The Loader Splits in Two: A Field Guide to Profile-First Reconnaissance Botnets

TI-2026-083D · The Loader's Trail, Part D (capstone) Confidence: HIGH — the command distribution and the per-tier behaviours are directly documented; the two-phase division-of-labour inference is labelled as such. Classification: TLP:WHITE

What the honeypot is actually catching

Three parts into The Loader's Trail, a reflex forms: a loader logs in and drops a payload. That is what 083A/B caught — the Nexus chain, in and out in sixty seconds with its nexus. binary. It is the picture the word "loader" paints.

Then look at the honeypot's own books. Sort every post-login command it has ever recorded into categories, and the shape is startling:

Downloads — the actual act of dropping a payload — are rarer than one in sixty recon commands. The sensor is overwhelmingly being cased, not conscripted. Thousands of intruders log in, look around, and leave without dropping anything at all.

That is not laziness. It is a different operating model, and once you see it you cannot unsee it. The loader is splitting in two: a cheap, disposable reconnaissance tier that fingerprints hosts and reports home, and a separate delivery tier that strikes only the vetted targets, out-of-band, from infrastructure the honeypot never sees. This capstone reads The Loader's Trail as that spectrum — from the crude single-phase drop to the intelligence-led two-phase funnel — using clusters the corpus has already captured at each tier.

Tier 1 — The Scout: log in, read the label, leave

The purest expression of the recon tier lives on AS197170 — TechTies Inc., a Seychelles-registered, Spamhaus-DROP'd bulletproof ASN (documented as an offshore shell in TI-2026-059A). Its nodes do one thing. They brute a login with sprayed credentials — root:toor, root:qwerty, ubuntu:ubuntu, admin:password, test:test — and on success they run exactly one command:

uname -s -v -n -r -m

Then they disconnect. No second command. No download. No persistence. Just the kernel, hostname, and architecture string, grabbed and gone. The client is a Go program (SSH-2.0-Go, shared HASSH 0a07365c…), and the identical behaviour spans 45.153.34.0/24, 45.156.87.0/24 and 91.92.42.0/24, classified botnet/C2, still active as of 2026-07-13.

This is a pure OS-triage beacon. It is not trying to infect the box on this visit; it is filing the box — is this a real Linux host, what kernel, what arch — into a database somewhere, so that a later, separate stage knows what it is dealing with before it spends an exploit or a payload. The Scout is the cheapest possible reconnaissance: one syscall's worth of intelligence, at internet scale, from disposable offshore IPs.

Note on novelty: 059A already documents what AS197170 is — an offshore bulletproof shell. This part reads what its recon tier does, and places that behaviour on the spectrum. We cite the provenance rather than re-litigate it.

Tier 2 — The Appraiser: value the box, and check for watchers

One rung up is the Appraiser of Part C: the DMZHOST cluster on AS47890 (and sister AS48090), another Spamhaus-DROP bulletproof stack. Where the Scout grabs one uname line, the Appraiser runs a ~2KB profiler that harvests the full hardware picture — OS, architecture, CPU model, core count, uptime, login history, and GPU presence (lspci | grep nvidia) — and then does something no earlier tier does: it runs an anti-honeypot shell-authenticity probe, executing nonexistent commands and a write-chmod-exec sentinel to detect that it is talking to an emulated sensor.

And the payoff is identical to the Scout's: across 19 IPs, 2,102 commands, zero downloads. It profiles hundreds of times and drops nothing. The Appraiser adds two capabilities on top of the Scout — compute-value triage (is this box worth taking?) and observation-awareness (am I being watched while I decide?) — but it keeps the defining behaviour of the recon tier: fingerprint, judge, and withhold.

Tier 3 — The Loud Loaders: the crude baseline

The bottom of the spectrum is where the reflex was right. These loaders barely profile and drop at once.

