Same 1,196 Bytes, Only the Face Changed — A Photo List That Went Stale in Three Days

Sometimes there’s a photo taped to the wall of an apartment building’s security office. “Do not let this person in.” Maybe they were handing out flyers on the sly, or maybe they were walking off with someone else’s parcels. The guard checks the faces of people coming in against that photo.

This method works well. But it has one condition. The person has to come back with the same face.

Suppose someone is the same height, and does exactly the same things once they get inside. But what if their face is different every time they come? The photo on the wall never recognizes them, not once.

That is what happened on our server yesterday.

First, about our server

FACT We run a honeypot. A honeypot is a bait server deliberately left loosely open. It’s there so we can watch who comes and what they do. The story below is not actual damage. It is an observation record.

FACT There are two bait servers. On Sensor 01, if the password matches, you really can get in. The commands typed and the files pulled down get recorded. Sensor 02 has doors that never open. It only notes who knocked on which door and how many times. Today’s story comes mostly from Sensor 01.

FACT Names starting with ATK- are aliases we assign per origin. Origin IPs are written with the trailing portion hidden. Addresses that served files are written like 185[.]228[.]72[.]128, wrapping the dots in brackets. It’s a notation deliberately broken so that it won’t connect even if you click it by accident. This is called defanging.

One term for today: hash

FACT A hash is a unique number computed from a file’s contents. Change a single character and a completely different number comes out. That’s why the security field identifies files by hash. A list collecting the hashes of bad files is called a hash blocklist.

Put back into the security-office metaphor, it goes like this. The hash is the face photo, and the hash blocklist is the list of photos taped to the wall. File size is roughly the height.

The same person came again

FACT It was 9:57 p.m. on October 18 (Korea time). ATK-1B78D6 (177.46.x.x) came in over Telnet and logged in successfully. Telnet is an old channel for connecting to a distant machine and typing commands. What travels over it is not wrapped in encryption.

FACT This visitor stayed for 75.34 seconds. In that time it typed 559 commands. That works out to more than 7 per second. It’s not a speed human hands can produce. It also pulled down 22 files.

FACT The number 559 is not a first. We saw it five times on October 13 and twice on October 15. The origin was different each time. Yet the command count was identically 559.

FACT Fifty-six minutes later, ATK-AB8FF6 (185.40.x.x) came in. 82.15 seconds, 559 commands, 22 files. The same as the previous visitor.

FACT Then two more places came. ATK-B91DF4 (42.100.x.x) ran 531 commands, and ATK-8BA6EA (113.221.x.x) ran 532. That’s 27–28 fewer than 559. The files they pulled down were one fewer too, at 21.

FACT All four intrusions began within 1 hour, 8 minutes, and 32.69 seconds. That’s about once every 17 minutes. All four matched on what they were trying to do (intent classification). File download, granting execute permission, execute after download, trace deletion. Those four.

“Granting execute permission” means attaching the marker “it’s okay to run this” to a file you received. On Linux, without that marker you can’t launch a file. “Trace deletion” means erasing the record that you came and went.

INFERRED The four origins differ from each other starting at the leading part of the IP. Yet what they do is identical. Rather than someone typing by hand, this looks closer to the same automated program running on several already-infected devices. In the security-office metaphor, it’s one person with the same height and the same gait showing up in different clothes each time.

This time the face was different

Up to here, it’s a scene we also saw last week. What was different lay in the files these four visitors pulled down.

FACT All four pulled down the same two files.

Look at the second row. The size doesn’t differ by a single byte. But the hash is different. Same height, only the face changed.

FACT wget.sh is, just as the name says, a note containing the command for pulling a file down from the internet (wget). The .sh means it’s a file listing commands in order (a shell script). This one is 11 bytes bigger than last time. Eleven characters of English, a difference of two or three words.

FACT The address that served this file, 185[.]228[.]72[.]128, appears nowhere in our past 38 logs. The same goes for the hashes of the two files. The aliases of all four visitors were also ones we were seeing for the first time.

FACT 1,196 bytes is about 1,196 characters of English. Roughly six sheets of manuscript paper. A size that fits on one page of a notebook. Renesas SH is the name of a chip. A chip is a machine’s brain, and each kind understands a different language. That’s why executables are built separately for each chip type.

