LSN โ€” Local Sovereign Network

The Dispossessed: A Census of the Brood

The Raspberry Worm โ€” Part 5

Classification: HIGH ยท Confidence: MEDIUM-HIGH (first-party credential census; provider-type inference)

Part 1 called the victim the attacker, because a compromised Pi that scp-pushes the worm onward is both at once. Part 2 watched the brood spread. Parts 3 and 4 followed the command channel and the operator's key. This final letter turns from the code and the controller to the conscripts โ€” the machines actually running the loop โ€” and asks the one question the series has circled without answering: who are they?

The answer reframes everything that came before. The Raspberry Worm's brood is not, in the main, a collection of attackers. It is a collection of victims โ€” hijacked home routers, telecom modems, and small-office Linux boxes scattered across the developing world, each one owned by someone who does not know their device now belongs to a botnet, each one attacking the rest of the internet against its owner's will. A minority of the brood is deliberately-rented weaponry. The majority is the dispossessed: people's own devices, turned against people, by a worm that changed the locks and never told them.

The propagation surface, and when it opened

The observable brood is measured through a single credential. The worm spreads by guessing pi:raspberry โ€” the Raspberry Pi factory default โ€” and every host running its propagation loop appears at the honeypot as an attempt on exactly that login. The honeypot's credential ledger reports 83 distinct source addresses trying pi:raspberry, across 78 active days, and the first attempt is dated 2026-03-25.

That date is the corroboration that ties this letter to the last. Part 4 established that the operator's four-month campaign โ€” thirteen key-matched builds โ€” began with its first captured sample on 2026-03-25. The propagation surface opened on the same day. The worm and its spread are not two phenomena that happen to coincide; they are one, observed from two instruments โ€” the sample corpus and the credential ledger โ€” that independently place the campaign's birth on the same date. From that day the brood knocked at this one perimeter, on and off, for the entire life of the campaign.

The census: eighty percent victims, twenty percent weapons

Resolving the brood's addresses to the networks that own them sorts them cleanly into two populations, and the ratio is the heart of this letter. Of the fifty brood addresses that resolve cleanly, forty sit on residential, mobile, and telecom ISPs; ten sit on hosting and cloud providers โ€” roughly four to one, victims to weapons.

The distinction is an inference, but a strong and standard one. An attacker does not rent a home broadband line in Peru or a mobile connection in Indonesia to launch attacks from โ€” those addresses are behind carrier-grade NAT, dynamically assigned, and useless as controllable infrastructure. When a Rostelecom subscriber line, a China Unicom broadband address, or a Telkomsel mobile IP is running an automated pi:raspberry scp-propagation loop, the overwhelmingly likely explanation is not that a criminal chose to operate there, but that a device on that connection was compromised and conscripted. Conversely, a DigitalOcean droplet or a bulletproof-host VPS running the same loop is exactly the controllable, disposable infrastructure an operator does choose โ€” a deliberately-rented spreader, not a hijacked bystander. The provider type is the tell: residential and telecom means victim; hosting and cloud means weapon.

Neither population is small in what it says. Forty conscripted devices in a fifty-address sample means the brood this perimeter sees is, to about four-fifths, made of other people's compromised machines. The botnet is mostly its own casualties.

Why a home line proves a victim

The inference that a residential or telecom address is a conscripted victim rather than a chosen operating point deserves its technical footing, because the whole reading of this census rests on it. Three properties of consumer network access make such an address nearly useless to an attacker as infrastructure, and therefore nearly certain as a victim.

First, dynamic assignment: consumer IPs are handed out by the carrier's DHCP and change โ€” sometimes daily, sometimes per-reconnect. An operator wants infrastructure they can return to; an address that may belong to a different subscriber tomorrow is worthless for anything the operator needs to control or find again. Second, carrier-grade NAT: most mobile and much residential access now sits behind CGNAT, where hundreds or thousands of subscribers share a handful of public addresses and no unsolicited inbound connection can reach any specific device. You cannot host a service, a panel, or a reachable bot on such a line; it can only make outbound connections โ€” which is exactly, and only, what a compromised device running a scanning loop does. Third, the economics: an operator who wants launch points buys cloud instances at cents an hour with clean outbound bandwidth and an API to script them, because that is cheaper, faster, and more controllable than somehow renting a stranger's Peruvian broadband line would ever be.

Put together, these mean a Rostelecom subscriber address or a Telkomsel mobile IP running an automated pi:raspberry propagation loop is not a place an attacker would choose to be โ€” it is a place an attacker's malware ends up when it compromises a device that happens to live there. The residential and telecom addresses in this census are not where the operator works; they are where the operator's victims live. That is the basis for reading four-fifths of the brood as the dispossessed, and it is a strong one.

