107 Sources, One Try Each — Nobody Touched It Twice

A row of lockers lines a school hallway. The locks are the kind you open by spinning to a number.

Suppose someone is trying to figure out another person’s locker combination. If one person stands there spinning the dial, it becomes obvious fast. A kid walking by notices. A teacher notices. “If the same kid keeps standing in front of that locker, they get caught” — that’s usually why we feel safe. Not because the lock is strong, but because sticking with it too long draws attention.

But what if it went like this. A hundred people simply walk down the hallway. Each one gives the dial a single spin and moves on. Nobody touches it twice.

From the observer’s point of view, nothing happened. Because no one acted suspicious.

The records left on our server across the single day of August 30, 2026 have exactly that shape.

First, let me unpack one unfamiliar term. A honeypot is a bait server, deliberately built to look flimsy and put out on the internet. It does no real work. It’s a machine left open in order to record, in full, who comes in and what they do. Every number below is what got logged there.

What we picked as the theme this day is three numbers that lined up

FACT On this day, 282 different sources reached our honeypot 01. Among them, these three values came out.

• Sources that threw the identical string 345gs5662d34 / 345gs5662d34 as both username and password — 107 sources, 112 attempts
• Sources that left behind the same 389-byte key file (a8460f44…) — 107 sources, 112 times
• Sources stamped with the client program fingerprint f555226df… (SSH-2.0-libssh_0.9.6) — 106 sources

FACT And 112 attempts divided by 107 sources is 1.05 per source. It means each source knocked, on average, just once.

INFERRED 107, 107, and 106 are 37.9%, 37.9%, and 37.6% of the 282 sources respectively. Roughly four out of every ten visitors that day were clustered on the same side. We read this as a single scattered crowd — using the same tool, reading the same list, carrying the same file — converging on a single day.

FACT That said, we have to draw a line here. We placed these three values side by side ourselves; the data did not tie them together. There is no field in the raw material saying “these 107 sources and those 107 sources are the same ones.” We cannot rule out that they were three different groups that happened to be similar in size. We’ll come back to this at the end.

FACT Yesterday (August 29), the number of sources throwing the same credential was 9. Across the August 16–29 window we can verify, the maximum is 26 sources on August 27. This day’s 107 is about 11.9 times yesterday’s figure and 4.1 times the maximum over that stretch.

INFERRED When a number jumps like this, the usual write-up is “the attacks intensified.” But the point of this day is not intensity. It’s that each source did it only once. It’s the same as walking down the hallway and giving the dial one spin. The scale grew, yet the individual behavior actually got quieter.

The day in chronological order

Laid out in time order, it looks like this. There are a lot of rows, but you only need to look at how similar the numbers are across the upper rows marked ‘whole observation window’. The bottom five rows are sessions with actual timestamps.

