Sometimes the hunt finds you... true story. IOC's provided. While doing some checks on my deception…
PETER D. — Cybersecurity / Threat Researcher / Breaker of All Things / Discovered a 563-Node Global Botnet
Sometimes the hunt finds you... true story. IOC's provided.
While doing some checks on my deception environment, I tripped over a queue of flagged canary hits that had been patiently sitting there for 18 days.
Queued. Waiting. Not going anywhere.
Using SSH client fingerprint (HASSH) clustering, I correlated 7 IPs across 6 countries that all participated in a coordinated operation on March 19 2026 within a 4-hour window. The lead actor out of Poland completed the full kill chain — SSH brute force into a honeypot filesystem, read embedded credential files, pivoted to an FTP honeypot, and accessed a canary file.
Two shared HASSH fingerprints linked the core cluster:
acaa53e0a7d7ac7d1255103f37901306 — Poland, China (x2), Hong Kong 16443846184eafde36765c9bab2f4397 — Poland, China (x2), Romania
IOCs:
PL blueconnect — lead actor- DM me, happy to disclose to vetted people
219.147.196.170 — CN ChinaNet Heilongjiang
223.112.66.229 — CN China Mobile
116.48.138.69 — HK HKT
49.247.36.49 — KR SMILESERV
2.57.121.50 — RO UNMANAGED LTD
159.223.68.23 — SG DigitalOcean
Interesting twist — one Korean IP inside the same cluster showed completely different TTPs consistent with a known campaign, and a Hong Kong node was confirmed Mirai botnet. Different actors, same operation window, shared fingerprints.
Anyone else seen these HASSH values?
4 reactions · 0 comments