TI-2026-026O: The Convergence

"The truth is rarely pure and never simple."
— Oscar Wilde, The Importance of Being Earnest (1895)

This is the final dossier in a fifteen-part forensic investigation that began with a single anomaly in our honeypot logs and ended with the mapping of a state-affiliated cyber operation spanning 50 countries, 1,313 unique IP addresses, three coordinated attack campaigns, and an infrastructure budget exceeding six figures. What started as a question — who is scanning our SSH port? — became an anatomy of how the modern internet actually works: as a battlefield where the lines between state power, corporate infrastructure, and criminal enterprise have dissolved beyond recognition.

This dossier does not introduce new evidence. Instead, it does something harder: it forces every thread we've pulled across fourteen dossiers to converge into a single, coherent picture. And that picture is uncomfortable.

Chapter 1: What We Found — The Evidence Ledger

Fourteen dossiers. Eighty-nine days of continuous data collection. Twenty-nine thousand four hundred and fifty-two SSH sessions. One hundred and twenty-eight countries. And a single, uncomfortable conclusion that none of us wanted to reach but all the evidence demands.

Before we synthesize, let us inventory. Every claim in this series is grounded in evidence — and that evidence has been catalogued, cross-referenced, and preserved in our intelligence database. Here is what we found:

This is not a small investigation. This is a corpus — built session by session, IP by IP, over three months of continuous observation, enrichment, and analysis. What follows is what all of it means when you stop looking at the pieces and start looking at the picture.

Chapter 2: The Five Convergence Threads

Across fourteen dossiers, five distinct investigative threads emerged independently. Each was pursued for its own reasons, following its own evidence. But as the investigation progressed, these threads began to intersect — first tentatively, then unmistakably. The convergence is not something we constructed. It's something we discovered.

Chapter 3: The Attribution Assessment

Attribution is the most dangerous act in cyber threat intelligence. Done carelessly, it creates false narratives, provokes diplomatic incidents, and obscures the real threat. Done correctly, it enables targeted defense, proportional response, and accountability. We approach this with full awareness of the stakes.

What We Can Say With Confidence

What We Cannot Say

Intellectual honesty demands we acknowledge the limits of our evidence:

• We cannot name the specific operator. Despite reconstructing their daily schedule, team size, and timezone, we have no direct identification. The operator's OPSEC is effective.
• We cannot confirm the specific state agency. UTC+8 and Chinese infrastructure are necessary but not sufficient conditions for attributing to MSS, PLA, or any specific ministry.
• We cannot prove the Flax Typhoon connection. The tactical similarities are compelling but circumstantial. Many Chinese APT groups share TTPs.
• We cannot determine the ultimate objective. The botnet's capabilities support espionage, financial crime, and destructive attacks equally. We see the weapon; we don't see the target.

Chapter 4: The Ecosystem Map — How It All Connects

The Phantom ASN Ecosystem is not a single entity — it is a supply chain. Like any supply chain, it has suppliers, manufacturers, distributors, and customers. It operates across jurisdictions, exploits regulatory gaps, and has built-in redundancy at every level. Here is the complete ecosystem map as reconstructed from our investigation:

Layer 1: The Operator (Producer)

Layer 2: The Infrastructure (Manufacturing)

The operator's infrastructure is distributed across three tiers:

• Tier A — State Infrastructure: ChinaNet (93 nodes), BytePlus/Volcano Engine (44 nodes). These are the persistent backbone — tolerated by the Chinese government, difficult to take down via abuse reports, and providing the lowest-latency access to Chinese targets.
• Tier B — Cloud Infrastructure: Microsoft Azure (56 nodes across 15 countries), Google Cloud, various European VPS providers. These provide geographic diversity and are provisioned using stolen credit cards or compromised cloud accounts. Lifespan: 1-7 days before abuse response triggers shutdown.
• Tier C — Compromised Devices: Residential routers (Vodafone, FPT, Reliance Jio), IoT devices, Raspberry Pis. These are the 1,027 "flash fleet" nodes — used once and discarded. They provide volume without cost.