1. 2026-08-30 (daily aggregate)
   FACT Honeypot 01 (Cowrie, high-interaction): 1,623 sessions · 282 unique sources · 1,332 login attempts · 1,686 commands · 982 TTY recordings. Port 2222 (SSH) 1,386 / 2223 (Telnet) 237
2. 2026-08-30 (daily aggregate)
   FACT The credential 345gs5662d34/345gs5662d34 (identical string for username and password) was attempted 112 times from 107 different sources. That is 1.05 per source
3. 2026-08-30 (daily aggregate)
   FACT A 389-byte OpenSSH RSA public key (sha256 a8460f44…) was observed 112 times from 107 sources. The download-source address field is empty — it was not fetched from outside but created within the session (same judgment as the 8/17 brief)
4. 2026-08-30 (daily aggregate)
   INFERRED The two values above (107 sources · 112 times / 107 sources · 112 times) match exactly. However, the data does not link the two items to each other, so this means the figures are the same, not that they are confirmed to be the same group
5. 2026-08-30 (daily aggregate)
   FACT The SSH client program fingerprint f555226df1963d1d3c09daf865abdc9a (SSH-2.0-libssh_0.9.6) was observed from 106 sources this day, 366 cumulative. Yesterday's brief showed a cumulative value of 289 sources, so 77 sources were added in one day
6. 2026-08-30 (daily aggregate)
   INFERRED 106 sources and 107 sources are 37.6% and 37.9% respectively of sensor 01's 282 total unique sources this day. It means roughly four out of ten sources were clustered on the same tool and the same credential
7. 2026-08-30 (daily aggregate)
   FACT Command intent classification: reconnaissance (system) 769 / granting execute permission 186 / persistence (planting SSH keys) 116 / trace deletion 114 / execute after download 42 / file download 42 / impair defenses 1 / reconnaissance (network) 1. Reconnaissance is 45.6% of all 1,686 commands
8. 2026-08-30 (daily aggregate)
   INFERRED The 116 'planting SSH keys' instances and the 112 observed public key files are close. It reads as meaning that attempts to plant a key left a file behind almost without exception
9. 2026-08-30 (daily aggregate)
   FACT There are 897 credential combinations whose values were not published because they did not clear the citation threshold (3 or more distinct IPs). This is not the maximum for the verified window (8/18: 1,388 kinds, 8/25: 1,017 kinds, 8/23: 1,007 kinds)
10. 2026-08-30 (daily aggregate)
    FACT The string '3245gs5662d34' was used as the password for four usernames: root (48 sources) · test (5 sources) · daniel (4 sources) · inventory (4 sources). '345gs5662d34' has the form where username and password are identical. The two strings differ by one character ('2')
11. 00:32:05Z ~ 00:32:19Z (13.8 sec)
    FACT ATK-B0D364 (211.53.x.x, Telnet) logged in successfully. 22 commands, 11 files saved, TTY recorded. The only intent was 'impair defenses' — the single instance of this intent observed across the entire day. Completeness 42, the highest of the day. All 11 files taken are 1-byte empty files (01ba4719…)
12. 01:10:58Z ~ 01:12:02Z (64.1 sec)
    FACT ATK-1D684D (154.201.x.x, Telnet) logged in successfully. 17 commands, 5 intent types (reconnaissance (system) · file download · granting execute permission · execute after download · persistence (planting SSH keys)), 0 files saved, TTY recorded
13. 01:55:23Z ~ 01:57:22Z (119.1 sec)
    FACT ATK-FA7100 (183.208.x.x, Telnet) logged in successfully. 31 commands, 3 intent types, 1 file. This alias is one of the 9 sources that left behind a 306-byte POSIX shell script (a6296a79…, hxxp://185[.]93[.]89[.]72/wget)
14. 05:19:58Z ~ 05:21:03Z (65.1 sec)
    FACT ATK-525D2A (69.165.x.x, Telnet) logged in successfully. 17 commands, 5 intent types, 0 files saved. Command count, intent combination, and file count are all identical to ATK-1D684D four hours earlier
15. 14:55:49Z ~ 14:55:53Z (3.64 sec)
    FACT ATK-CA5936 (130.12.x.x, SSH) logged in successfully. Only 1 command yet 5 intent types, 2 files (399-byte OpenSSH private key 43728fbf… + 54-byte text 00b6f15c…). Fingerprint 16443846…4397 / SSH-2.0-Go. Alias, fingerprint, and figures are identical to the 8/19 · 8/24 · 8/25 · 8/28 briefs
16. 2026-08-30 (daily aggregate)
    FACT Of the 9 client program fingerprints, the only one marked as 'actually deposited a sample' is 16443846184eafde36765c9bab2f4397 (SSH-2.0-Go, 3 sources this day · 27 cumulative). f555226df… (106 sources), the top source count of the day, is marked as not
17. 2026-08-30 (daily aggregate)
    FACT Honeypot 02 (Beelzebub+adbhoney, low-interaction): 55,925 contacts · 250 unique sources. VNC (5900) accounts for 53,360 contacts, 95.4% of the total, yet from only 45 sources — an average of 1,186 per source. Conversely, RDP (3389) had 2,139 contacts from 127 sources, 16.8 per source
18. 2026-08-30 (daily aggregate)
    INFERRED The top 9 sources on 02 (5,064~7,535 contacts each) total 53,291 contacts, nearly matching the 53,360 VNC contacts and accounting for 95.3% of all contacts on 02. However, the data does not link sources to services
19. 2026-08-30 (daily aggregate)
    FACT In 02's VNC negotiations, the version proposed by the other side was 003.003 in 53,312 cases and 003.008 in 33 cases. Only the vocabulary defined by the protocol was recorded; there is no raw exchanged content
20. 2026-08-30 (daily aggregate)
    FACT 02's RDP cookie values were hello 1,458 times · <ip> 501 times · empty 6 times, plus three kinds of 9-character random strings (udzoENWbp · veuBbKTeU · nYXElrYly) once each. Of the 8 proposed SMB dialects, SMB 2.??? appeared only twice and the rest were versions at or below NT LM 0.12
21. 2026-08-30 (daily aggregate)
    FACT 02 secured 4 samples (46,525 · 239,388 · 334,816 · 153,208 bytes, totaling 773,937 bytes) across 25 ADB sessions. The 6 samples 01 secured the same day total 1,158 bytes
22. 2026-08-30 (daily aggregate)
    INFERRED All 4 of 02's samples were left by two aliases, ATK-E23F05 · ATK-1D7F04. The data does not state whether these downloads came via the ADB path, but ADB is the only channel on 02 where file contents can be retained

