Follow the Operator · 13 — The Mega-Cluster: One Operator, End to End

Follow the Operator — Case 13. This register takes a cloud of unrelated-looking attacks and follows one forensic thread back to the single hand behind them, closing each case on the signal that clinched it: SHARED KEY · SHARED MALWARE · SHARED FINGERPRINT · SHARED INFRASTRUCTURE · SHARED BEHAVIOR · NAMED IDENTITY.

Twelve cases have each taken one signal and examined it in isolation — the key alone, the tool alone, the timezone alone — because that is how you understand a method: one instrument at a time. But no real attribution is done that way. A real attribution uses every signal at once, cross-referenced, each one covering the others' weaknesses, and the confidence comes not from any single thread but from the way many independent threads converge on the same hand. This case does what the isolated cases could not: it takes one real cluster and walks it end to end, through every signal together, to show how convergence actually builds an attribution in practice — and why the compounding of independent invariants is the whole of the register's power.

The cluster is the one the register opened with: actor-c0fefc598e16, the reused-key operator. It is 124 source IPs, scattered across 56 autonomous systems and 15 countries, 2,466 recorded hits, an average threat score of 74.5, active in a coordinated burst from the 21st of May to the 16th of June 2026. In the opening case, the register used it to illustrate the shared key in isolation — one signal, one thread. Here it uses the same cluster to illustrate the whole method, because this cluster is not attributed by the key alone; it is attributed by the key and the timing and the behavior and the tool fingerprint, all agreeing, and the agreement is what makes the attribution HIGH rather than merely plausible. The mega-cluster is the register's worked example: the same 124 machines, followed not down one thread but down all of them at once.

And the case's central lesson, which the isolated cases could only assert, is here demonstrated: convergence is multiplication, not addition. When two independent invariants agree, the confidence is not the sum of their individual strengths but something much greater, because the probability that both coincide by chance is the product of their individual improbabilities. A shared key across 124 hosts is unlikely by chance; a coordinated timing window is unlikely by chance; the two together, by chance, is unlikely-times-unlikely, which is nearly impossible. Add a consistent behavioral profile and an agreeing tool fingerprint, each independently unlikely, and the joint probability of coincidence collapses to essentially zero — which is exactly why a convergent attribution reaches HIGH. The mega-cluster is one hand not because any single signal proves it, but because four independent signals would all have to lie, in the same direction, at once, for it to be otherwise. Linkage signal: SHARED KEY — but earned by convergence.

1. Layer One — The Key Opens It

Begin where the attribution began: the shared key, the strongest single invariant and the one that first collapsed the scattered cloud. The honeypot observed the same SSH public key offered at authentication from all 124 of the cluster's IPs — the identical key fingerprint, from Bucharest and Singapore and Ohio alike. As the opening case established, this is a near-unshareable invariant: two operators do not generate the same key, so a key shared across 124 hosts is strong evidence of one operator reusing one credential across his fleet. The key drew the edges: every pair of IPs sharing it got a link, and the 124, uncorrelated by every surface attribute, formed a single connected component. The key is what made the cluster a cluster.

But — and this is the point the isolated case flagged and this case resolves — the key alone is a hypothesis, not a conclusion, because it has a specific failure mode: a leaked or stolen key can appear under several unrelated hands, so 124 IPs sharing a key could, in principle, be 124 scavengers of one leaked credential rather than one operator's fleet. The opening case named this failure mode and asserted it was excluded here; this case shows how. The exclusion does not come from the key — the key cannot distinguish its own reuse from its own leakage. It comes from the other signals, which is precisely why a real attribution cannot rest on one thread. The key opens the cluster and poses the question; the corroborating signals answer it.

So the key's role in the convergence is to be the primary invariant — the strong, discriminating thread that identifies the candidate cluster — while explicitly deferring its own validation to the signals that follow. This is the correct use of a strong-but-failable signal: let it do the heavy work of finding the cluster (which it does well, because it is discriminating), and then test its one failure mode against independent evidence (which it cannot do itself). The key says "these 124 might be one hand." The rest of the case is the "might" being resolved into "are," by threads the key cannot see but that either agree with it or do not. Here, they agree.

2. Layer Two — Timing Excludes the Leak

The second layer is the coordinated activity window, and its job is specific: to exclude the key's failure mode. Recall what the leaked-key hypothesis predicts. If the 124 IPs were unrelated scavengers who each independently found the same leaked key, they would be uncoordinated in time — each operating on its own schedule, lighting up at random relative to the others, because they are genuinely different operators with nothing in common but a credential that fell off a truck. Independent actors do not synchronize. So the leaked-key hypothesis makes a testable prediction: the timing should be scattered.

