LSN โ€” Local Sovereign Network

The Final Accounting: Reading the Tail, Counting the Board

The Long Tail โ€” Part 4, and the close of the honeypot census

Classification: MEDIUM ยท Confidence: HIGH on method, CALIBRATED on the count

This series began by refusing a dismissal. An earlier letter had called the census's remainder "thinner material" โ€” the singletons, the fragments, the samples the operator count could not cluster โ€” and moved on. That was wrong, and the three letters since have shown how wrong: the tail held two full botnets staging their payloads off-box, an opaque four-tool toolset whose function was hidden by design, and a reconnaissance layer that turned out to be where intent lives. The material was never thin. It was written in a smaller hand, and the summary that filed it as noise had simply declined to read it.

This closing letter does two things. First, it accounts honestly for what remains at the very bottom โ€” the genuine fragments, the samples that really are almost nothing, because an honest census must distinguish the hidden from the empty rather than lumping both under "tail." And second, it settles the account the whole investigation opened: how many operators, once the corpus has been read rather than weighed or labelled, the honeypot has actually been watching. The number is not the one the family labels implied, nor the one the drop-weights suggested. It sits between them, and only reading got us there.

The genuine noise floor, sorted

Not everything in the tail is a hidden operator. Some of it really is residue โ€” but "residue" turns out to be four different things the classifier lumped into one, and telling them apart is itself the discipline.

Command output mistaken for a file. One 85-byte "Network logging utility" is not a utility at all. Its entire content is 0+0 records in / 0+0 records out / 0 bytes transferred โ€” the standard-error printout of the dd command. An attacker ran dd, it produced its usual summary line, and the honeypot captured that summary as though it were a dropped artifact. It is not malware, not a tool, not even a file the attacker meant to leave. It is an echo โ€” the transcript of a command mistaken for the command's payload. A corpus that does not recognize its own captured console output will count echoes as samples.

Self-checks whose content is the victim. Another fragment is a captured public-IP-and-geolocation lookup result โ€” the kind of ipinfo-style JSON an attacker pulls to learn where they landed, discussed generically in the previous letter. Its content is the sensor's own metadata reflected back, which is why its specifics are excluded from these letters: it is an indicator of nothing but the honeypot itself. As a census entry it is a mirror, not a window. It tells you an attacker checked their coordinates; it tells you nothing about the attacker.

Config shards. A 1,269-byte standalone miner-configuration shell, a second and non-famous authorized_keys key seen twice โ€” these are real, but they are fragments of operations, not operations. The small key is a genuine minimalist backdoor, a quieter cousin of the decade-old Outlaw key from Part One of the skeleton-key thread, planted by a hand that did not reuse the famous key and so passes without a name. It counts, barely, as an operator; but what landed is a shard, and honesty requires marking it as such.

The genuinely opaque and alone. And one sample resists everything. The 5.96-megabyte "SSH-related implant" from early April has an entropy of 2.74 โ€” very low, mostly-empty โ€” carries almost no strings, and does not share the $0f9C2u marker that clustered the June opaque toolset. It is neither a hidden operator we can name nor a fragment we can dismiss. It is a single large binary, deliberately or incidentally illegible, tied to nothing else in the corpus. The honest entry for it is a shrug with a hash: one opaque object, one operator perhaps, unresolvable further from what the sensor holds.

Four kinds of "noise," and only the last two are even arguably operators. An echo, a mirror, a shard, and an opaque stone. The value of sorting them is that it stops the census from either inflating the count with echoes and mirrors or deflating it by discarding the shard and the stone along with them.

The three ways to count, and what each gets wrong

The whole investigation has, in effect, been a comparison of three ways to count a malware corpus, and the close is the place to state plainly what each one does and where each one fails โ€” because the disagreement between them is the finding.

Counting by family label โ€” the classifier's names โ€” fails in two opposite directions, and this series found both. It over-counts the verbose: the dominant Go toolkit exposed enough strings to be read as ten different families, one operator inflated to ten labels. And it confabulates the opaque: the June toolset exposed almost nothing, so the classifier invented four confident names, including one ("Runtime monitoring tool") that describes a benign utility and is almost certainly wrong. Label-counting measures how legible an operator chose to be, which is a property the operator controls โ€” pad it by being chatty, skew it by being silent. It is the least reliable of the three and, being the default, the source of most published overcounts.

Counting by drop weight โ€” how much each operator deposited on the sensor โ€” is what the census used, and it fails in one direction, structurally. It under-counts the external-stager. Whisper and Nexus dropped a loader each and kept thirty and fourteen architectures of payload on a server elsewhere; the sensor weighed a few kilobytes and filed two full botnets as singletons. Weight-counting measures how much of itself an operator happens to deposit inline, which is a property of delivery architecture, not of size or reach. It ranks the inline-dropper up and the stager down, every time, regardless of which is bigger.