FACT What catches the eye in the table is the bottom session. 3.64 seconds at 14:55. It logged in, typed exactly one command, and left — and inside that one command were five intents: reconnaissance, download, execute permission, execution, and persistence. And this alias, this fingerprint, and these figures are identical to the records from August 19, 24, 25, and 28.

INFERRED This is not something a person sits down and does. We read it as a pre-written one-liner played back as-is. The same goes for the two sessions at 01:10 and 05:19. They are four hours apart, yet 17 commands, 5 intent types, and 0 files saved are identical.

The note the 107 sources carried was the same one

FACT There were 1,332 login attempts this day. Spread evenly across the day, that’s someone entering a username and password about once a minute. There were 282 different sources.

FACT Below are 20 combinations, filtered to only those observed from 3 or more distinct IPs. Combinations seen from only one source may be real accounts leaked from somewhere, so we do not publish their values.

FACT Beyond these 20, there are 897 more combinations that came only from single or few sources. We write down only the count, not the values. For reference, this number is not the maximum for the verified window (August 18: 1,388 kinds, August 25: 1,017 kinds, August 23: 1,007 kinds).

FACT Look closely at the table and the string 3245gs5662d34 appears across four rows. It was used as the password for root (48 sources) · test (5 sources) · daniel (4 sources) · inventory (4 sources). And it differs from 345gs5662d34 in the top row by one character (‘2’).

INFERRED It’s a string that appears to mean nothing. Not a value a person thinks up and types in. We read it as meaning something is reading a list circulating out there, verbatim. The fact that twin strings differing by one character show up together on the same day also leans toward that list being copied around in multiple editions.

INFERRED This is where the day’s contrast comes into focus. On one side there is a single combination shared by 107 sources. On the other, 897 kinds that each came from only one or two sources. In hallway terms, a crowd all holding the same note and a crowd each holding a different note passed through the same hallway on the same day.

And they taped a list inside the locker before leaving

FACT One of the most frequently observed actions after a successful login is ‘persistence — planting SSH keys’, 116 times. And on the same day, the same 389-byte public key file (a8460f44…) came from 107 sources, 112 times.

Let me unpack two terms here.

A fingerprint (sha256) is a 64-character value computed over the entire file. Change a single character inside the file and the value changes completely. That’s why we use this value to decide whether two files are the same or different.

A public key works like this. A Linux server has a file called authorized_keys (the list of permitted keys). Write one public key line into it, and whoever holds the matching counterpart gets in without ever being asked for a password. In locker terms, it’s like taping a note inside the door saying “this key just passes.” And here’s the crux: even if you change the combination, that piece of paper stays taped there. A password is checked at the door, while this list is stored inside the server — they’re different things.

FACT 389 bytes is about the size of two or three lines of a text message. And the fingerprint of this file has been the same for 15 consecutive days, from August 16 through this day.

FACT Yet the number of sources leaving this file behind kept swinging.

FACT This day’s 107 sources is the maximum daily source count within the range we can verify. It is 4.1 times the previous maximum of 26 sources on August 27.