INFERRED The 559 commands are unchanged. What changed is only the address serving the files and the files’ hashes. If you had built a blocklist from the hashes of three days ago, yesterday’s file would not have been caught by that list. The photo on the wall went stale in three days.

559 versus 531 — what’s the difference?

FACT There is one more file, a 202-byte shell script (0c99433c…). It’s an already familiar face, appearing in seven logs since August 21. Yesterday, only the two places with 559 commands pulled it down. The two with 531 and 532 did not.

INFERRED The 531/532 side has 27–28 fewer commands and one fewer file pulled down. That difference could be the step of pulling down and handling that one 202-byte file. But we could not confirm it, because we don’t have the raw command text.

The fastest yet

FACT The 559-command sessions lasted 79.27–104.73 seconds on October 13, and 104.25–107.69 seconds on October 15. Yesterday’s first visitor was 75.34 seconds. That’s the shortest among all 559-command sessions we’ve seen. It beats the previous shortest record by 3.93 seconds.

Laid out in time order

Laying out yesterday in time order gives this. From the second row through the fifth, notice how the gap between visitors shrinks: 56 minutes → 7 minutes → 2 minutes.

1. 2026-10-18T09:09:41.818Z (18:09:41 KST)
   FACT ATK-D385E9(185.41.x.x) logged in over Telnet successfully. 76.47 seconds, 33 commands, 19 downloads. intents was 1 kind, trace deletion; completeness 66; TTY recording present. It pulled down the 1-byte empty file (01ba4719…) but not wget.sh or the Renesas SH file
2. 2026-10-18T12:57:36.952Z (21:57:36 KST)
   FACT ATK-1B78D6(177.46.x.x) logged in over Telnet successfully. 75.34 seconds, 559 commands, 22 downloads. intents 4 kinds, completeness 81
3. 2026-10-18T13:54:10.300Z (22:54:10 KST)
   FACT 56 minutes 33.35 seconds after the previous session started, ATK-AB8FF6(185.40.x.x) came in. 82.15 seconds, 559 commands, 22 downloads, intents 4 kinds, completeness 81. Same as the previous session
4. 2026-10-18T14:02:36.388Z (23:02:36 KST)
   FACT 7 minutes 03.94 seconds after the previous session ended, ATK-B91DF4(42.100.x.x) came in. 91.84 seconds, 531 commands, 21 downloads, intents 4 kinds, completeness 78
5. 2026-10-18T14:06:09.643Z (23:06:09 KST)
   FACT 2 minutes 01.42 seconds after the previous session ended, ATK-8BA6EA(113.221.x.x) came in. 91.71 seconds, 532 commands, 21 downloads, intents 4 kinds, completeness 78. From the first session to here, four intrusions of the same shape within 1 hour 08 minutes 32.69 seconds
6. Whole day
   FACT All four sessions pulled down wget.sh (e06be431…, 1,498 bytes, hxxp://185[.]228[.]72[.]128/wget.sh) and the Renesas SH executable (453505bf…, 1,196 bytes). Both files 4 times, from 4 places
7. Whole day
   FACT The 202-byte shell script (0c99433c…) was pulled down only by the two 559-command sessions (ATK-1B78D6, ATK-AB8FF6). The two 531/532-command sessions did not pull it down
8. Whole day
   INFERRED The 531/532 variant has 27–28 fewer commands and 1 fewer download than the 559 variant. That difference could be the step of pulling down and handling the one 202-byte script. We could not confirm it, as we don't have the raw command text
9. Archive comparison
   FACT Durations for the 559 variant were 79.27–104.73 seconds on 10/13 and 104.25–107.69 seconds on 10/15. Today's 75.34 seconds is 3.93 seconds shorter than the minimum of that range
10. Archive comparison
    INFERRED Four origins differing in the first two octets ran the same bundle of commands. This looks closer to the same automated tool running on different infected devices than to someone typing by hand. Because it's Telnet, the SSH fingerprint is empty, so we cannot confirm it by fingerprint
11. Whole day
    FACT ATK-9A068C pulled down bot.arc (18 times), bot.arm4 (18 times) and bot.arm5 (16 times) from 143[.]20[.]154[.]42. The three hashes match the 10/15 log, and the alias is not in the archive

The more visitors came, the faster the next one arrived. The last two came in two minutes after the previous one left. And look at the bottom row. The three bot.* files we saw on October 15 had unchanged hashes. This time the origin alias was new. Some files changed their face; some files came back having changed only the person.

