LSN โ€” Local Sovereign Network

Borrowed Trust: A Compromised University Gateway on the Attack

TI-2026-084A ยท Borrowed Trust, Part A Confidence: HIGH โ€” the institutional anchor, the gateway role, and the behaviour are documented from reverse DNS, LACNIC, and honeypot telemetry; the true attacking device is behind NAT and is characterised, not named Classification: TLP:WHITE

When the attacker has a good name

Every prior investigation in this corpus has, in one way or another, been about attackers manufacturing respectability โ€” renting a clean IPv6 block, painting a bank's name on a scanner, laundering a VPN exit through a British CDN. The costume series was a study in false identity: the whole trick was to look trustworthy while being nothing of the kind.

This dossier opens a new series about the opposite failure. Here, the attacking address needs no costume, because its identity is genuinely, verifiably trustworthy โ€” and that is exactly the problem. The traffic came from one of Latin America's most respected academic institutions. The address is real. The reputation is earned. And an intruder is wearing it like a stolen coat.

The subject is a single IP, 200.89.69.247, which arrived at the SSH honeypot as an ordinary abuse-100 brute-forcer โ€” until you look up its name, and the name changes everything.

The name: an open engineering network's front gate

Reverse DNS resolves 200.89.69.247 to:

69247-nat-ingenieria-libre.uchile.cl

Read that hostname left to right and it tells you the whole story:

So the address is not a server and not a workstation. It is the shared front gate of an open engineering network โ€” the single public IP through which an entire segment of loosely-governed, open-access university machines reaches the internet. Everything behind it โ€” every lab computer, every student laptop, every unmanaged device on the "libre" net โ€” speaks to the outside world as 200.89.69.247.

That one fact reframes everything the honeypot recorded. The University of Chile is not attacking anyone. A device behind the university's open gateway is โ€” and the gateway lends it the university's face.

What it did: conscription, not theft

Across 2026-06-29 and 2026-06-30, the IP generated 121 honeypot sessions, earning a flat AbuseIPDB 100. Where it presented credentials, it did the least imaginative thing in the attacker's playbook โ€” a sequential weak-password spray against root:

root:123    root:1234    root:12345    root:123456

This is not a targeted operator picking a lock. It is a bot rattling every doorknob on the street, keeping whichever opens. And when the honeypot played along and let it "in," the commands it ran were not a search for anything to steal. They were an inventory:

free -h | head -2      # how much RAM does this box have?
ssh -V                 # which SSH version is it running?
pwd                    # where am I?

Three questions, and they are the questions a conscription tool asks, not a thief. Is there enough memory here to run a miner or hold a bot? Is the SSH version one I can work with? What's my foothold? This is an automated recruiter evaluating a freshly-cracked host for its usefulness as future infrastructure โ€” the same "size the box, keep it if it's worth it" logic seen in botnet loaders, minus the payload the honeypot never let it stage. The behaviour is machine-simple and machine-cold: brute the easy wins, assess the catch, move on. There is no human rummaging here, and no data heist. There is a bot, running on someone else's good name.

Why the shared gate is the whole point

The NAT gateway is not an incidental detail; it is the mechanism of the abuse. Because every device on the open segment egresses through this one public address, the honeypot โ€” and every other target on the internet โ€” sees only 200.89.69.247. The specific compromised machine behind it is invisible: it could be a decade-old lab desktop nobody patches, a student's malware-laden laptop that joined the open WiFi, an IoT sensor with a default password. From the outside, they are indistinguishable, because they all wear the same address.

And that address is trusted. This is the asymmetry that makes borrowed trust dangerous. When a scan arrives from a random budget-host /24, reputation systems and analysts treat it with suspicion by default. When a scan arrives from a top university's registered address space, it inherits a lifetime of institutional goodwill: allowlists that exempt .edu and national-university ranges, reputation feeds that score academic space as low-risk, tired analysts who read uchile.cl and move on. The intruder did not have to build that trust โ€” the way the costume hosts laboriously fake it. It simply had to get onto the open network and let the university's reputation do the rest. The open segment is the soft entry; the institution's good name is the free cover.

The cost lands entirely on the innocent party. The university's single trusted IP absorbs 100% of the reputational damage โ€” 121 abuse reports, a maxed AbuseIPDB score, a place on ban-lists โ€” for whatever one compromised device behind its gate is doing. The institution pays; the intruder hides; and every defender who does block the address ends up blocking a legitimate university's entire open network along with the one bad machine on it.