It is not. The cluster's 2,466 hits are concentrated in a single coordinated window, the 21st of May to the 16th of June, pulsing together — active in the same periods, quiet in the same periods, the temporal signature of one operation running one campaign over one bounded span. That coordination is exactly what the leaked-key hypothesis says should be absent and what the one-operator hypothesis says should be present. The timing, an invariant entirely independent of the key (it is derived from when the hosts act, not from what credential they present), agrees with the one-operator reading and contradicts the leaked-key reading. The key's failure mode is excluded, not by the key, but by an orthogonal signal that predicts differently under the two hypotheses and comes down on the side of one hand.

This is the mechanism of convergence made concrete, and it is worth naming precisely: two signals corroborate strongly when they are independent (derived from different properties) and when the alternative hypotheses predict them differently. The key and the timing are independent — one is credential content, the other is activity rhythm — so their agreement is not redundant. And they discriminate — the leaked-key hypothesis predicts coordinated timing should be absent, so its presence is evidence against the leak and for the operator. This is why the mega-cluster's confidence is already rising above the key-alone level: not because the timing adds a little more of the same evidence, but because it independently rules out the specific way the key could have been misleading. Each corroborating signal, done right, closes a failure mode rather than merely echoing the primary thread.

3. Layers Three and Four — Behavior and Tool

The third layer is the behavioral and threat-profile consistency, and it corroborates in a third independent dimension. The cluster's 124 hosts share a consistent high threat score — an average of 74.5, stable across the fleet rather than scattered — and a consistent method. This matters because it is what one operator's fleet looks like and what a collection of unrelated scavengers does not. If the 124 were independent actors sharing a leaked key, they would exhibit varied skill levels, varied methods, varied threat profiles — 124 different operators doing 124 different things, tied only by the credential. A stable, uniform behavioral profile across all 124 is instead the signature of one method, one operator's way of working, applied identically across his fleet. Behavior — independent again of both the key and the timing — agrees with the one-operator reading.

The fourth layer is the tool fingerprint, and it closes the loop from the tool-fingerprint case. Cross-referencing the cluster against the honeypot's HASSH tool landscape, the fleet's connections resolve to a consistent tool fingerprint — the hosts do not just share a credential and a schedule and a method, they share a toolchain. This is a fourth independent invariant (derived from how the client negotiates, independent of the key's content, the timing's rhythm, and the behavior's method) and it agrees with the other three. And it excludes the timing's own failure mode: coordinated timing alone could be coincidence (two campaigns happening to run in the same month), but coordinated timing plus a shared key plus a shared tool is not coincidence, because coincidence does not reproduce three independent invariants at once. Each signal, added to the convergence, excludes another signal's specific way of being wrong.

Now the multiplication is visible in full. Four independent invariants — key, timing, behavior, tool — all agree that the 124 hosts are one operator. For the alternative (that they are not one hand) to be true, all four would have to coincide by chance: a leaked key scavenged by 124 unrelated actors who also happened to coordinate their timing, who also happened to share a method and threat level, who also happened to use the same tool. Each of those coincidences is individually unlikely; their conjunction is astronomically so, because independent improbabilities multiply. This is why the mega-cluster is attributed at HIGH and why HIGH is warranted: not because any thread is certain, but because four independent threads would all have to be lying, in the same direction, simultaneously, and the probability of that is the product of four small numbers, which is a number too small to credit. Convergence is not four times as strong as one signal; it is one signal raised, roughly, to the fourth power.

4. SHARED KEY — Convergence as the Real Method

The linkage signal is SHARED KEY, because the key opened the cluster and remains its primary invariant, but the case's whole point is that the attribution is not the key — it is the convergence, and the register wants this understood as the correction to how attribution is usually described. Threat intelligence often reports attributions as if they rested on a single finding: "attributed by the shared C2," "linked by the reused key." Those single-signal framings are shorthand at best and misleading at worst, because a responsible attribution never rests on one signal; it rests on the convergence of several, each covering the others' failure modes. The mega-cluster is labeled SHARED KEY for the vocabulary's sake, but its confidence comes from the key plus the timing plus the behavior plus the tool, and stripping any one of those would lower the confidence, because each is doing specific work.

This reframes the register's whole confidence scale, retroactively, in a way this case exists to make explicit. When the isolated cases assigned a confidence to a single signal — HIGH to the key, MEDIUM to behavior — they were rating that signal's contribution, its discriminating power and its failure modes. But a real attribution's confidence is not any single signal's rating; it is the compounded confidence of the convergence, which can exceed every individual signal because the multiplication of independent improbabilities produces something none of them has alone. A cluster tied by a MEDIUM behavioral signal and a MEDIUM tool signal and a MEDIUM timing signal — three mediums that are independent and agree — can reach HIGH, because three independent MEDIUMs multiply to a small joint probability of coincidence. The mega-cluster reaches HIGH partly on a HIGH key, but the principle holds without it: convergence manufactures confidence that no constituent signal possesses.