INFERRED And for this file, the download-source address field is empty. That means it was not fetched from outside but created within the session. This is the irritating part for defenders. There is no address to put on a blocklist. Blocking all outbound communication doesn’t stop this. Because it is something that completes inside the server the moment the door is successfully opened.

INFERRED The 116 key-planting intents and the 112 actual files are close. We read it as meaning that attempts to plant left a file behind almost without exception.

The tool fingerprint grew twelvefold in a single day

FACT Incoming SSH connections greet the server slightly differently depending on the program. The value summarizing that greeting is called a client fingerprint. It’s a value indicating which program was used to connect.

FACT There were 43 fingerprint clusters this day. Among them, f555226df1963d1d3c09daf865abdc9a (SSH-2.0-libssh_0.9.6) was observed from 106 sources this day, 366 cumulative. Yesterday the same value was 9 sources that day, 289 cumulative. In a single day the day’s source count grew about 11.8 times, and the cumulative figure rose by 77 sources. The past values we can verify are 10 sources on August 19, 19 sources on August 24, and 9 sources on August 29. 106 sources is a different order of magnitude.

FACT Yet there is one value attached to this fingerprint that points the other way. Of the 9 fingerprints this day, the only one marked as ‘actually deposited a sample’ is 16443846… (SSH-2.0-Go), and that one is 3 sources this day · 27 cumulative. f555226df… (106 sources), the top by source count, is marked as not.

INFERRED How to read this value is the day’s unresolved point. If this marking counts text files such as public keys as well, then the reading “the 106-source crowd planted that public key” does not hold. We cannot determine the definition from the brief input alone, so we leave the reading unsettled.

FACT And we draw one more line. This is a fingerprint of a build, not a fingerprint of a person. Completely unrelated people using the default libssh 0.9.6 bundled with the same distribution end up with the same value. So we write only ‘the same tool’ and do not write ‘the same organization’.

Files they left behind

These are values to take down. Click a value to copy it — these exist not to be read but to be put on a blocklist. The addresses are deliberately written broken (hxxp://, [.]). Copy and paste them as-is and they won’t connect.

INFERRED Read this list from top to bottom and you’ll see there is exactly one line with an address. All the rest read ‘download-source address not recorded’. It means we obtained the fingerprints but have no address to put on a blocklist. A fingerprint is only useful while the file stays unchanged. Change a single character inside and the value becomes entirely different.

Mapped to the international classification table

The techniques attackers use carry numbers the whole world shares. It’s a list called MITRE ATT&CK. Below, clicking an ID takes you to the original description — we include them so you don’t have to take our word for it and can check directly.

• T1110Brute Force — 1,332 login attempts. However, the largest combination this day was a distributed form at 1.05 per source, differing in shape from traditional brute forceINFERRED
• T1078Valid Accounts — all 5 completed sessions logged in successfullyINFERRED
• T1082System Information Discovery — 'reconnaissance — system' 769 timesINFERRED
• T1098.004Account Manipulation: SSH Authorized Keys — 'persistence — planting SSH keys' 116 times + 389-byte public key 112 timesINFERRED
• T1222.002File and Directory Permissions Modification: Linux and Mac — 'granting execute permission' 186 timesINFERRED
• T1105Ingress Tool Transfer — 'file download' 42 times, hxxp://185[.]93[.]89[.]72/wget from 9 sourcesINFERRED
• T1059.004Command and Scripting Interpreter: Unix Shell — 'execute after download' 42 times, POSIX shell script sampleINFERRED
• T1070Indicator Removal — 'trace deletion' 114 timesINFERRED
• T1562Impair Defenses — 'impair defenses' 1 time (ATK-B0D364 session)INFERRED
• T1046Network Service Discovery — 'reconnaissance — network' 1 time. Separately, the five service contacts on honeypot 02 also read as this category, but we do not assert it because sources and services are not linked in the dataINFERRED
• T1021.005Remote Services: VNC — 53,360 contacts on 02's port 5900. This is the contact and negotiation stage; no authentication success existsINFERRED
• T1021.001Remote Services: Remote Desktop Protocol — 2,139 contacts on 02's port 3389. Likewise the contact stageINFERRED

FACT The largest number among the twelve rows is the third, reconnaissance (system), 769 times. That is 45.6% of the day’s 1,686 commands. Nearly half of what they did after getting in was checking “what kind of machine is this.” Next comes granting execute permission at 186 (11.0%), and then key planting at 116 and trace deletion at 114, sitting at almost the same scale.

