnal signature in the activity, a rhythm of busier and quieter hours that tracks the operator's day, not his machines' locations.
This is the piercing insight, and it is worth stating precisely because it inverts the operator's whole disguise strategy. The operator invests enormous effort in geographic disguise โ scattering his IPs across dozens of countries, precisely so that "where is this attacker" has no answer from the addresses. But the working-hours pattern answers a different and better question: not where are his machines, but where is he. And the answer comes from his own clock, which is anchored to his physical location and his human schedule, both of which are fixed in a way his addresses are not. He can put a machine in Singapore, but if he administers it at what is 2 p.m. in Bucharest and 8 p.m. in Bucharest goes quiet, his activity plotted by hour-of-day peaks on Bucharest's clock, not Singapore's. The addresses say fifteen countries; the working day says one timezone, and the timezone is his.
The mechanism is simple and robust: aggregate all the operator's activity by hour of the day (in UTC), over many days, and look at the shape. A human-operated operation shows a clear diurnal curve โ a peak spanning the operator's working hours, a trough spanning his night โ and the position of that curve on the 24-hour clock implies his timezone. The signal is statistical, emerging from many events over many days, and it is robust to individual exceptions (a late night here, an early start there) because it is the aggregate rhythm that matters. It reveals not a precise location but a timezone band โ a meaningful narrowing, from "anywhere on earth" (which the scattered addresses imply) to "the longitudes where it is working hours during the activity peak." For an operator who has hidden his geography behind his infrastructure, that narrowing is a real and orthogonal blow: it is a signal about him that no manipulation of his machines can touch.
3. Human or Machine
Now the prerequisite distinction that the working-hours signal depends on, because it does not apply universally and mistaking its absence for its presence (or vice versa) is a real error: not every operation has a human in the loop, and only the ones that do leak a timezone. A fully autonomous botnet โ a worm that spreads and attacks with no human intervention, or a mature botnet that runs on its own โ has no diurnal pattern, because there is no human keeping hours behind it. It runs 24/7, flat across the clock, because machines do not sleep. So a flat, round-the-clock activity profile is not a failure of the timezone signal; it is a different finding โ it indicates automation without a human in the loop, an autonomous operation, which is itself worth knowing but which carries no timezone inference because there is no working day to leak.
Telling the two apart is therefore the first step of temporal attribution, and it is done by the shape of the hourly distribution. A diurnal curve โ a clear peak and trough โ indicates a human operator working a shift, and its position gives the timezone. A flat distribution โ activity spread evenly across all 24 hours โ indicates an autonomous system with no human rhythm, and gives no timezone. The distinction is itself informative about the nature of the operation: whether there is a person actively running it or whether it has been set loose to run itself. And it must be made before any timezone claim, because reading a timezone off a flat distribution would be inventing a pattern that is not there, and dismissing a genuine diurnal curve as "just automation" would discard the signal's whole value.
There are complications the honest analyst must weigh, and the register names them. A large operation might run in shifts, with operators in multiple timezones, smearing the diurnal curve into something flatter or multi-peaked โ which is itself a finding (a distributed team, not a lone operator) but complicates the single-timezone inference. An operator might deliberately randomize or shift his active hours to defeat the analysis, though few do, because it means working against his own body clock. And automation between the human's touches can fill the troughs, muting the diurnal signal. So the timezone inference is not automatic; it requires a clean enough diurnal curve, over enough time, with enough human-in-the-loop activity to shape it. When those conditions hold โ and for many human-run operations they do โ the working day is a genuine window onto the operator's location that his infrastructure cannot close. When they do not, the register says so, and does not manufacture a timezone from noise.
4. SHARED BEHAVIOR โ The Orthogonal Signal
The linkage signal is SHARED BEHAVIOR, the temporal reading closing the behavioral arc, and its confidence must be stated in two parts because the two temporal signals differ sharply in value. For one-operator attribution on coordinated timing alone, the confidence is MEDIUM-LOW, for the low-cardinality reason already given: shared activity windows are common by coincidence, so timing ties fleets weakly. But the working-timezone inference, though also weak as a sole attribution (many operators share a timezone), is uniquely valuable as a corroborator, and that value comes from a single property: it is orthogonal to every other signal in the register. Every other thread โ key, tool, malware, infrastructure, routine, wordlist โ is derived from the operator's machines or his software. The timezone is derived from his body. So it adds information that none of the address-and-artifact signals can, and orthogonal information is worth far more than its raw strength suggests.
This orthogonality is why timing earns its place despite its weakness, and it is the case's methodological contribution to the register. When signals are independent, they multiply: a fleet tied by a shared key (HIGH) that also pulses on one coordinated schedule and shows a diurnal curve implying one working timezone is confirmed more strongly than the key alone, because the timezone agreement is not derivable from the key โ it is a separate fact that happens to point the same way. And crucially, the timezone can corroborate across the operator's one successful disguise: if his addresses convincingly span the globe, every address-based signal is fighting that disguise, but the timezone reads straight through it, because it never depended on the addresses in the first place. A weak signal that is orthogonal to a strong one strengthens the strong one more than a second strong-but-correlated signal would, and the working day is exactly such an orthogonal weak signal โ which is why the register keeps it.