What to watch instead of the photo

If the photo on the wall doesn’t work, the guard has to watch something else. Behavior. Yesterday’s four visitors had different faces, but the same behavior. And that behavior contained one step that cannot be skipped.

FACT All four visitors, after logging in, pulled files down from an outside address. Across the whole day, 394 commands were classified as “file download” and 340 as “execute after download”.

INFERRED No matter how much an attacker changes the hash, they cannot change the order that requires bringing the file in from outside. In security-office terms, rather than memorizing a suspicious person’s face, it’s the side that sets the rule “people in this building don’t go wandering into just any outside storage room.” The photo went stale in three days, but this rule holds even when the face changes.

Addresses you only see after unpacking

FACT Besides the addresses visible on the surface, there were hidden ones too. UPX is a tool that compresses an executable to shrink it. With a compressed file, you can’t see the text inside from the outside. There were 12 addresses that only appear once you unpack that compression. All of them were under 31[.]77[.]227[.]121/bins/, on paths by chip type. This address has been in our records since August 19.

FACT A blocklist built by looking only at the surface would not include these 12. It’s like how you can’t see a face if you don’t take the hat off when taking the photo.

Values to write down

These are the values the defending side would put on its list. Click a value to copy it. Addresses are left defanged as-is.

The top three lines are the photos to newly tape up today. The bottom two lines are faces that should already be on the list. The 1-byte file is exactly one character in size, and it came down 133 times in a day. And to say it again: the top three lines may be stale by next week.

All of yesterday

FACT These are Sensor 01’s numbers for the day.

FACT There are also totals for commands grouped by “what they were trying to do”. System reconnaissance 2,296, granting execute permission 1,414, file download 394, execute after download 340, cron registration 103, trace deletion 80, mining 55, planting an SSH key 19. Cron is a scheduling feature that automatically re-runs a command at set times. Planting an SSH key means writing a key that lets you in without a password into the server’s authorized_keys (the list of permitted keys).

FACT Today’s four visitors had neither cron nor key planting. They pulled down, ran, erased, and left. The stage of settling in and staying put isn’t in the record.

FACT Screen recordings (TTY) numbered 3,036. The session count of 3,846 and the 3,234 login attempts are each counted separately. The reason the session count is 13 higher than the per-door total (3,833) is written in “What We Don’t Know” below.

The server whose doors don’t open: Sensor 02

FACT On Sensor 02, VNC, the screen-sharing channel, was knocked on 63,607 times. A day is 86,400 seconds, so that’s roughly once every 1.4 seconds. Still, it’s fewer than October 15 (84,222, the highest so far). The 344 origins is also fewer than October 13 (438, the highest). Yesterday no record was broken on Sensor 02.

FACT For the version number the two sides negotiate on a VNC connection, 003.008 appeared 42,741 times and 003.003 20,703 times. 003.008 is 67.4%. In the name-tag field (cookie) of the first RDP connection request, hello was written 1,274 times and <ip> 477 times.

INFERRED On the SMB side, the other party presented even 1990s-era spec names all at once (NT LM 0.12 41 times, LANMAN1.0 35 times, and so on). It reads as the way a scanning program works, trying to find whichever version fits.

FACT Two files were left on Sensor 02 as well: 333a9ccd… (152 times) and 0c3ad275… (60 times). Both are 206,176 bytes, and both came from ATK-412FD8. Neither the hashes nor the alias appear in past records.

Are you using this password?

FACT Of the ID/password combinations that came into Sensor 01 yesterday, we reproduce only those that appeared from multiple distinct origins and are therefore permitted to quote.

FACT admin / admin appeared 192 times from 41 origins. That’s 4.7 times per origin on average. It amounts to each origin knocking fewer than five times before handing off to the next.

FACT Combinations that appeared from fewer than 3 origins number 2,339 kinds. Since they could be actual leaked accounts, we don’t carry the values, only the count. It’s the fifth highest among the past 38 logs. The days with more were October 8 (3,212), October 4 (3,026), October 13 (2,633) and September 7 (2,527).