INFERRED The count of planting keys and the count of erasing traces sit two apart. We read it as intrusion tooling performing ‘making a way back in’ and ‘erasing the marks of having been in’ as one bundle.

INFERRED And all twelve rows carry the ‘INFERRED’ badge. Because what we saw is the intent classification and counts of commands, not a purpose the attacker stated themselves.

The whole of yesterday

FACT Based on sensor 01 (high-interaction honeypot).

INFERRED One number looks out of place. 85.4% of sessions were SSH, yet 4 of the 5 sessions that logged in successfully and actually did work were Telnet. Telnet is a very old remote access method. It’s a channel left open so someone across the internet can type directly into that machine’s command prompt, and the password travels in the clear, unencrypted. Far more of the knocking was on the SSH side, but the side that got inside and did something was mostly Telnet.

FACT We’ll also carry over the numbers from the second server standing beside it (sensor 02). This one is low-interaction, so login successes, commands, and credentials do not exist there in the first place. All it counts is ‘which door was knocked on how many times.’ It is not a record of anyone getting in.

FACT In total, 55,925 contacts from 250 unique sources. Spread across the day, something knocked on this server about once every 1.5 seconds.

INFERRED Same server, yet the picture in front of the two doors is the exact opposite. On the VNC side, 45 sources were stuck to it at 1,186 times each. Spread across the day, that means one source, once every 73 seconds, all day long, holding on to the same door. On the RDP side, 127 sources passed through at about 17 times each. A pattern of a few clinging to one door and a pattern of many skimming shallowly arrived at the same server on the same day.

FACT The protocol told us some things too. Of the 53,360 VNC contacts, 53,312 proposed version 003.003. The newer 003.008 accounts for only 33. Of the 8 proposed SMB dialects, SMB 2.??? appeared only twice and the rest were versions at or below NT LM 0.12. RDP connection cookies logged hello 1,458 times, <ip> 501 times, empty values 6 times, and three kinds of 9-character random strings (udzoENWbp · veuBbKTeU · nYXElrYly) once each.

INFERRED Almost all of them proposing the same old version reads as the trace of the same script knocking repeatedly, not human hands. That said, these values are merely the vocabulary the protocol defines. We do not assert the other side’s actual tooling or intent from these values.

FACT The two sensors diverged sharply on file size. 02 secured 4 samples across 25 ADB sessions, totaling 773,937 bytes. The 6 samples 01 secured the same day total 1,158 bytes. A 668-fold difference.

INFERRED 01 was busy all day yet almost no files remained. 02 produced four large files from one quiet channel. Measure risk by contact count and the ordering flips. That said, we make no judgment about what these 4 are. There is no file type information.

FACT And on sensor 02 this day, we cannot compute whether a single source swept multiple services together. The sum of unique sources per service (45+127+36+26+5=239) is smaller than the total unique sources of 250, so there is no way to work backward to whether there was overlap. Writing 0 would be false, so we left it as no value.

So what should you do

INFERRED Here are the six ‘had this control not existed’ items the brief laid out, ordered by how strongly this day’s data supports each.

1. Replace the door that opens with a password with a door that opens with a key — this is the day’s centerpiece. 85.4% of sessions were SSH. SSH is a protocol you can lock so it opens only with a key instead of a password. Had password authentication been turned off and only key authentication allowed, those 112 attempts thrown by 107 sources this day would all have ended at the door. Defense that counts attempts and defense that makes counting meaningless are different things.

2. Don’t leave management ports open to the internet as-is — you become a target even without a vulnerability. In one day, a server with no advertising whatsoever drew RDP from 127 sources · VNC 45 · LDAP 36 · SMB 26 · MSSQL 5. Combining both sensors, up to 532 sources (an upper bound, since overlap is unknowable). Move management ports behind a VPN or jump host, or restrict which sources can connect, and most of the contacts observed this day disappear before they even reach the authentication stage.

