How I Discovered a 563-Node Global Botnet from my deception honeypots True story, still can't believe I…
PETER D. — Cybersecurity / Threat Researcher / Breaker of All Things / Discovered a 563-Node Global Botnet
How I Discovered a 563-Node Global Botnet from my deception honeypots
True story, still can't believe I caught this..
It started with two Chinese IPs flagging in my dashboard.
Different provinces. Different ISPs. On the surface, unrelated. But they'd executed identical command sequences — same SSH key injected, same hardening commands, same order. That's not coincidence. That's one operator.
I pulled their HASSH fingerprints — the MD5 hash of an SSH client's key exchange parameters. A reliable way to identify shared tooling across actors. The two IPs shared fingerprints. I queried those fingerprints against my full telemetry.
Elastic hit its cap of 100 IPs. Repeatedly. Six fingerprints. Hundreds of nodes. One operator — attributed to ChinaNet Anhui — running a cover IP with an AbuseIPDB score of zero. Completely invisible to reputation-based controls.
563+ confirmed nodes across 40+ countries.
HASSH fingerprints that mapped the entire operation:
57446c12547a668110aa237e5965e374
eff4c24daffc8532c160e86e5f006e53
b21d7cdcc8133dc2b430d1a039fece20 ← human operator tool
4e066189c3bbeec38c99b1855113733a ← C2 dispatch cluster
084386fa7ae5039bcf6f07298a05a227
dd9bcf093c355da7000132131cb36fd0
Among the nodes: Afghan government infrastructure and the Indonesian Ministry of Defense — identified through ASN attribution.
The 4e066189 cluster exposed the C2 relay — three Linode nodes, 3 sessions in 60 seconds, single fingerprint discipline: 45.33.12.122 / 45.33.109.18 / 172.236.228.222
Cross-referencing fingerprints revealed a BEC overlap on 198.235.24.0/24 (Palo Alto Networks ASN, Belgium). Two campaigns. Shared infrastructure.
Trojanized sshd recovered across a 4-node cluster:
SHA256: a8fbb5195a6e792c94f0945e11e3b4e07485f1f80cf3a87fad81dd6718ce609b
This campaign would have sailed through IP reputation systems, geographic blocking, threshold alerting, and standard HASSH blocking — the operator was actively rotating tools.
Behavioural correlation caught it. Nothing else would have.
Disclosure completed to 🇺🇸 CISA 🇨🇦 CCCS 🇦🇺 ASD/ACSC 🇬🇧 NCSC UK (ref 250326-GQW) plus DigitalOcean, AWS, Azure, GCP, Alibaba, ByteDance, and Linode. 15 organizations total. Campaign designated SSHBOT-2026-001.
Update 2026-03-26: GCP investigating (ref PRU2W4QQMVO4WHZKFLP4LQ6FQ4). CISA responded — case CASE0171367 assigned, referred to FBI IC3 for attribution. Provider response varied: DigitalOcean terminated same day. AWS engaged their customer and closed the case without action.
If your detections rely entirely on reputation scores and known-bad IPs, you have blind spots. The most interesting actors know exactly how to stay invisible inside those gaps.
2 reactions · 0 comments