Mapping the methods to the international classification table

Matching the methods the attacker used to the numbers in the international classification table called MITRE ATT&CK gives this. Click an ID to see the original description.

• T1078.001Valid Accounts: Default AccountsINFERRED
• T1110.001Brute Force: Password GuessingINFERRED
• T1059.004Command and Scripting Interpreter: Unix ShellINFERRED
• T1105Ingress Tool TransferINFERRED
• T1222.002File and Directory Permissions Modification: Linux and MacINFERRED
• T1070Indicator RemovalINFERRED

Those six lines are exactly the four visitors’ route. They come in on a factory default account (T1078.001), guess the password (T1110.001), use the command shell (T1059.004), bring files in from outside (T1105), attach the execute marker (T1222.002), and erase traces (T1070). The faces changed, but this table is the same as last week’s. The reason all of them are “INFERRED” is that we are the ones who attached our command classification results to this table.

There has been a shape like this before

FACT In the password table above, root / xc3511, root / vizxv, root / juantech and root / xmhdipc are values found in the default password list of the Mirai source code published in 2016. Mirai was a botnet that infected small devices like routers and cameras and drove them all at once. A botnet means a group of many infected devices that one person bundles together and controls.

INFERRED The route in over Telnet is similar too. Bringing in executables for router and embedded-device chips (ARC, ARM, Renesas SH) also overlaps with methods of the same family. That said, we did not confirm whether yesterday’s files are a branch off Mirai. File classification results are not in the record. (Reference: US CISA alert TA16-288A)

So what should you do?

The photo list has to be kept patched up. Below it is a rule that lasts longer than that. The likelihood of compromise is carried over exactly as judged in the brief.

1. Using factory-shipped accounts and easy passwords as-is · high likelihood of compromise INFERRED admin / admin appeared 192 times from 41 origins. All five of yesterday’s main sessions logged in successfully. If a device still has its factory password, it opens right up to a program running the same list. What follows is the same order we saw yesterday. A file comes in, the execute marker gets attached, and the device runs on someone else’s commands.

2. Using only password login and not key-based login · high likelihood of compromise INFERRED Telnet has no key-based method. The door opens if just one password matches. All five successful intrusions yesterday came in by this path. On top of that, the password travels without being wrapped in encryption, so it’s easy to eavesdrop on in transit.

3. Leaving the administration door open directly to the internet · high likelihood of compromise INFERRED 221 origins knocked on Sensor 01’s doors in a day. An administration door left open outside should be assumed to be found within a day. If the two items above are loose, it gets breached the same day.

4. No reconnection limits (fail2ban, rate limit) · medium likelihood of compromise INFERRED fail2ban is a program that temporarily blocks an origin that gets the password wrong several times. Yesterday’s login attempts averaged 14.6 per origin. Looking only at admin / admin, it’s 4.7 per origin. That’s around the common blocking threshold (say, 5), so if they spread the knocking across many origins, some get through. Hence “medium”.

5. Not blocking outbound connections from devices · high likelihood of compromise INFERRED Today’s conclusion is right here. Every step after login was the device going out to an outside address to fetch a file. If the device could not go out to just any outside address, yesterday’s deliveries would have failed. Regardless of whether the hash changed or the address changed. It’s the way of blocking the route instead of the photo.

6. Not collecting records off-device (no log collection, no EDR) · high likelihood of compromise INFERRED Trace-deletion commands appeared 80 times in a day. They were present in all five main sessions. ATK-D385E9 did nothing but trace deletion. If records live only inside the device, they vanish the moment they’re erased. An intrusion that finishes in 75–92 seconds, like yesterday’s, is not a length a person watching a screen can catch. EDR is a security program that monitors suspicious movement inside a device and reports it outward.

What We Don’t Know

This section is the most important part of this log. It’s where we draw the line on how far what we said above holds.

About the changed face

• [Cannot confirm] We have no basis for judging whether 185[.]228[.]72[.]128 and 176[.]65[.]139[.]40 from October 13 and 15 are the same operator. All that is confirmed is that the command bundle is the same.
• [Cannot confirm] We don’t know whether wget.sh (e06be431…) is a script that fetches the Renesas SH executable or files for other chips. The script’s contents are not in the brief. Of the 22 downloads, only some are confirmed by stored hashes.
• [Cannot confirm] The Renesas SH executable 453505bf… is small, at 1,196 bytes. It looks like a small first stage that pulls down other files, but that is only an inference. File classification results (MalwareBazaar tags) are not in the record.

