LSN โ€” Local Sovereign Network

The Operators Behind the Rack: Structure Without a Name

TI-2026-086M ยท Series: The Wardrobe ยท Case 13 ยท Classification: HIGH ยท Confidence: MEDIUM (coordination documented; the principal is a documented absence)

Four cases deferred a question to this one. 086B asked whether the flagship fleet was one operator or a service and answered "not yet." 086D found three national masks in one exploit cluster and stopped at "one operation." 086J tied the web mask to the SSH scanner and drew the line at "convergence, not conspiracy." Each time the honest verdict was: the coordination is real, but the name is not in hand. This case turns the entity graph โ€” the corpus's authority on who-is-whom โ€” directly on the fleets to settle it. The answer is not a name. It is a precise account of why there is no name, and it is more useful than a name would be.

Executive Summary

Point the strongest attribution tool at a web fleet member and it comes back empty. sec_intel_shared_identity on 136.107.160.133 โ€” the Fake-Baiduspider node from 086D โ€” returns no SSH keys, no HASSH, zero identity relationships, confidence low. The gold-standard same-operator signal (a shared SSH host key, 0.90+ confidence) simply does not exist for this node, because a web mask does no SSH from its disposable Google Cloud VM and therefore leaves no key to fingerprint. Ask the graph who operates it and the only answer it can give is "Google LLC" โ€” the cloud registrant. The landlord, not the principal.

Turn the same tool on the SSH side and the picture inverts. The honeypot resolves 23 multi-ASN operator clusters bound by shared SSH keys and authorized_keys โ€” real, provable coordination. The largest, actor-c0fefc598e16, spans 124 IPs across 56 ASNs and 15 countries on one shared host key. Another, actor-6f199858ed7e, spans 81 IPs / 52 ASNs / 29 countries on a shared authorized_key, and its ASN set includes the wardrobe's own GCP home, AS396982, alongside Azure and DigitalOcean, with a geography (Hong Kong, UAE, Russia, Vietnam) that matches the cross-vector hadoop:123123 cluster of 086J.

So the deferred question resolves to a two-level verdict. Coordination: proven. Principal: absent โ€” and absent by design. The wardrobe is neither one operator nor a random crowd. It is a structured crowd: a small number of coordinated operator-populations, provably organised, that chose infrastructure engineered to leave no name above the cloud. The absence of the anchor is the finding.

The Empty Result That Says the Most

Begin with the null. 136.107.160.133 is a real, convicted node โ€” a Fake-Baiduspider member that 086D showed sweeping .env files off the Gitea host, and that the crosslinks flag as multi_layer_blocked: confirmed hostile by MikroTik at L3, CrowdSec at L7, the honeypot at SSH, and the web edge, all four. It is about as thoroughly a known threat as the platform has. And when you ask the attribution engine who is behind it, the answer is nothing:

sec_intel_shared_identity(136.107.160.133)
  hassh:                     []
  ssh_keys:                  []
  shared_ssh_key_ips:        []
  total_identity_relationships: 0
  confidence_level:          low

This is not a gap in coverage; it is a property of the target. SSH keys are the corpus's strongest attribution signal because two IPs presenting the same host key are almost certainly the same operator โ€” a key is generated once and reused. But a web mask never opens an SSH connection. It rents a Google Cloud VM, fires a .env sweep under a forged crawler name, and the instance is torn down. It generates no key, forward-confirms no rDNS, persists nothing. There is, quite literally, no identity marker to collect. The graph's only handle on the node is the registrant of the address โ€” and that resolves, via web_ip_operated_by_org, to Google LLC, the cloud, which tells you the landlord and nothing about the tenant.

This is the mask economy's deepest defence, deeper than any costume: the web fleets are built on infrastructure that is attributable to no one above the cloud. The costume hides who you claim to be; the disposable-VM-with-no-key hides that there is anyone to attribute at all.

The Side That Does Have Keys

If the web masks are ghosts, the SSH side leaves fingerprints โ€” and turning the operator-clustering engine on it shows the coordination the masks conceal. The honeypot resolves 23 operator clusters that span more than one ASN, each bound by an identity signal a random crowd cannot fake:

A shared authorized_key is an operator planting the same persistence key on every box it compromises โ€” an even more deliberate signal than a reused host key, because it is the attacker's own key, chosen and carried. actor-6f199858ed7e is therefore a genuine, coordinated operator-population, and it operates across exactly the clouds the wardrobe uses, in exactly the geography the cross-vector cluster occupies. This is the closest the evidence comes to "the operator behind the rack" โ€” and it is still a cluster ID, not a name.

One Operator, a Service, or a Crowd?

Now the deferred question can be answered precisely, by elimination.

Not one operator. The SSH side is not a single cluster but twenty-three multi-ASN ones, plus more below the size threshold โ€” heterogeneous keys, heterogeneous toolkits (from 086A's HASSH census: libssh scanners, Go_SSH, Paramiko, Hydra, Medusa). No single key or toolkit accounts for the whole wardrobe. Anyone claiming "one crew runs all of this" is over-reading, the error the series has refused since 086A.

Not a random crowd. A shared SSH host key across 56 ASNs, a shared authorized_key across 29 countries, the Shared-Exploit Cluster binding Baidu- and Yandex-masked nodes to one ten-path exploit set (086D), the Vhost Sweep campaigns โ€” these are real coordination structures. Independent, unrelated opportunists do not converge on identical keys and identical path sets. Something organises this.