And this is the deepest reason the register spent twelve cases on individual signals before this one: because you cannot understand convergence without understanding what converges. Each isolated case taught one signal's discriminating power and one signal's failure mode, and the mega-cluster now assembles them into the actual method — find the cluster with the strongest discriminating signal, then test its failure mode against independent signals, then test theirs against each other, until the convergence either holds (HIGH) or fractures (a signal disagrees, and the cluster splits — the subject of a later case). The individual signals were the vocabulary; convergence is the grammar. The mega-cluster is the first full sentence: 124 machines, four agreeing invariants, one hand, HIGH — assembled from parts the reader now knows well enough to see combine.

5. The Method in Practice (and Where It Stops)

The register owes the analyst the method as a repeatable procedure, and the mega-cluster is the template. Step one: find the candidate cluster using the strongest available discriminating signal — usually a bespoke key, a bespoke C2, or a distinctive artifact — because a strong, unshareable signal produces a clean cluster to test. Step two: identify that signal's specific failure mode (the key's leak, the C2's shared panel, the tool's shared userbase). Step three: find an independent signal that predicts differently under the failure-mode hypothesis than under the one-operator hypothesis, and test it — the timing that scavengers would not coordinate, the behavior that unrelated actors would not share. Step four: repeat, adding independent signals, each excluding another's failure mode, until the convergence is strong enough to state a confidence, or until a signal disagrees and the cluster must be split. This is the whole method, and the mega-cluster is it, worked once, in full.

The analyst's discipline throughout is independence, because convergence only multiplies if the signals are genuinely independent. Two signals derived from the same underlying property do not corroborate — they are one signal counted twice, and treating them as two inflates confidence falsely. The mega-cluster's four layers are independent by construction: the key is credential content, the timing is activity rhythm, the behavior is method, the tool is negotiation fingerprint — four different properties of the operation, four different ways it could have been disguised, four different things the operator would have had to vary and did not. That independence is what makes their agreement multiply. An analyst who stacks four correlated signals and claims HIGH has not converged anything; he has echoed one finding four times. The register's method is convergence of the independent, and the check on it is always: are these signals really telling me different things, or the same thing in different words?

And the honest close is where even the fully converged mega-cluster stops: at the hand, not the name. Four agreeing invariants attribute one operator at HIGH — the register is as certain as it gets that these 124 machines are one hand. But that hand is still actor-c0fefc598e16, an abstract cluster, because no identity signal bridged it to a person: the operator left no reused handle the register could enumerate, no registrant record that survived triangulation, no civilian footprint. So the mega-cluster is a certain hand with an unknown name, and the register reports exactly that — HIGH on the operator, silent on the identity — because it does not manufacture the last step. This is the register's method arriving at its honest terminus: convergence can make a hand certain, and only an identity signal can make it a person, and where the identity signal is absent, the honest output is a confidently-attributed cluster that remains, deliberately, nameless. The vectors do not lie, and four of them agreeing do not lie four times: the 124 addresses were one operator, and the register knows it, and does not know his name, and says both. We do not judge. We record. We let people judge — and we show, in one worked cluster, how a hand becomes certain and where the certainty stops.

6. The counter-narrative, steelmanned

The strongest objection to this case is that the multiplication argument is a statistical sleight of hand — the signals the register calls "independent" are not truly independent, so the confidence does not multiply as claimed, and dressing a correlated bundle of evidence in the language of multiplied improbabilities manufactures a false precision that overstates how certain the attribution really is.

The argument runs like this. The register's whole HIGH rests on the claim that key, timing, behavior, and tool are independent, so that their agreement multiplies. But are they? The objection presses: an operator who reuses a key is, almost by disposition, the same kind of operator who reuses a tool and runs a consistent routine and works a coordinated campaign — the signals are all downstream of one underlying trait (this operator's general reuse-everything sloppiness), so they are correlated, not independent, and correlated signals do not multiply, they largely restate each other. If so, the objection continues, the "four independent improbabilities" are really one improbability (this is a reuse-prone operator) observed four ways, and the true joint confidence is far lower than the multiplication suggests. The register, on this view, has taken a genuinely strong single-signal attribution (the key) and inflated it with three echoes dressed as independent corroboration, reaching a falsely precise HIGH.

