The Widest Net Is 389 Bytes: The Honeypot's Real Operator Census

The Toolkit — Part 4

Classification: HIGH · Confidence: HIGH (first-party full-corpus measurement)

The first three letters in this series measured one operator. This one measures all of them — and it opens with the number that reorders the whole picture. The most widely distributed piece of malware the honeypot has ever retained is not the thirty-megabyte Go toolkit that Parts One through Three dissected. It is 389 bytes long. It has no compiled code, no configuration system, no persistence engine, no encryption. It is a single line appended to a file. And it reached one hundred distinct source addresses — more of the internet than any other artifact in the corpus, by a wide margin.

Part Three ended on a promise it did not fully keep. It asserted that the honeypot's retained corpus of 81 samples resolves to roughly six or seven real operators rather than the dozen-plus the classifier's family labels imply, and that one of those operators accounts for 52% of everything. It asserted this from the toolkit's own footprint. It did not turn the same lens on the other half. This letter does. It takes every sample the sensor has retained, extracts from each the one artifact that survives a configuration change but not a change of author, clusters on that artifact, and counts the clusters. The result is a census — not of families, but of hands on the wire.

The census confirms the estimate almost exactly. It also contains three findings that the toolkit investigation could not have produced on its own, because they are only visible when you look at the whole board at once.

The method, stated plainly

A malware family label is a hypothesis about lineage produced by a content classifier reading strings. It is useful and it is cheap and it overcounts operators badly, because one operator's modular platform presents a different string profile every time it is recompiled with a different capability enabled, and the classifier names each profile separately. Part One demonstrated this on the toolkit: ten labels, one build hash. The correction is not to distrust the classifier — it is to add a second axis.

That axis is the durable build artifact: a token stamped into the binary by the build pipeline rather than chosen by the configuration. It changes when the author changes their toolchain or their keys. It does not change when they flip a feature flag. For a Go program it is the cgo build-path hash and the Go build ID. For a signed IRC bot it is the RSA public key plus the protocol verbs. For a Mirai-descended loader it is the multi-architecture family signature and the delivery structure. Extract that token from every sample, cluster on it, and the count of distinct clusters is an honest floor on the number of operators — honest because two operators can share a family label by coincidence, but they cannot share a private key or a build hash without sharing a build machine.

DOCUMENTED, method applied to the full retained corpus: 81 samples in, three dominant clusters and a resolvable tail out.

The three pillars: 83% of the corpus is three operators

The clustering produces three structures that dwarf everything else.

Pillar one — the Go toolkit. Build hash eba3282b571c: 42 samples, 52%. This is the subject of Parts One through Three: one maintained Go platform, one architecture (x86-64), compiled, presets-driven, wearing ten classifier labels from "XMRig" to nine variants of PAM and SSH backdoor. Depth. One operator, one target architecture, four months of continuous release cadence.

Pillar two — the RSA-signed IRC artifact. A single shell artifact of exactly 4,745 bytes, carrying an embedded RSA public key and raw IRC protocol verbs: 14 samples, 17%. Every one of the fourteen is byte-for-byte the same size. This is the self-propagating bash IRC bot catalogued at length in the 087 series — the Raspberry Worm. DOCUMENTED: fourteen retained drops of one 4,745-byte artifact, spanning 2026-03-25 to 2026-07-23, the entire observation window. INFERRED, very high confidence: it is one operator's single script, because a 4,745-byte artifact that is identical in size across fourteen drops and carries the same key-plus-protocol signature is one file, not fourteen authors independently converging on the same byte count.

Pillar three — RedTail. A Mirai-descended multi-architecture miner-loader: 11 samples, 14%. These arrived in two dated waves. On 2026-07-09: five drops — x86, x86-64, aarch64, arm, and a shell loader. On 2026-07-19: six drops — x86, x86-64, aarch64, arm, riscv, and a shell loader. DOCUMENTED: eleven samples under the RedTail family label, structured as two complete multi-architecture delivery sets. INFERRED, high confidence: one operator, because the multi-architecture-wave structure — ship the same payload compiled for every CPU family a victim might have, fronted by one shell loader that picks the right binary — is a single coherent delivery strategy executed twice.