Counting by durable artifact โ€” the build hash, the runtime marker, the fixed key, the loader's hard-coded C2 โ€” is the method that survived contact with all of it. eba3282b571c collapsed the toolkit's ten labels to one operator; $0f9C2u clustered the opaque toolset's four names to one; the mdrfckr key's exponent-37 fingerprint tied a hundred delivering hands to one owner; Whisper's and Nexus's loaders gave up their staging servers. Artifact-counting works because it counts what operators embed for their own purposes and cannot shed without breaking their tooling โ€” the one class of evidence the operator does not get to skew for the analyst's benefit. It is the method this entire investigation has been quietly arguing for, and the tail is where it earned its keep, because the tail is where the other two methods fail hardest.

Even artifact-counting has a floor. The genuinely opaque April implant shares no marker; the communal reconnaissance tooling clusters no one because it belongs to everyone. The honest census is therefore not a number but a range with a method-dependent floor โ€” the count you can defend depends on how deep you were able to read, and some samples do not let you read deep enough.

The count

With the tail read rather than weighed, the honeypot's four-month, 81-sample corpus resolves to approximately nine to eleven distinct malware operators, plus a communal substrate that is no single operator, plus a residue that is no operator at all.

The operators, assembled from the whole investigation:

Plus the living-off-the-land reconnaissance layer โ€” neofetch and the public-IP lookups โ€” which is not an operator but the shared habit of many, the substrate they all stand on. And plus the genuine residue โ€” the dd echo, the reflected self-check โ€” which is no operator at all.

Roughly ten hands. Set that against the two anchors this investigation kept returning to. The family labels, tallied naively, imply something north of twenty distinct threats โ€” the toolkit's ten names, the worm's seven, RedTail's two, the opaque toolset's four, and every singleton's confident label, each counted as its own thing. The drop-weight census, at the other extreme, settled on roughly six, because it could not see the operators who staged their weight elsewhere. The truth is neither: about ten, reached by disbelieving both the labels and the weights and following the fingerprints instead. Reading pushed the naive twenty down by collapsing the over-labeled, and pushed the weight-census six up by surfacing the hidden โ€” and the two corrections met near ten.

Four strategies, not a crowd

Sort the roughly ten operators not by size but by how they chose to run on strangers' machines at scale, and the crowd collapses into four strategies โ€” the real structure the family labels obscured.

Depth is the Go toolkit: pick one architecture, the one that runs the servers worth mining and the credentials worth stealing, and pour a maintained, modular, quietly-persistent platform into it. One author's craft, compounded over months. The opaque June toolset sits near here too โ€” heavy compiled tooling, deliberately hidden โ€” a depth operator who added concealment to craft.

Breadth is RedTail, Whisper, and Nexus: assume nothing about the victim's processor, cover every architecture from x86 to RISC-V to PowerPC to SPARC, and where coverage runs out, brute-force or stage the rest. RedTail carries its breadth inline and verifies each architecture; Whisper and Nexus stage theirs off-box and fetch on demand; all three are the Mirai instinct to win by covering everything rather than mastering one thing.

Minimalism is the Outlaw key and its quieter unnamed cousin: no binary, no infrastructure, a single line appended to the victim's own trust store, borrowing the operating system's daemon as the persistence engine. The least code, and โ€” in the Outlaw key's case โ€” the widest reach in the corpus.

Opacity is the refusal to be read at all: the June toolset again, and the lone April implant โ€” operators whose whole answer to being catalogued is to make cataloguing fail. It is less a way of running than a way of not being counted, and it cuts across the other three.

Two findings cross all four strategies and are worth restating because they held where almost nothing else did. First, on secrets: the depth operator and the breadth operators, opposite in nearly everything, both externalized their mining wallets โ€” professionalism about the one artifact that would burn the operation is independent of strategy. Second, on maintenance: the operators that ship binaries โ€” the toolkit, RedTail โ€” are actively-iterating software with visible release cadences, while the operator that ships no binary โ€” the Outlaw key โ€” is a decade-frozen constant. Maintenance tracks payload complexity, not reach. The widest-reaching thing in the corpus never changes; the things that require compilation are revised in real time.

What the whole census was actually about

The number is worth having, but the method is the real deliverable, because the number is only ever as good as the reading behind it and the reading is what transfers to the next corpus.

Every letter in this investigation found the same thing at a different scale: that the name a sample wears is a hypothesis, that the weight it dropped is a bias, and that the truth is in what the operator could not help leaving behind. A verbose operator leaves too many names and one build hash โ€” follow the hash. An opaque operator leaves too few strings and one runtime marker โ€” follow the marker. A staging operator leaves no payload and one hard-coded address โ€” follow the address. A careless operator leaves a binary for the wrong platform and reveals its whole toolchain โ€” read the misfire. In every case the legible surface lies in the direction the operator chose, and the durable artifact lies underneath it, in the direction the operator could not avoid. The census is the practice of counting the second and disbelieving the first.