3. Open authorized_keys once and look — 116 key plantings, and the same public key file from 107 sources 112 times. If you run a server, open the ~/.ssh/authorized_keys file. If there’s a line you don’t remember putting in, that’s someone else’s key. Changing the password does not erase it. In incident response, if you only reset the password and never look at this file, the door stays open even after you stamp ‘remediation complete.’

4. Get rid of default accounts and common passwords — the 20 kinds in the table above are combinations actually knocked by 3 or more distinct IPs. On top of that there are 897 kinds whose values we did not publish. This dictionary was not built to target a specific organization; it’s a collection of defaults that work anywhere. Which means you don’t have to stand out to become a target. All 1,686 commands observed this day were executed after a successful login.

5. Restrict outbound connections from the server — file downloads at 42 times and execute-after-download at 42 times are exactly the same number. It means what was downloaded led to the execution stage virtually without exception. Had outbound communication been blocked by default with only necessary destinations allowed, it would break at the download stage. In fact, 2 of the day’s 5 completed sessions (ATK-1D684D · ATK-525D2A) went as far as download by intent yet had 0 files saved.

6. Don’t rely on ‘lock out after N failures’ alone — the largest combination this day was 1.05 per source. An approach of ‘block one IP after N failures’ never even reaches its trigger condition. Even had it been in place, it likely could not have stopped this pattern. That said, this is specific to this pattern. Counter-evidence is in the same day’s data. The overall average is 4.7 per source, and admin/admin was 46 attempts from 25 sources, 1.8 per source. And sensor 02’s VNC was 45 sources at 1,186 each — there, rate limiting would clearly have been effective. So this item is not ‘throw it out’ but ‘this alone is not enough.’

FACT And a caveat on item 5. The SSH key planting that was the centerpiece of this day requires no outbound connection. Block all outbound and this still isn’t blocked.

7. Keep logs somewhere off the server — intent to erase traces was observed 114 times. The reason we can write the timeline above, and cross-check it against 982 TTY recordings, is that the logs remain outside the server. If the logs live only inside that machine, then once they’re erased, not even the fact that they were erased remains.

It has happened before

INFERRED The Mirai botnet (2016). A case where a single dictionary of default Telnet credentials took over many devices and had them download executables built separately per CPU type. The 4 completed Telnet sessions observed this day, and the per-CPU filename pattern in the indicators that only surface after decompression (parm5 · parm6 · parm7 · pm68k · pmips · pmpsl · pppc · psh4 · pspc · x86_64), are of the same family in form. However, we have no grounds to assert that what we observed is of the Mirai family — we have no means (VirusTotal) to attach a classification to samples. (Basis: US-CERT/CISA alert TA16-288A, published source code)

INFERRED The FritzFrog P2P SSH botnet (2020). A case where, after getting in via SSH credential guessing, it added its own public key to authorized_keys to secure continued access. This day’s 116 key plantings, and the pattern of a 389-byte public key with the same hash coming from 107 sources, overlap with this technique. This is similarity of technique, and there is no basis for saying it is the same campaign. (Basis: published vendor report — Guardicore/Akamai)

What We Don’t Know

This is the most important part of this post. There is more we could not write than what is written above.