Three pillars. Forty-two plus fourteen plus eleven is sixty-seven of eighty-one — 83% of the corpus is three operators. The honeypot does not have a malware-diversity problem. It has three operators and a thin tail.

The universal law: labels overcount every operator, not just the toolkit

Part One framed the ten-labels-one-hash finding as a property of the toolkit — the price of its modularity. The full census shows it is not special to the toolkit at all. It is a property of content classification itself, and it applies to every operator on the wire.

The 4,745-byte IRC artifact — one file — appears in the corpus under seven distinct family labels: "IRC botnet loader," "IRC Botnet Dropper," "IRC Botnet Loader," "IRC Bot Backdoor," "Bins," and — twice — "XMRig." One file. Seven names. Two of its fourteen instances are filed under the name of a cryptominer it is not.

RedTail is worse in miniature: its shell loader is filed under both "RedTail" and "XMRig" on different drops. The multi-architecture binaries carry the RedTail label; the loader that fetches them sometimes carries a miner's.

This produces a corollary that matters for anyone reading a family-labelled threat feed. The label "XMRig" in this corpus is not evidence of the XMRig miner. Of the corpus's "XMRig"-labelled samples, some are the toolkit (Part Two established the toolkit ships XMRig as one of two bundled miners), some are the IRC worm's dropper, and one is RedTail's loader. "XMRig" is not an operator, not a family, and frequently not even a miner. It is the string-profile of "a script that mentions mining," and at least three different operators trip it.

The law, stated generally: a family-label census overcounts operators by a factor that scales with how modular and how mislabel-prone the population is. On this corpus, the toolkit's ten labels, the worm's seven, and RedTail's two collapse to three operators. Roughly nineteen labels, three hands.

The inversion: the smallest artifact has the widest reach

Now the finding that only the whole-corpus view can produce, and the one that should change how the sensor's operators are ranked.

Rank the corpus by depth — by how much of one operator's output the sensor retained — and the toolkit wins overwhelmingly: 42 samples, a maintained platform, four months of releases. Rank it instead by reach — by how many distinct source addresses delivered a given artifact — and the toolkit does not win. It is not close.

The widest-reaching artifact in the entire corpus is the SSH-key backdoor: 389 bytes, delivered in 107 drops from 100 distinct source IPs, spanning 2026-03-31 to 2026-07-23. One hundred different addresses across four months all delivered the same tiny artifact. Nothing else in the corpus approaches this. The toolkit's individual builds are typically one-IP, one-drop events. The worm's fourteen drops came from a handful of IPs. This 389-byte artifact came from a hundred.

And it is nothing. It is an authorized_keys append — a single public key written to a single file so that the operator can log back in as root without a password, forever, over stock OpenSSH, using no malware at all. There is no binary to fingerprint, no C2 to trace, no persistence engine to reverse, because the persistence engine is sshd itself and it was already installed. The entire program is: put my key here. 389 bytes.

This is the inversion, stated cleanly: sophistication and prevalence are orthogonal. The most sophisticated thing at the sensor — the 30 MB compiled Go platform — is the deepest, and it is the work of one disciplined developer. The most prevalent thing at the sensor — the 389-byte key append — is the shallowest, and it is delivered by a hundred hands, because it needs no skill to deliver and no infrastructure to run. Depth is a property of an author. Reach is a property of a technique. They do not correlate, and a census that ranks only by sample count — as a family-label feed implicitly does — will rank the loudest author first and miss that the widest campaign on the wire is a one-liner anyone can paste.

BOUNDED: distinct_ips counts source addresses that delivered the artifact to this sensor. A hundred IPs delivering an identical authorized_keys line is far more likely to be one technique in a hundred hands — a commodity script embedded in many actors' post-exploitation kits — than one operator with a hundred addresses. That is precisely the point: the widest thing on the wire is not an operator at all. It is a habit.

The tail, counted honestly

The clustering left 25 samples "unresolved" — meaning the automated fingerprint did not assign them to one of the three pillars. Unresolved is a ceiling on operators, not a count of them, and the honest thing is to resolve it by hand rather than let it inflate the census.