The honeypot's real story, across all of it, was never variety. Twenty-odd labels became about ten operators became three or four strategies โ€” depth, breadth, minimalism, and the opaque refusal to be read โ€” pursued by a small population of maintained, iterating, professionally-secretive software projects and a scatter of careless or communal hands around them. The tail was not the bottom of that story. It was half of it, kept in a smaller hand, in the part of the corpus that a summary is always tempted to skip โ€” which is exactly why it held the two staged botnets, the hidden toolset, the reconnaissance intent, and the honest correction to the count. The dismissal this series began by refusing was the single most expensive analytic move available: to weigh what fell on the sensor, call the light half noise, and never read it. Read it, and the noise resolves into a board โ€” about ten hands, three or four strategies, one classifier that saw a crowd, and a tail that was quietly holding the other half of the truth.

For the analyst downstream

The reason to write a census down is so someone else does not have to rediscover it, so it is worth stating the transferable rules plainly โ€” the things this corpus taught that apply to the next one.

Do not tally family labels. A family-label feed is a list of hypotheses formatted as facts, and it fails in both directions at once: it splits verbose operators into many names and papers confident names over operators it could not read. Treat every family name as a claim to be checked against a durable artifact, never as a unit to be counted. When you see a confident, benign-sounding label โ€” "monitoring tool," "system info," "test binary" โ€” on a sample that arrived by attack, distrust that label specifically; it is the shape a confabulation takes.

Do not rank by what landed. A drop-weight ranking is a ranking of delivery styles wearing the costume of a threat ranking. The operator who staged thirty architectures on a server you never saw looks smaller than the one who dropped five inline, and that is exactly backwards. When a singleton is a loader pointing at a live server, it is the tip of something whose size lives off-box โ€” follow it, do not weigh it.

Read the tail; it holds the addresses and the intent. The heavy inline operators are where the payloads are, and a weight census finds them fine. The light staging operators are where the live C2 addresses are, because a stager must name its server. And the non-payload layer โ€” the reconnaissance tools, the self-checks โ€” is where intent lives, legible in the clear, before any weapon is committed. The bottom of the corpus is not the least important part; it is the part that pays back reading at the highest rate, because it is the part everyone else skipped.

Count fingerprints, and state a range. Cluster on what the operator embedded for their own use and cannot shed โ€” build hash, runtime marker, fixed key, hard-coded C2 โ€” count the clusters, and report the count as a range whose floor is set by how deep you could read. The genuinely opaque and the purely communal will resist you; say so, rather than forcing them into a false precision. A defensible "about ten, floor uncertain" beats an indefensible "twenty-three families" every time.

Bounds and limits

DOCUMENTED, first-party, for the fragments: the 85-byte "Network logging utility" is captured dd standard-error output; a captured public-IP/geolocation self-check reflects the sensor's own metadata; a 1,269-byte standalone miner-config shell and a twice-seen non-famous authorized_keys key are operation fragments; the 5.96 MB April "SSH-related implant" has entropy 2.74, minimal strings, and does not carry the $0f9C2u marker of the June opaque toolset.

CALIBRATED, on the count: "approximately nine to eleven operators" is a considered synthesis across the whole investigation, not a hard tally. Its uncertainty is real and directional โ€” the lone April implant may be an eleventh operator or a stray build of a counted one; the second key-planter and the standalone miner shell sit at the boundary between "operator" and "fragment"; and the range's floor is method-dependent, because the genuinely opaque and the purely communal resist clustering by any method the sensor supports. The honest figure is a range near ten, explicitly not a point.

BOUNDED: this is one sensor's retained corpus over roughly four months. Burst operators are sampled rather than measured, so several counts (RedTail's, the staged botnets') are floors on activity; external-stagers' payload capabilities were referenced but not retrieved; the opaque operators' functions were not established; and "operator" throughout denotes a distinct build-pipeline or keypair, which is a floor on hands and says nothing about the humans or crews behind them, who may be fewer (shared tooling) or more (leaked keys) than the artifact count implies. The number counts fingerprints, honestly, and stops where the fingerprints stop.

That is the whole census: about ten hands behind eighty-one samples, read out of a corpus that a label-count would have inflated past twenty and a weight-count would have deflated to six โ€” and a tail that turned out to be, not the noise floor, but the half of the board written small enough to be missed.

This closes The Long Tail and the honeypot census that ran through it. The investigation began with a single operator measured at 52% of the corpus and ends with the full board counted: the strategies named, the hidden operators surfaced, the confident labels disbelieved, and the tail read to the bottom. The method โ€” count the durable artifact, disbelieve the name and the weight โ€” is the part meant to outlive this particular sensor and this particular four months.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Long Tail โ€” 4 / 4 Next โ†’