Layer 3: The Enablers (Distribution)

Between the operator and the internet, a layer of enabling infrastructure makes the operation possible:

• PIO-Hosting GmbH (AS198584, Germany): The gray-transit provider that routes traffic from bulletproof operations. Operated by XSServer GmbH (Marcel Edler, Rene Spellerberg).
• HBING Limited (AS208949, UK): A bulletproof hosting front registered by Russian nominee Olga Inag, directed by Turkish national Cihan Kaplan. Three continents, one shell.
• IPXO UAB (Lithuania): Vincentas Grinius's IP address marketplace that enables reputation laundering — taking IP blocks with bad reputation and selling them as "clean" to new operators.
• SkyLink Data Center BV (Netherlands): Dirk Bellgart's upstream provider for PIO-Hosting, providing transit connectivity.
• IPv4 Superhub Limited (Hong Kong): Chinese-controlled entity involved in IP reputation laundering.

Layer 4: The Shields (Legal Cover)

The operation is protected by layers of legal and jurisdictional shielding:

• British Virgin Islands: Shell company registrations (itweb-1-MNT) that provide opacity.
• Seychelles: Corporate registrations (Rea Ketty Barreau, Panama Papers connection) in a jurisdiction with minimal disclosure requirements.
• Panama: Additional shell company layers detected via ICIJ leak data.
• South Africa: AFRINIC IP allocations routed through European infrastructure — African address space used as European attack platform.

Layer 5: The Revenue (Customers)

The ecosystem generates revenue through multiple channels:

• DDoS-for-hire: 1,313 nodes can generate significant volumetric attacks. Market rate: $500-50,000 per attack depending on target and duration.
• Proxy services: Compromised residential IPs are sold as "residential proxies" for ad fraud, credential stuffing, and scraping. Market rate: $5-15 per IP per day.
• Initial access brokering: Successfully compromised servers with persistent access are sold to ransomware groups. Market rate: $500-50,000 per access depending on target value.
• Cryptocurrency mining: Compromised devices can be used for Monero mining. Revenue: minimal per device but significant at scale.

Chapter 5: The Governance Void — Why Nobody Stops It

Our investigation filed abuse reports, submitted evidence packages, notified CERTs across 12 countries, and documented criminal infrastructure with forensic precision. The response rate was approximately 4%. This chapter explains why.

The Abuse Report Graveyard

Dossier 026J documented the systematic failure of abuse reporting mechanisms. Let the numbers speak:

The abuse reporting system is predicated on a foundational assumption: that network operators have both the incentive and the ability to police their customers. This assumption was never true, and our investigation proves it empirically.

The Jurisdictional Arbitrage Machine

The Phantom ASN Ecosystem operates across a minimum of 7 jurisdictions in a single routing chain:

No single jurisdiction has authority over the complete chain. No bilateral treaty covers all seven countries simultaneously. The Budapest Convention on Cybercrime — the primary international legal instrument — has only 68 signatories. China is not among them.

The RIR Accountability Crisis

Regional Internet Registries (RIRs) allocate the IP addresses used by botnet operators. They are supposed to ensure accurate registration data and enforce allocation policies. Our investigation found:

Why Cloud Providers Don't Act

Microsoft Azure hosted 56 botnet nodes across 15 countries. Google Cloud hosted additional nodes. BytePlus/Volcano Engine (ByteDance's cloud arm) hosted 44 nodes. Why don't these companies simply ban botnet traffic?

The answer is economic: cloud providers make money from compute usage regardless of what that compute does. A botnet node spinning up 100 VMs across 15 countries generates the same revenue as a legitimate startup doing the same thing. The cloud provider's abuse team is a cost center; the sales team is a revenue center. In any conflict between the two, revenue wins.

Additionally, cloud providers face a detection problem. SSH brute-force traffic looks identical to legitimate SSH administration from the network perspective. The provider would need to inspect traffic content to distinguish legitimate from malicious use — which would require either breaking encryption or deploying behavioral analytics that generate false positives against paying customers.

Chapter 6: The Human Cost — What the Data Doesn't Show

Our investigation has dealt in IP addresses, ASN numbers, corporate registrations, and HASSH fingerprints. This chapter is about what happens at the other end of those connections — the human cost that no threat feed captures.

The Victims We Don't See

Our honeypot intercepted 29,452 SSH brute-force sessions. Each session represents an attempt to compromise a real system. Most failed — our honeypot is designed to capture, not to be useful. But across the internet, sessions like these succeed thousands of times daily. The typical victims:

The People Behind the Infrastructure

Our investigation identified real people operating the enabling infrastructure. They deserve examination as human beings, not just as data points:

• Cihan Kaplan (Turkey): Named director of HBING Limited. Is he a knowing participant in bulletproof hosting, or a nominee director who signed papers for a fee he can't refuse? In Turkey's economic crisis, nominee directorship of foreign companies pays €500-2,000 per year. For someone earning minimum wage (₺17,002/month ≈ €460), that's meaningful money.
• Olga Inag (Russia): HBING's Russian contact. The name pattern suggests a nominee identity rather than a real person. But if she is real — who approached her, and what was she told about what the company would do?
• Marcel Edler & Rene Spellerberg (Germany): XSServer/PIO-Hosting operators. These are real people running a registered German GmbH. They chose to operate in the gray zone between legitimate hosting and bulletproof services. German law enforcement knows about them. They continue operating. What does that tell us about enforcement priorities?