Of the 25: eleven are RedTail — already counted as pillar three; the automated pass simply lacked a RedTail signature and the family label plus the two-wave multi-architecture structure resolve them by inspection. Four are the SSH-key family — the 389-byte wide-net artifact, a 398-byte sibling, and two large ELF "SSH-key backdoor dropper" binaries dropped on 2026-06-08 — one minimalist technique plus its heavier delivery tools. Two more large ELF binaries ("Runtime monitoring tool," 2.2 MB and 2.0 MB) arrived on that same 2026-06-08 date, one IP each; INFERRED, moderate confidence, they are one operator's toolset delivery — four coherent binaries, one day, matched purpose. That leaves roughly seven genuine singletons: a "Whisper" 8 KB text artifact, a 27 KB Windows API dropper (delivered, notably, to a Linux SSH honeypot it can never execute on — a mis-aimed shot from a Windows-oriented kit), a 377 KB "System Info" reconnaissance shell script, a standalone 1.3 KB XMRig shell, and three small text fragments (a 472-byte cross-compiled loader stub, an 85-byte network-logging utility, a 310-byte network-metadata file).

Resolved honestly, the 25 are: 11 (RedTail, already a pillar) + 4 (SSH-key family) + 2 (the 06-08 ELF toolset) + ~7 true one-offs, plus a couple of fragments too small to attribute. Not 25 operators. Closer to three additional operators and a scatter of singletons.

The census result

Assembling the pillars and the resolved tail, the honeypot's retained corpus of 81 samples is the work of approximately six operators plus a singleton tail:

1. The Go toolkit — 42 samples (52%). Depth. One author, one architecture, maintained.
2. The RSA+IRC worm — 14 samples (17%). One 4,745-byte self-propagating script, seven labels.
3. RedTail — 11 samples (14%). Breadth. Multi-architecture Mirai-descended loader, two waves.
4. The SSH-key backdoor technique — 4 samples but 100 distinct source IPs. Reach. A habit, not a program.
5. The 2026-06-08 ELF toolset — ~4 coherent binaries, one delivery. INFERRED single operator.
6. A singleton tail — Whisper, the mis-aimed Windows dropper, a recon script, a standalone miner shell, and fragments.

Six hands, one at 52%. This is exactly the estimate Part Three asserted, now produced from the full corpus rather than from the toolkit's own shadow. The family-label census — which would report the toolkit's ten names, the worm's seven, RedTail's two, plus every singleton's label, as if each were a separate threat — inflates six operators into something north of twenty. The durable-artifact census deflates them back to six. The difference between those two numbers is the difference between a threat picture that is actionable and one that is theater.

The clock: standing presences versus burst deliveries

The census has a time axis, and it separates the six operators into two temporal classes that the sample counts alone hide.

Two of the pillars are standing presences — continuous across the entire four-month window. The toolkit's 42 samples span 2026-03-24 to 2026-07-22 with drops in nearly every week; the worm's 14 span 2026-03-25 to 2026-07-23, effectively the same interval. The 389-byte SSH-key technique likewise runs 2026-03-31 to 2026-07-23. These three are not campaigns that came and went. They are the ambient condition of the sensor — the background radiation of the internet's unhardened-Linux economy, present on essentially any day you look.

The others are burst deliveries — sharp, dated, and gone. RedTail's eleven samples arrive in exactly two spikes, 2026-07-09 and 2026-07-19, and nowhere else; each spike is a complete multi-architecture set fired in a single day. The heavier ELF toolset lands entirely on 2026-06-08. These are not a presence; they are events — an operator sweeping a range on a given day, dropping their whole payload set at each host they land on, and moving on.

This distinction matters because the two classes demand different defenses and produce different evidence. A standing presence is caught by any day's telemetry and rewards durable, always-on rules — the artifact signatures above. A burst is caught only if you happened to be recording on its day, which means the census almost certainly undercounts the burst operators worse than the standing ones: RedTail dropped 11 samples in two days we observed, and we have no basis to assume those were the only two days it fired. The standing presences are measured; the burst operators are merely sampled, and a sample of bursts is a floor with a wide error bar. The toolkit being 52% is a solid measurement. RedTail being 14% is a lower bound that could be much higher on a longer clock.