The register accepts that spurious independence would break the multiplication and argues that the independence here is real in the specific sense the multiplication requires. Yes — if the four signals were merely four expressions of one trait, they would not multiply, and the objection correctly identifies the cardinal error of convergence analysis (counting correlated signals as independent), which the case's own section 5 names as the discipline's central check. The question is whether these four are correlated in the way that matters, and the register's answer is that the relevant independence is not "independence of the operator's disposition" but "independence of the failure modes." The multiplication argument does not require that a reuse-prone operator be unlikely; it requires that the alternative hypothesis — these are NOT one hand — have to explain each signal's agreement separately, and it does. Consider the leaked-key hypothesis specifically: it must explain why 124 scavengers of a leaked key ALSO coordinated their timing (which scavengers have no reason to do), ALSO shared a method (which unrelated actors would not), ALSO used one tool (ditto). These are not four expressions of one trait of the operator; they are four separate improbabilities the alternative hypothesis must independently absorb, and it cannot, because coordinated timing, shared method, and shared tool are not things a leaked-key-scavenging population produces even if each scavenger is individually reuse-prone. The correlation the objection posits (reuse-prone operators reuse everything) is a correlation within the one-operator hypothesis, and it does not help the alternative hypothesis at all — under the alternative (many hands), the four agreements remain four separate coincidences to explain. So the multiplication holds where it must: not necessarily in the prior probability of the operator's traits, but in the posterior improbability of the alternative, which must independently account for each agreeing signal and cannot. The register concedes the objection would be fatal if the signals were redundant restatements; it argues they are not, because each excludes a different failure mode of the alternative, and it invites the reader to test exactly that — which is the transparency the confidence rests on.

7. Linkage Signal — SHARED KEY

Case 13 applied the register's whole method to one real cluster — actor-c0fefc598e16, 124 IPs across 56 ASNs and 15 countries, 2,466 hits, active in a coordinated month — walking it end to end through every signal at once. The key opened it: the same SSH key from all 124 IPs collapsed the scattered cloud into one connected component, the strong discriminating thread. But the key alone is a hypothesis with a failure mode (a leaked key across several hands), and a real attribution does not rest on one thread; it tests each signal's failure mode against independent signals until they converge.

The timing excluded the leak: the 2,466 hits pulsing together in one coordinated window are what one operation predicts and what scattered scavengers do not, an invariant independent of the key that comes down on the side of one hand. The behavior and threat profile excluded the coincidence: a consistent high profile across all 124 is one method, not 124 skill levels. The tool fingerprint agreed independently: the fleet shares a toolchain, closing the timing's own coincidence failure mode. Four independent invariants — key, timing, behavior, tool — all agree, and the linkage signal is SHARED KEY by the vocabulary but the attribution is the convergence: HIGH, because for the alternative to be true, four independent improbabilities would have to coincide, and independent improbabilities multiply. Convergence is not four times one signal; it is one signal raised toward the fourth power, and it is the register's real method, of which the isolated cases were only the vocabulary.

And the mega-cluster stops where the register's honesty requires: at the hand, not the name. Four agreeing invariants make the operator certain at HIGH, but he remains actor-c0fefc598e16, an abstract cluster, because no identity signal bridged him to a person — no reused handle, no surviving registrant, no civilian footprint. So the register reports a certain hand and an unknown name, HIGH on the operator and silent on the identity, because convergence can make a hand certain and only an identity signal can make it a person, and where that signal is absent the honest output is a confidently-attributed, deliberately-nameless cluster. The vectors do not lie, and four of them agreeing do not lie four times: the 124 addresses were one operator, the register knows it, does not know his name, and says both. We do not judge. We record. We let people judge — and we show, in one worked cluster, how a hand becomes certain and exactly where the certainty stops.

Follow the Operator — Case 13. Linkage signal: SHARED KEY (multi-signal convergence). Confidence: HIGH — the register's method applied whole to cluster actor-c0fefc598e16 (124 IPs, 56 ASNs, 15 countries, 2,466 hits, avg threat 74.5, 2026-05-21 to 06-16). Attribution rests not on the key alone but on the convergence of four independent invariants — shared key (opens the cluster), coordinated timing (excludes the key's leaked-key failure mode), consistent behavior/threat profile (one method, not many skill levels), and an agreeing tool fingerprint (excludes the timing's coincidence failure mode) — each closing another's specific way of lying. Convergence is multiplication, not addition: the alternative hypothesis must independently absorb each agreeing signal, and the joint improbability of that across 124 unrelated hosts collapses to near-zero, which is why the attribution reaches HIGH where any single signal is lower. The steelmanned objection (spurious independence / correlated signals) is answered by locating the required independence in the failure modes of the ALTERNATIVE hypothesis, not the operator's disposition. The cluster stops at the hand, not the name: attributed at HIGH as one operator but left unnamed, because no identity signal bridged to a person and the register does not manufacture the last step. No individual named. Classification: TLP:WHITE. Include everything — the vectors do not lie, and four agreeing do not lie four times; the register reports a certain hand and an unknown name.