The dispossessed: a map of the Global South

Read the victim population by geography and it is a map of where unmanaged Linux devices and unchanged default passwords cluster โ€” which is to say, a map of the world's least-defended networks. Among the fifty are subscriber and carrier addresses in Indonesia (heavily โ€” PT Aplikanusa Lintasarta, PT Global Media Data Prima, PT Adau Putra Network, and Telkomsel mobile all appear), China (China Unicom, China Telecom), Russia (Rostelecom), Taiwan (HINET), Saudi Arabia (Saudi Telecom), Peru (Red Cientรญfica Peruana), Colombia (UNE EPM), Germany (wilhelm.tel and BITel regional broadband), and Argentina. The Argentine address is the one that should stay with a reader: it belongs to the Municipality of Malagueรฑo, a small-town local government. Somewhere in a municipal office, a Linux device โ€” a Pi, a controller, a cheap server โ€” was plugged in with its default password intact, and it now spends its cycles scanning the internet for the next Pi to infect, on behalf of a stranger in an IRC channel, funded unwittingly by a town's electricity bill.

That is the texture of the dispossessed majority: not hackers, not infrastructure, but the ordinary under-defended edge of the internet โ€” home connections, mobile phones, regional ISPs, a town hall. These are the people Part 2's usermod line dispossesses, quantified into a population. Each of them, right now, is simultaneously a victim whose device was stolen and an attacker striking at everyone else's, and neither half of that sentence cancels the other. They did nothing but leave a password unchanged, and for that they were conscripted into a four-month campaign they will almost certainly never learn they joined.

Why the edge, and why Indonesia

The geography is not random, and its logic is the whole reason a worm this crude still works in 2026. The Raspberry Worm hunts exactly one weakness โ€” a device reachable with the Raspberry Pi factory default pi:raspberry โ€” and its brood therefore maps precisely onto the places where such devices are most common and least tended. Those are not the hardened enterprise networks of the wealthy internet; they are the fast-growing, cost-sensitive edges where cheap single-board computers and unmanaged Linux appliances are deployed by the million, often by people for whom the device is a tool, not a system to be secured, and for whom "change the default password" was never part of the setup.

Indonesia's prominence in this sample โ€” four distinct Indonesian networks among fifty addresses โ€” is the clearest instance. It is one of the largest and fastest-growing consumer-internet populations on earth, with an enormous installed base of inexpensive routers, IoT gear, and hobbyist and small-business Linux devices, a great many shipped with defaults intact and never changed. The same forces put China, the Global South, and the regional-ISP edge of Europe on the map: wherever the ratio of connected Linux devices to people who harden Linux devices is high, the worm finds soil. This is the quiet reason default-credential worms never die. The technique is decades old and trivially preventable, and it persists undefeated because the population of unchanged defaults is not shrinking โ€” it is growing, device by cheap device, at the exact edges of the internet least equipped to notice. The worm is not clever about geography; it simply follows the defaults, and the defaults lead here.

There is a bitter equity dimension in that. The victims are concentrated among the least-resourced users of the internet, and the harm flows outward from them to everyone else โ€” their stolen devices attack the whole world โ€” while the cost of their compromise, the bandwidth and the electricity and the eventual cleanup, falls on them alone. The worm is a small engine for converting the under-defense of the poor into an attack on the well-defended, and leaving the bill with the poor.

The weapons: rented, disposable, and already on file

The other fifth of the brood is a different animal entirely, and a familiar one. The hosting-and-cloud spreaders include DigitalOcean droplets, a Linode/Akamai node, a Fiba Cloud instance, a SPARKED Host box โ€” and two names this investigation has met before under other headings. One is VPS Dedicated LLC, whose block earned a full subnet ban in the companion Recidivists series for an SSH brute-force fleet. The other is DMZHOST / TECHOFF SRV LIMITED, the bulletproof host that was itself the subject of an entire earlier investigation. The same rented, abuse-tolerant infrastructure that the rest of this estate's threat intelligence has documented spreading web attacks and hosting bulletproof clients is also, here, spreading the Raspberry Worm.

That overlap is worth naming plainly, because it collapses a distinction that is easy to keep artificially separate. The "web threats" of the Recidivists series and the "malware" of the Raspberry Worm series are not two different underworlds; they are the same rented infrastructure serving multiple lines of business. A bulletproof VPS is a general-purpose criminal tool โ€” today it fronts an SSH brute-force fleet, tomorrow it seeds a Pi worm, and the address is the same either way. The ten cloud spreaders are the operator's chosen amplifiers: fast, disposable, controllable boxes rented precisely to accelerate a propagation that the conscripted victims perform more slowly and blindly. Where the forty victims spread the worm because they cannot help it, the ten weapons spread it because someone paid for them to.

Both at once: the moral geometry of a worm

The census makes precise a paradox the series has carried since its first letter: in a self-propagating worm, the categories of victim and attacker are not opposed but superimposed. Every one of the eighty percent is, at the same instant, a machine that was robbed and a machine committing robbery. The Municipality of Malagueรฑo's device is a victim of the operator and an attacker of the next unpatched Pi down the line. There is no clean population of "the attacked" to defend and "the attackers" to block, because the same forty addresses are both, and blocking them โ€” which this perimeter does, instantly, on contact โ€” protects the estate without doing a thing for the conscript on the other end, still owned, still locked out, still scanning.