And it closes the behavioral arc in a way that is thematically exact, connecting back to the register's affine spine. The behavioral cases have all been about invariants beneath the operator's transformations โ the routine beneath the changed addresses, the wordlist beneath them, and now the clock. But the clock is the deepest invariant of the three, because it is not even a property of the operation; it is a property of the operator as a physical, embodied, sleeping human being. He can rewrite his routine, recurate his wordlist, regenerate his keys, rebuild his tools, rent new addresses in new countries โ every artifact of his operation is, in principle, changeable. His timezone is not, short of him physically relocating or deliberately destroying his own sleep. The working day is the invariant closest to the person, the one transformation the operator cannot apply because it would require transforming himself. The register reads it, weak but orthogonal, as the corroborator that places the human behind all the machines โ the clock he cannot move.
5. Reading the Clock (and Confounding It)
The register owes the analyst and the defender, and the working day gives the analyst a powerful corroborator with strict conditions, and the defender a modest note. For the analyst, the method has three steps. First, classify the rhythm: is the hourly distribution diurnal (human in the loop, timezone available) or flat (autonomous, no timezone)? Do not proceed to a timezone claim on a flat distribution. Second, if diurnal, aggregate enough activity over enough days to establish a stable curve, and read the timezone band from the peak's position on the UTC clock โ reporting a band, not a point, and noting the confounds (shift work, deliberate randomization, automation filling troughs) that widen or blur it. Third, and always, use the result as a corroborator, not a primary attribution: coordinated timing narrows, the timezone corroborates orthogonally, but neither alone attributes an operator, because both are low-cardinality and coincidental overlap is common. The working day confirms a cluster and places its operator; it does not, by itself, build the cluster.
The orthogonality is the analyst's real prize, and it deserves emphasis as a method. When an operator has invested successfully in geographic disguise โ genuinely global, convincingly unrelated addresses โ the address-based signals are all working against that disguise, and may be weakened by it. The timezone reads through the disguise untouched, because it was never about the addresses. So in exactly the cases where geography is most misleading, the working day is most valuable: it is the signal that says "ignore where the machines are; here is when the human works," and for an adversary whose whole disguise is geographic, that is the signal that undoes the disguise from a direction the disguise did not defend. The analyst who has a strong address-based cluster and adds an orthogonal timezone inference has an attribution far more robust than either gives alone โ the machines and the man pointing, independently, the same way.
The defender's note is brief, because the working day is more an analyst's tool than a defender's, but it has one edge and one caution. The edge: temporal anomaly is a detection signal โ an operation whose activity against you tracks a foreign working day, or pulses in coordinated bursts, is a coordinated adversary and not ambient noise, and that shape is worth alerting on. The caution, and the case's closing honesty, is the confound the sophisticated operator can deploy: the working day is defeatable, unlike a person's actual sleep, by putting a machine between the human and the operation. An operator who fully automates, or who schedules his activity to run around the clock regardless of his own hours, flattens his diurnal curve and closes the window โ which is why the register rates timing weak alone and leans on it only as an orthogonal corroborator, present when the operator left a human rhythm and absent when he did not. The working day catches the operator who works like a human and did not think to hide it; it does not catch the one who automated himself out of his own timezone. The vectors do not lie, and neither does the clock: fifteen countries said the operator was everywhere, and the working day said he slept in one of them. We do not judge. We record. We let people judge โ and we read, in the rhythm of the operation, the one invariant the operator carries in his body and cannot rent by the hour.
6. The counter-narrative, steelmanned
The strongest objection to this case is that timezone attribution is a party trick that collapses the moment an operator thinks about it โ a diurnal curve is trivially forgeable, easily confounded by automation, and shared by billions of people, so treating "he seems to work Eastern European hours" as an attribution signal is exactly the kind of soft, defeatable inference that gives attribution a bad name.
The argument runs like this. A working-hours pattern, the objection notes, is defeated by a single scheduling decision: an operator who runs his automation on a cron schedule, or who simply lets his botnet run continuously, emits no diurnal curve at all, so the signal is present only for the careless and absent for anyone who thought about it โ meaning it systematically fails against exactly the sophisticated operators attribution most wants to catch. Worse, the objection continues, it is forgeable in the wrong direction: an operator who wants to be misattributed can deliberately work (or schedule) foreign hours, painting a false timezone that points the analyst at the wrong part of the world. And even when genuine, a timezone is shared by every person in a band of longitudes โ hundreds of millions of people โ so it individuates almost nothing. A signal that is absent against the careful, forgeable by the clever, and shared by hundreds of millions when real is not attribution; it is astrology with timestamps.