The inverse of the costume

It is worth stating plainly how this differs from everything before it, because it defines the new series.

The 082 hosts manufactured false identity: they rented clean address space and painted a trustworthy name on it, and the forensic work was to see through the paint to the rented substrate underneath. The lesson there was don't trust the name; check the provenance.

This is the mirror image. Here the name is true โ€” the provenance checks out perfectly, LACNIC and DNS both confirm a real, respected institution โ€” and the danger is precisely that truth. The forensic work is the reverse: not seeing through a fake name, but recognising that a real one has been borrowed. The lesson is the harder one: a trustworthy source IP is not a trustworthy packet. Institutional reputation attaches to an address; it does not attach to the intent of whatever device currently sits behind that address. An open academic gateway can, at any moment, be speaking for its worst-secured machine.

A brief, honest boundary: NAT hides the attacker, and this dossier will not pretend to see through it. We do not know which device behind the gateway is compromised, or how โ€” only that the behaviour reaching the honeypot is an automated brute-force conscription bot, and that it egresses through the university's open engineering gate. The institution is characterised as the abused party, not the attacker, and the individual machine as a compromised host we cannot name from outside. That is the ceiling the evidence sets, and we hold to it.

The one good thing: this is fixable

There is a redemptive difference between this and the offshore costume hosts, and it is worth ending on. VASH KREDIT's abuse desk was a privacy-fronted decoy; VPSVAULT's routed to a Seychelles shell; the whole point of those operations was that no complaint would ever be read. Here, the opposite is true. LACNIC lists a real owner โ€” Universidad de Chile โ€” and a real abuse contact, Alvise Bolsi Rubio (ALB32), reachable through an institution that has every incentive to care about its own reputation. This is not a dead-letter box. It is a remediable incident: someone can find the compromised device on the open segment, clean it, and add the egress filtering that would have stopped it borrowing the university's name in the first place.

That is the defensive value of documenting it โ€” not one more IP to block, but a repeatable case study in a chronically-abused class of infrastructure. Universities run large, open, device-dense networks with thin security staffing and a culture of access; they are, structurally, among the most-borrowed trusted infrastructure on the internet. This is one gateway on one day. The pattern is everywhere.

The translation, for everybody

Imagine a burglar who, instead of hiding his face, drives around in a borrowed university van โ€” the real thing, with the real crest on the door โ€” because a van with a respected university's name on it gets waved through checkpoints that would stop anyone else.

That's what happened here. Someone's device โ€” a lab computer, a laptop that joined the campus open Wi-Fi, a cheap gadget nobody's watching โ€” got taken over, and now it's out on the internet trying every door it can find with the dumbest passwords in the world ("123", "1234"), and whenever one opens it quickly checks "is this machine big enough to be useful to me?" before moving on. It's not stealing from the university; it's using the university's address as a disguise.

And here's the cruel part: because it all comes out through the campus's one shared front gate, the university is the one getting reported to everybody as an attacker โ€” thousands of complaints piling up against a respected school for something one hijacked gadget on its open network is doing. The good news, unlike the shady offshore outfits in earlier chapters, is that this one has a real caretaker with a real phone number who can go find the sick machine and fix it โ€” and lock the gate a little tighter so the next intruder can't borrow the school's good name.

You didn't need the intruder's identity. You needed to read the gate's own sign โ€” and once you did, you knew the school was the victim, not the villain.

Borrowed Trust โ€” Part A

One IP, one maxed abuse score, one respected university whose open engineering gateway was borrowed by a compromised device to spray passwords under an honest name. Not laundered false identity โ€” borrowed genuine trust, the harder problem, because the provenance is real and the danger rides on that reality. A trustworthy source is not a trustworthy packet.

Borrowed Trust begins. When the attacker has a good name, check whether the name is really the one attacking โ€” or just the gate it came through.

Cross-references

This dossier documents abused academic infrastructure for defensive purposes. The University of Chile and its FCFM are characterised as the ABUSED party, not as attackers; the true attacker is a compromised device behind the institution's NAT gateway whose individual identity is not recoverable from external telemetry. A live LACNIC abuse contact exists and the incident is remediable. The named responsible/abuse contact is reproduced from the public LACNIC record for routing/remediation accuracy only. TLP:WHITE.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous Borrowed Trust โ€” 1 / 4 Next โ†’