About the same behavior

• [Cannot confirm] The reading that the difference between the 531/532 and the 559 variants is the 202-byte script step is an inference drawn from the difference in the “who pulled down which file” record. We did not verify it, as we don’t have the raw command text.
• [Cannot confirm] The reading that the four origins use the same program rests on the command counts, intent classification and pulled-down files being the same. Because it’s Telnet, we cannot confirm it by the connecting program’s fingerprint (hassh). In any case, we can say only as far as “the same tool.” There is no basis for saying “the same organization.”

About the numbers and the reporting

• [Cannot confirm] Sensor 01’s session count of 3,846 is 13 higher than the per-door total of 3,833. The raw material cannot tell us whether there are sessions with no door number or channel recorded.
• [Cannot confirm] We wrote the Telnet door as 2223 because the Telnet session count (1,366) and the door-2223 session count (1,366) are the same. The main session records themselves have no door-number field.
• [Cannot confirm] The 842 origins across both sensors combined is a maximum. Since we don’t know how many origins came to both sides, the real number may be lower.
• [Cannot confirm] For Sensor 02’s ADB there is only the contact count of 415, with no detailed record. We cannot confirm what came in over ADB, or whether the two 206,176-byte files came in over ADB.
• [Cannot confirm] We could not count whether a single origin moved around multiple doors on Sensor 02, as there is no per-origin record.
• [Cannot confirm] The new distribution point 185[.]228[.]72[.]128 is subject to reporting to C-TAS (the Korea Internet & Security Agency’s threat information sharing system). However, only transmission success has been confirmed. Whether it was actually registered with KISA has to be checked separately.
• [Cannot confirm] The list of addresses in the record contains a Discord webhook address. A webhook is an address that automatically sends messages into a messenger room. Which session or file it connects to is not in the brief. Because the address contains a secret token, we do not carry the original.

What we do not judge at all

• Carrier / organization (ASN, ISP): We have no relevant database. We do not infer.
• Geographic location: Unknown for the same reason. An IP’s geographic information cannot serve as a basis for identifying who did it in the first place. This post does not point to any country, company or individual as the attacker.
• VPN / Tor / cloud status: We have no means of determining it.
• VirusTotal: Not integrated. File classification uses MalwareBazaar tags.
• Connecting program string (User-Agent): Neither sensor is a web (HTTP) server. Sensor 01 is SSH and Telnet; Sensor 02 is SMB, RDP, VNC, MSSQL, LDAP and ADB.
• Vulnerability number (CVE) linkage: SSH and Telnet attacks mostly do not reference a specific vulnerability. The same goes for Sensor 02, since it’s at the stage of matching connection protocols.

The photo on the security-office wall is useful. It stops people who come back with the same face. Yesterday, too, the three bot.* files from October 15 came back with the same face.

But the 559-command visitor was different. The height stayed 1,196 bytes. The behavior stayed 559 commands. Only the face changed, and it came back within three days. If we had trusted the photo list alone, all four would have been visitors we were seeing for the first time.

Faces can change at any time. What doesn’t change is the route that requires bringing something in from outside. So there are two things to do. Change your router’s administrator password today. And block your devices from going out to outside addresses you don’t know.

The observation date is October 18, 2026 (a single day in UTC), and this post was written up the next day. The comparison set is the October 13 and October 15 logs and the 38 logs from August 16 to October 15. Origin IPs are carried over exactly in the masked form used in the brief (177.46.x.x, 185.40.x.x, 42.100.x.x, 113.221.x.x, 185.41.x.x) and were not restored. Addresses are kept defanged (hxxp://, [.]) so they won’t connect by accident. For credentials, only the 11 combinations observed from multiple distinct IPs and therefore permitted to quote are carried verbatim. For the 2,339 kinds that appeared from fewer than 3 origins, we state only the count and do not write the values. Items for which we have no means of measurement — carrier, nationality, VPN status — are left as “we don’t know” rather than inferred.