The register agrees with nearly every factual claim and rejects the conclusion, because the objection is attacking a use of the signal the register explicitly disclaims. Yes โ the diurnal curve is defeatable by automation, forgeable by deliberate off-hours work, and, when real, shared by a whole timezone band; the case asserts all three, in the human-or-machine section (defeated by automation), in the defender's closing caution (forgeable), and in the confidence rating (low-cardinality, shared by many). The register does not claim timezone as a primary attribution or a precise locator; it claims it as a weak, orthogonal corroborator, and every one of the objection's points is a reason the confidence is MEDIUM-LOW and the signal is never used alone โ which is exactly what the case says. On "absent against the careful": true, and the case states that the working day catches the operator who left a human rhythm and not the one who automated it away โ a signal that is honestly present-or-absent, and reported as absent when the curve is flat, is not failing; it is being honest about its scope. On "forgeable": true, and it is named as the sophisticated confound, which is why a timezone inference is offered as corroboration to be weighed, not proof to be trusted, and why a timezone that contradicts strong address-and-artifact signals is a flag for possible deception (the subject of the later false-flag case) rather than an override. On "shared by millions": true, and precisely why timing attributes nothing alone and is valued only for its orthogonality โ a signal that narrows "anywhere on earth" to "one timezone band," independently of the addresses, adds real information to a cluster even though the band contains millions, because it multiplies with the independent signals rather than standing alone. The objection is a correct and complete description of what timezone attribution cannot do; the case claims only what it can โ corroborate, orthogonally, weakly, when a human rhythm is present โ and rates it accordingly. Astrology asserts; the register, here, mostly declines to, and says so.
7. Linkage Signal โ SHARED BEHAVIOR
Case 08 closed the behavioral arc with the operator's clock. The honeypot timestamps every event, so activity becomes a temporal series carrying two signals. Coordinated timing: scattered IPs that pulse together โ active and quiet in the same windows, campaigning on one schedule, as one cluster's 2,466 hits concentrated in a single month โ behave as one coordinated operation, not independent hosts. And the working-hours pattern: a diurnal curve behind the automation whose peak position on the UTC clock implies the operator's real timezone โ a signal anchored to his body, not his machines, that reads straight through the geographic disguise his scattered addresses create. He moved his addresses to fifteen countries; he did not move his sleep.
The linkage signal โ the thread โ is SHARED BEHAVIOR (temporal), and its confidence is two-part: MEDIUM-LOW for one-operator on timing alone, because time is low-cardinality and coincidental overlap is common, but the working-timezone inference is a uniquely valuable corroborator because it is orthogonal to every other signal in the register โ derived from the operator's body, not his infrastructure โ so it multiplies with the address-and-artifact signals rather than duplicating them, and corroborates most exactly where geographic disguise makes the other signals weakest. A prerequisite distinction gates it: a diurnal curve means a human working a shift (timezone available); a flat 24/7 rhythm means an autonomous operation (no timezone), and the register reads a timezone only off a genuine curve, reporting a band not a point and naming the confounds (shift work, deliberate off-hours forgery, automation filling troughs).
The working day is the behavioral arc's deepest invariant, closest to the person: the operator can rewrite his routine, recurate his wordlist, regenerate his keys, rebuild his tools, and rent new addresses, but he cannot cheaply move his timezone, because that would mean transforming himself. It is defeatable โ by the operator who automates himself out of his own clock or deliberately works foreign hours โ which is why the register rates it weak alone and uses it only as an orthogonal corroborator: it catches the operator who worked like a human and did not think to hide it, and honestly reports absence when he did. The vectors do not lie, and neither does the clock: fifteen countries said the operator was everywhere, and the working day said he slept in one of them. We do not judge. We record. We let people judge โ and we read the human behind the machines in the one rhythm he carries in his body.
Follow the Operator โ Case 08. Linkage signal: SHARED BEHAVIOR (temporal). Confidence: MEDIUM-LOW for one-operator on timing alone (low-cardinality; coincidental overlap common), with the working-timezone inference valued as a uniquely orthogonal corroborator โ derived from the operator's body not his infrastructure โ that pierces geographic disguise and multiplies with the address-and-artifact signals. Coordinated activity windows (e.g. a cluster's 2,466 hits in a single month) tie a fleet as one operation; a diurnal hour-of-day curve implies the operator's real timezone, read only off a genuine curve (a flat 24/7 rhythm indicates an autonomous, human-out-of-the-loop operation and carries no timezone). The signal is defeatable (automation, deliberate off-hours forgery, shift work) and shared by a whole timezone band, so it is never a primary or precise attribution โ reported as a band, used only as corroboration, and a timezone contradicting strong signals is flagged as possible deception (the false-flag case). Closes the behavioral arc: the clock is the invariant closest to the person, the one the operator cannot apply a transformation to without transforming himself. The operator cluster is kept abstract; no real individual is named, and presumption of innocence is preserved. Classification: TLP:WHITE. Include everything โ the vectors do not lie, and they do not judge. The reader judges the human behind the machines, in the one rhythm he carries in his body.