• The Nexus IoT chain (083A/B) fires router-CLI escape verbs at whatever answered, sprays fourteen architectures, and fetches its payload in the same session. No value check, no honeypot check — it takes everything, immediately.
• The mdrfckr / Outlaw miner (TI-2026-008) runs a fixed block: plant an authorized_keys backdoor, evict rivals (rm secure.sh; pkill auth.sh; echo > /etc/hosts.deny), read /proc/cpuinfo and free -m, and immediately pull the kswapd0 miner. It profiles CPU and RAM — but only to size the mining payload it is already dropping on this visit.

Both commit on the first contact. The mdrfckr toolkit is sophisticated in its payload (backdoor + competitor-eviction), but crude in its approach: it never asks whether it should drop here, only what to drop. That distinction — sophistication in the payload versus sophistication in the approach — is the whole point of the spectrum.

The spectrum, on four axes

Lay the tiers against the dimensions that separate them and the progression is monotonic:

Sophistication moves in one direction: from spray-and-drop toward intelligence-led, value-aware, observation-aware, deferred conscription. The more capable the operator, the less the honeypot sees it drop — because the whole design of the upper tiers is to deliver elsewhere, to targets already confirmed real, valuable, and unwatched.

Why this matters: counting payloads undercounts the threat

Here is the sting, and it is a methodological one. A defensive system that scores an IP's hostility by what it drops will rate the Scout and the Appraiser as low-threat — they drop nothing observable. Yet they are among the most sophisticated actors in the entire corpus. The Appraiser literally defeats the honeypot on purpose. Payload-counting systematically under-weights the most advanced tier.

This is the same trap the web-threats pipeline was built to escape. There, a scanner probing /​.env through an Authelia-protected host receives an innocent-looking HTTP 200 login page; score the raw status and it reads as benign, while the real intent hides one layer down in the ?rd= redirect. The SSH recon tiers are the same shape: the raw signal (no download) reads as harmless, while the real intent hides one layer down — in the reconnaissance itself. Depth of profiling and the presence of honeypot-evasion are hostility signals in their own right. To see profile-first operators, score the recon, not the drop.

And this is not brand new — TI-2026-024A (Offshore Bulletproof) caught a Seychelles IP a year of iterations ago that enumerated kernel, ports, writable paths and tunneling tools on a single login while its passive DNS pointed at darknet markets. What 2026 adds is the escalation: value-based (GPU) triage, active honeypot detection, and the organisation of these behaviours into a coherent reconnaissance tier that feeds a separate delivery stage. The shape was always there. It is getting smarter, and it is getting quieter.

Findings

1. The loader is splitting into a recon tier and a delivery tier. (HIGH / inference labelled) — sophisticated operators fingerprint and leave; the drop happens out-of-band.
2. A four-axis spectrum orders the captured loaders from crude to sophisticated. (MEDIUM) — profiling depth, value-awareness, observation-awareness, payload timing.
3. Reconnaissance dwarfs delivery in the honeypot corpus. (HIGH) — recon 3,364 vs downloads 54 vs exfil 9.
4. Counting payloads undercounts the most sophisticated operators. (HIGH) — score the recon, not the drop; the SSH analogue of the 200-mask.
5. [INST] Anti-honeypot detection is an emerging tier capability. (MEDIUM) — the Appraiser's shell-authenticity probe is the frontier.

The Loader's Trail, closed

The trail began with a single loud loader caught mid-drop and ends with the recognition that the loudest loaders are the ones we catch because they are loud. The quiet ones log in, read what you are worth, check whether you are watching, and leave without a trace — and the payload, when it comes, comes from somewhere the sensor was never pointed. The trail runs from the shotgun to the scout, and the scout is already gone by the time you look.

Cross-references

• TI-2026-083A · 083B · 083C — the three loaders this capstone places on the spectrum.
• TI-2026-059A — The Secret Harvest — the provenance of the Scout's ASN (TechTies / Seychelles).
• TI-2026-008 — The Backdoor-Key Harvester — the mdrfckr/Outlaw miner, the sophisticated-payload / crude-approach reference.
• TI-2026-024A — Offshore Bulletproof — the earlier documented shape of offshore recon-and-leave.