This is the uncomfortable ethics of perimeter defence against a victim-built botnet, and honesty requires sitting in it rather than resolving it. The honeypot's instant ban of every pi:raspberry source (documented in the companion series as the correct response to a non-recidivating flood) is correct for the estate โ€” you cannot let compromised machines in merely because their owners are also victims. But it is not justice for the conscript, and it does not pretend to be. The device in Malagueรฑo remains compromised after this perimeter bans it; the ban protects the door, not the dispossessed. Solving the victim's problem would require reaching the owner โ€” a notification, a remediation, a cleanup โ€” that a honeypot on the far side of the world has no channel to deliver. The most this investigation can do for the eighty percent is name them: to record that the brood is mostly victims, so that the worm is understood as what it is โ€” a machine for turning the under-defended into unwitting weapons โ€” and not mistaken for a population of villains who chose this.

The conscript's lifecycle, and the notification gap

It is worth tracing what actually happens to one of the eighty percent, because the census is a snapshot of a process, and the process is where the cruelty compounds. A device โ€” a Pi on a shelf, a router in a shop, the controller in a town hall โ€” is plugged in with pi:raspberry intact. Some existing member of the brood, sweeping the address space, reaches it and pushes the worm. The worm reboots the device to root (Part 2), changes the pi password to lock the owner out, evicts any rival malware, installs the operator's backdoor key, joins #biret, and begins scanning โ€” turning the victim into a spreader within seconds. From that moment the device does two jobs it was never bought for: it attacks the internet, and it waits for signed commands that could turn it to anything.

The owner, meanwhile, notices nothing, or almost nothing. The device still does whatever it did before, more slowly; the internet bill is a little higher; a reboot happened once that read as a glitch. There is no ransom note, no defacement, no visible symptom โ€” a well-built worm is quiet precisely so the labour keeps flowing. And when, eventually, the device is caught โ€” banned by this perimeter, blocklisted by others, perhaps flagged by the carrier โ€” the ban lands on the victim, not the operator. The conscript accumulates a reputation as an attacker, its address sliding onto abuse feeds, while the hand in #biret that put it there is untouched and pseudonymous. If the device is ever cleaned, it is usually by accident โ€” a reboot that happens to wipe a non-persistent stage, a replacement for unrelated reasons โ€” and a cleaned device with the password still raspberry is simply re-infected on the next sweep. The lifecycle has no natural exit.

The exit that would work is a notification the internet is structurally bad at delivering. Somebody โ€” the honeypot operator, the carrier, a national CERT โ€” knows the Malagueรฑo device is compromised the moment it appears in a log. But there is no reliable channel from that knowledge to the town-hall employee who could unplug it and change the password: the reporting paths are slow, jurisdictional, often ignored, and for a small municipal device almost certainly never walked. This is the notification gap, and it is why victim-built botnets persist for years: the people who can see the compromise and the people who can fix it are separated by an abyss of missing plumbing. This investigation can close a tiny part of it only in the weakest way available โ€” by writing the victims down, so that at least the shape of the harm is on the record even when the remedy cannot reach the harmed.

What holds, and what is bounded

What holds, first-party: the propagation surface is 83 distinct addresses attempting pi:raspberry across 78 active days, first seen 2026-03-25 โ€” read directly from the honeypot's credential ledger, and coincident to the day with the campaign's first captured sample (Part 4). The provider resolutions are from Team Cymru's routing data.

What is inference, not observation: the victim-versus-weapon split rests on provider type, not on inspecting the devices themselves. That a residential or telecom address is a compromised victim rather than a chosen operating point is a strong inference โ€” the economics and the network characteristics make it the overwhelmingly likely reading โ€” but it is an inference, and a small number of the forty could in principle be something else. The four-to-one ratio is drawn from the fifty addresses that resolved cleanly out of the 83; it is a representative sample, not the full census, and the true ratio could shift somewhat with the remainder.

What cannot be confirmed: that each conscripted device is literally a Raspberry Pi. The worm hunts the pi:raspberry credential, which is the Pi factory default โ€” but any Linux host configured with that same login is equally a target, and the honeypot sees the credential, not the hardware. "Raspberry Worm" names the credential it hunts and the lineage it forks, not a certainty about every victim's silicon. The dispossessed are, precisely, devices reachable with the Pi default โ€” most of them very probably Pis, some of them perhaps not.

What is not claimed: the identity of any victim's owner or the operator. The addresses are networks, not people; naming the human behind the Malagueรฑo device, or the hand in #biret, is beyond what routing data and a honeypot can honestly deliver.

Census summary (IOCs)

Cross-references

The Raspberry Worm was built to own nothing, and it succeeded: it rents its spread from unchanged passwords, its command channel from a public IRC network, and its resilience from its victims' own numbers. This census is the last piece of that architecture โ€” the labour force. It is not an army of criminals. It is, four parts in five, a crowd of the robbed, made to do the robbing: a town hall in Argentina, a mobile phone in Indonesia, a broadband line in Peru, each one plugged in and forgotten, each one now a soldier in a war it never enlisted for, holding a rifle it cannot see, aimed at the next machine exactly like itself. The worm's genius and its cruelty are the same fact โ€” that it fights entirely with other people's hands.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Raspberry Worm โ€” 5 / 10 Next โ†’