• [Core] There is no confirmation that the 107 sources, 107 sources, and 106 sources are the same group. We placed the three values side by side and observed them; it is not a fact the data tied together. We cannot rule out that three different groups happened to be similar in size.
• And there is evidence within the same data that conflicts with the inference above. The fingerprint f555226df… (106 sources) is marked as not having ‘deposited a sample.’ We cannot determine the exact definition of this marking (whether it counts only malicious executables, or also text files such as public keys) from the brief input alone. If it includes the latter, the reading ‘this crowd planted the public key’ does not hold.
• We cannot explain from the data why the sources of the public key a8460f44… moved 26 (8/27) → 9 (8/29) → 107 (this day). We have no basis for distinguishing whether the campaign grew, our collection scope changed, or a botnet generation was replaced.
• The total fingerprint clusters fell from 45 yesterday to 43 this day, while on the same day the source count of the largest cluster rose from 9 to 106. We cannot judge whether diversity narrowed and concentrated on one side, or whether the aggregation criteria differ.
• The public key’s hash being the same means ‘the same file,’ not ‘the same operator.’ Who, and how many people, hold the private key matching this key is not in the data.
• Whether the 399-byte private key (43728fbf…) was planted by the attacker or was something on the server they tried to take is not distinguished. It’s in the download list yet the download-source address is empty. It has been in the same state for twelve days since the August 19 brief.
• The TTY recording count is written as two different values, 982 and 205. There is no explanation of whether 205 is the number of recordings actually viewable among those recorded, or whether the two values count different things.
• On sensor 02, we cannot compute whether a single source swept multiple services together. The sum of unique sources per service (239) is smaller than the total unique sources (250), so overlap cannot be worked out backward.
• The data does not state whether sensor 02’s 4 samples came in via the ADB channel. It is an inference leaning on the definition that ADB is the only channel on 02 where file contents can be retained. Also, these 4 have no file type information, so we make no judgment about what they are.
• We cannot tell what, among this day’s sessions and samples, a separately obtained Discord webhook address connects to. It did not appear in the address field of any download this day, so we did not describe it in connection with this day’s events.
• The 12 distribution addresses that only surface after decompression are on a different host from the hxxp://185[.]93[.]89[.]72/wget observed this day. We have no means to confirm whether it is the same campaign.
• The background statistics we hold — 6,580 CVEs, 388 CISA KEV entries, 98 confirmed ransomware cases — are background context based on KISA security notices. They are not connected to this day’s honeypot observations. No trace of a CVE being referenced was observed on the SSH or Telnet paths.
• The C-TAS report is confirmed only as far as succeeding at the transport layer. Whether it was actually ingested on the KISA side requires separate confirmation.
• Aliases (ATK-XXXXXX) are merely markers pointing to the same masked source across briefs; they are not identities. Even for an alias like ATK-CA5936 that reappears over more than ten days, we cannot rule out that the party using that address changed in the meantime.
• The 532 unique sources across both sensors is an upper bound. We cannot tell whether the same IP appeared on both.
• Finally, a honeypot is a server built to open its door. A successful login does not mean ‘this credential also works on real production servers’; it means ‘this credential is being tried.’

And below are things we have no means to confirm in the first place. We do not infer them.

• ASN · ISP — we have no relevant database. We cannot confirm which carrier or which hosting range.
• Geolocation — likewise absent. And IP geolocation is not a basis for attribution to begin with. We name no country, company, or individual as this day’s attacker.
• VPN · Tor · cloud status — we have no means of determination. Among the 282 sources and 250 sources, we cannot distinguish which are relays and which are origins.
• VirusTotal — not integrated. We cannot attach malware family names to the 10 samples secured this day (6 from 01 + 4 from 02). For sample classification we use MalwareBazaar tags.
• User-Agent — neither observation surface is HTTP. 01 is SSH and Telnet; 02 is SMB, RDP, VNC, MSSQL, LDAP, and ADB.
• CVE linkage — SSH and Telnet attacks mostly use credentials without referencing a specific vulnerability. 02 is likewise at the protocol negotiation stage. No CVE is connected to these observations this day.

INFERRED To sum up, this is the day. 1,623 sessions, 1,332 login attempts, 1,686 commands. And 107 different sources arrived carrying the same username, the same password, and the same single key file. At 1.05 times per source.

Nobody stood in the hallway holding on for a long stretch. Everyone gave the dial a single spin in passing and moved on. The kind of watching that says ‘if the same kid keeps touching it, they get caught’ had no occasion to fire even once this day.

So what this day’s data points to is not tightening the watching. Counting numbers and changing the door are different jobs. If you have even one server, there are just two things to try today. Opening ~/.ssh/authorized_keys once and looking, and locking the door that opens with a password so it opens only with a key. The first one takes a few seconds.

The observation day is the single day of August 30, 2026 (UTC). Source IPs are carried over in the brief’s masked form (211.53.x.x, 130.12.x.x) and were not restored. Distribution addresses are written in altered form so they will not connect (hxxp://, [.]). Credentials are cited for only the 20 combinations observed from 3 or more distinct IPs, and for the 897 combinations that did not clear that threshold we state only the count and do not publish the values. ASN, nationality, and actor attribution are not inferred, as we have no means to confirm them.