Three philosophies on one wire

Step back from the count and the six operators sort into three coherent strategies, which is the deeper reason the corpus looks diverse when it is not.

Depth is the toolkit: pick one architecture — the one that runs the servers worth mining and the credentials worth stealing — and invest everything in a single maintained, modular, quietly-persistent platform for it. One author's craft, compounded over months.

Breadth is RedTail: assume nothing about the victim's CPU, compile the payload for every architecture from x86 to RISC-V, front it with a loader that auto-selects, and fire the whole set at once. The Mirai inheritance — win by covering every target, not by mastering one.

Minimalism is the 389-byte key append: assume the victim's own software is the malware, and simply add yourself to its trust store. No binary, no C2, no persistence code — because OpenSSH already is all three. The technique that scales to a hundred hands precisely because there is nothing to it.

The honeypot is not watching a chaotic bazaar of dozens of families. It is watching three strategies — deep, broad, and minimal — instantiated by six operators, and miscounted by a classifier into a crowd. The 087 series and this series between them named the two giants; this census names the rest of the board and, more usefully, names the axes the board is organized on.

What this changes for defense

The operational payoff is that you block by operator artifact, not by family name, and when you do, coverage collapses onto a handful of rules:

• The toolkit's build hash eba3282b571c kills all 42 — every "XMRig" and every PAM/SSH-backdoor variant at once, because they are one build.
• The 4,745-byte RSA+IRC signature kills all 14 worm drops regardless of which of the seven labels each carried.
• The RedTail multi-architecture delivery set kills all 11 regardless of arch.
• Detecting authorized_keys appends — not a signature at all, but a behavior — kills the widest campaign in the corpus, the one no binary-blocklist can ever catch because there is no binary.

Four rules — three artifact signatures and one behavioral watch — cover better than 90% of everything the sensor has seen in four months. A family-name blocklist chasing the same coverage would need roughly twenty entries and would still miss every relabelled sample: block "XMRig" and you leave the toolkit's ten backdoor builds, the worm's dropper, and RedTail's loader untouched, because they wear other names. The census is not an academic exercise. It is the difference between four durable rules and twenty brittle ones.

And the behavioral watch is the one that matters most and is written least often. The corpus's widest campaign leaves no file to scan. It appends a key. Any defense organized entirely around artifacts to block is structurally blind to the single most prevalent thing on the wire, because that thing's entire innovation is to be no artifact. You cannot blocklist a habit. You can only watch the file it writes to.

Bounds and limits

DOCUMENTED: the sample count per cluster, the byte sizes, the distinct-IP counts, and the date spans are first-party measurements over the sensor's 81 retained samples. The three pillars — toolkit 42, IRC artifact 14, RedTail 11 — are counted directly.

INFERRED: that each pillar is one operator (the shared durable artifact makes this a strong floor, not a certainty — two actors sharing a build machine or a leaked key would collapse into one cluster while being two hands); that the 2026-06-08 ELF binaries are one toolset delivery; that the resolved tail is roughly three operators plus singletons rather than more.

BOUNDED: this is one sensor's retained corpus, not the internet. "Reach" is measured as source IPs hitting this honeypot; the 389-byte artifact's hundred sources almost certainly represent a commodity technique carried in many unrelated actors' kits, not one operator — which is itself the finding, not a caveat to it. String-presence extraction undercounts (a sample whose artifact did not cleanly extract falls to "unresolved," so the pillars are floors). The "~6 operators" figure is a considered estimate from hand-resolving a 25-sample tail, not a hard count; its honest range is five to eight. And a corpus is what an operator dropped at one sensor, which is a lower bound on their real output and says nothing about operators who never touched this particular address.

None of those bounds move the shape of the result. Three artifacts are 83% of the corpus. Every operator is overcounted by the labels. The widest campaign on the wire is 389 bytes and belongs to no one. Six hands, three strategies, one classifier that saw a crowd.

This letter is Part Four of The Toolkit. Part One identified the platform; Part Two dissected its mining; Part Three measured it at 52% of the corpus. This part turned the same durable-artifact lens on the entire board and found that the honeypot's real story was never variety — it was a few disciplined operators the family labels kept miscounting, and the widest of them fits on a single line.