A structured crowd. The verdict that fits both facts is a small number of coordinated operator-populations โ€” each internally bound by shared keys and toolkits, each running from disposable reputable-cloud tenancy, several of them converging on the same targets (DevOps credentials, 086J) and the same masks (the wardrobe). It is a campaign-shaped thing without a single command node: more organised than a crowd, more plural than an operator. actor-6f199858ed7e is one such population, sitting across the wardrobe's own clouds; the other twenty-two clusters are its neighbours in the same ecosystem. Whether they are separate crews sharing a toolkit vendor, or one crew running compartmentalised infrastructure, is the residual uncertainty โ€” but it is bounded uncertainty between two organised readings, not the open question it was in 086B.

Why the Name Is Absent โ€” and Why That Is the Finding

The instinct, at the end of an attribution case, is to apologise for not producing a name. That instinct is wrong here, because the missing name is not a failure of the investigation; it is a success of the adversary's design, and documenting the design is the more durable result.

The dossier methodology has a rule for exactly this: the mandatory institutional-anchor pass ends with "a documented absence of an anchor is itself a finding." Apply it. For every web fleet, the anchor search runs โ€” RIR registrant, rDNS operator, persistent key, reused credential โ€” and every channel comes back the same way: the registrant is the cloud, the rDNS is absent, the key does not exist, the credential is generic. That is not four dead ends; it is one deliberate architecture. The operators selected disposable VMs on reputable clouds, with no reverse DNS and no persistent SSH keys on the web side, precisely because that combination leaves nothing to attribute above the landlord.

So the honest finding is not "we could not identify the operators." It is: the operators are structurally knowable and nominally unknowable, and the gap between the two is engineered. The coordination shows โ€” you can see the shape of the campaign in the shared keys and shared toolkits โ€” but the principal is held in a place the infrastructure guarantees the analyst cannot reach. Naming that guarantee, and the specific infrastructure choices that produce it, tells a defender something a name never could: this class of operator cannot be attributed by these methods, so defence must not depend on attribution. Which is exactly why the rest of the series builds detection and enforcement (the fleet unit, the mismatch score, the autoban) that work without ever needing a name.

Steelmanning: "You gave up too early โ€” push the graph harder"

The fair objection: attribution is patient work, and one empty shared_identity result plus a cluster list is not exhaustive. Passive DNS, malware-sample overlap, OSINT on the credential strings (claude:Claude2026!), timing analysis, registrant pivots on the rare non-cloud node โ€” a determined investigation might yet surface a handle. Is "structured crowd, no name" a conclusion or a stopping point?

It is a conclusion about the web fleets specifically, and it is bounded honestly:

  1. The strongest signal is definitionally absent, not merely unsearched. SSH-key attribution cannot work on nodes that never do SSH; that is structural, not a matter of effort. The web masks are, for the gold-standard method, un-attributable in principle.
  2. The SSH clusters are the harder-pushed result. The 23 operator clusters are what the graph produces when it is pushed โ€” they are coordination, surfaced. The case does not stop at "no name"; it reports the coordination it found and locates the wardrobe inside it (actor-6f199858ed7e).
  3. The residual is named, not hidden. Whether the structured crowd is a toolkit-sharing set of crews or one compartmentalised crew is stated as open, and the pivots that might close it (malware overlap, credential OSINT) are exactly the deep-enrichment work the corpus does elsewhere โ€” a follow-up, flagged, not a pretence of finality.

The objection is right that more can always be pulled; the case's claim is narrower and holds: by the methods that produce reliable attribution, the web wardrobe resolves to a structured crowd on reputable cloud with no principal above the registrant, and that ceiling is a property of the target's infrastructure. Pushing harder is worthwhile and unlikely to change the ceiling.

What Holds, and What Is Bounded

Documented, HIGH confidence: the absence of SSH-key/HASSH markers on the web mask node (total_identity_relationships: 0); the cloud-registrant-only attribution for masks; the existence and scale of the 23 multi-ASN operator clusters, including the 124-IP/56-ASN and the 81-IP/52-ASN shared-key clusters; the latter's inclusion of AS396982 and its HK/UAE/RU/VN geography.

Inferred, MEDIUM confidence: the "structured crowd" synthesis, and specifically that actor-6f199858ed7e is the operator-population behind (part of) the wardrobe rather than a separate SSH operation that merely shares clouds and geography. The cloud + geography overlap is real and specific, but it is circumstantial linkage, not a shared key between a web mask and an SSH node (which cannot exist, since the masks hold no keys). Held as the leading reading; the one-crew-vs-toolkit-vendor fork is explicitly left open.

Why It Matters

The Operators Behind the Rack is the case that resolves the series' running attribution debt, and it resolves it into a shape more honest and more useful than a headline arrest would be. The wardrobe is not a mystery with a name waiting to be found; it is a campaign engineered to have no name to find โ€” coordinated enough to see, anonymous enough to survive, running from clouds whose registrants absorb all the attribution the graph can produce.

That reframes what a defender should want. For a decade, threat intelligence has treated attribution as the goal โ€” find the actor, name the group, indict the person. This case says: against the mask economy, attribution by these methods has a ceiling set by the attacker's infrastructure, and defence cannot wait at that ceiling. What you can have is the coordination structure (the clusters, the shared keys, the shared toolkits), the behaviour (the mismatch score of 086I), the provenance verdict (086E), and the enforcement that acts on all three without a name (086K). The operators built themselves to be unnameable. The answer is not to name them anyway; it is to build a defence that never needed to. The rack has no signature at the top โ€” so you judge it by its shape, and you were always going to have to.

Cross-references

Next in the series โ€” TI-2026-086N, The Long Con: the mask across the corpus's history โ€” how the same tactic evolved from the earliest budget-host impostors through the 059/066/085 cases to the industrialised wardrobe of 086.

TLP:WHITE. Attacker coordination structures only; no principal named because none is supportable. The absence is reported as a deliberate property of the adversary's infrastructure, not asserted attribution.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Wardrobe โ€” 13 / 26 Next โ†’