The Operators Themselves

Our temporal analysis (026N) reconstructed the operators' work patterns: UTC+8, Monday-Saturday, 09:00-18:00 with a lunch break. These are people. They commute to work. They eat lunch. They take weekends off (mostly). They celebrate Chinese holidays.

Who are they? Based on the operational profile:

Chapter 7: The Economic Engine — Follow the Money

Every investigation eventually leads to money. The Phantom ASN Ecosystem is not an ideological project — it is a business. A business with suppliers, customers, operating costs, and revenue streams. This chapter reconstructs the economics.

Revenue Model: The Multi-Stream Architecture

Modern botnets are not single-purpose tools. The Phantom ASN Ecosystem generates revenue across at least four simultaneous streams:

Operating Costs

The Insurance Subsidy

Perhaps the most perverse element of the botnet economy is the role of cyber insurance. The flow works like this:

1. Botnet operator compromises target via SSH brute-force
2. Access is sold to ransomware group for $5,000-$50,000
3. Ransomware group encrypts victim's data, demands $500,000-$5,000,000
4. Victim's cyber insurance policy pays the ransom (70%+ of insured victims pay)
5. Ransom payment (in crypto) flows back to the criminal ecosystem
6. A portion funds the next botnet campaign's operating costs

Insurance companies are therefore subsidizing the botnet economy. Premium dollars paid by legitimate businesses are converted into ransom payments that fund the infrastructure attacking those same businesses. It's a circular economy where the victim funds their own future victimization.

The State Subsidy Question

If this operation is state-affiliated — and our evidence strongly suggests it is — then the economics change fundamentally. A state-sponsored operation doesn't need to be profitable. It needs to be useful. The revenue streams may exist primarily to provide cover (making the operation appear criminal rather than state-directed) while the real value is in the pre-positioned access to critical infrastructure — an option with no market price but enormous strategic value.

Chapter 8: The Uncomfortable Questions — What If Everything Is Worse?

This chapter is different. Until now, we've operated within the boundaries of what the evidence directly supports. Here, we explore the implications that the evidence suggests but cannot prove — the scenarios that keep intelligence analysts awake at 3 AM, staring at the ceiling, wondering if they've connected enough dots or not enough.

Question 1: What If This Is Just The Visible Layer?

Question 2: What If The Corporate Layer Is Deeper Than We Found?

Question 3: What If This Is A Dry Run?

Chapter 9: The Defense Playbook — What Actually Works

After 14 dossiers documenting the threat, this chapter is about solutions. Not theoretical solutions — practical, implementable, evidence-based defenses that work against the specific threat profile we've documented.

Individual Organization Level

Industry Level

National/International Level

What Our Investigation Itself Demonstrates

Chapter 10: The Final Reckoning — What This Investigation Means

Fifteen dossiers. 1,313 identified botnet nodes. 22 named actors across 7 jurisdictions. Three coordinated campaigns launched simultaneously. 135,855 credential attempts. 86,530 entity relationships. One honeypot. One question: what does it all mean?

Finding 1: The Internet Has No Immune System

The most fundamental finding of this investigation is structural: the internet lacks an immune system. When a biological organism is invaded by a pathogen, the immune system detects the intrusion, identifies the threat, coordinates a response, and remembers the pathogen for future encounters. The internet has none of these capabilities at a systemic level.

Detection is fragmented — each organization sees only its own traffic. Identification depends on voluntary intelligence sharing that reaches approximately 5% of potential victims. Response is jurisdictionally constrained and commercially conflicted. And institutional memory is non-existent — the same botnet patterns that were documented in 2016 (Mirai) are still effective in 2026 because the underlying vulnerabilities were never addressed.

Our investigation didn't discover a new threat. We documented a systemic inability to respond to known threats. That's worse.

Finding 2: Attribution Is Possible But Meaningless

We achieved high-confidence attribution to a Chinese state-affiliated operation. The evidence is compelling: UTC+8 operational hours, Chinese holiday observance, ChinaNet backbone usage, BytePlus/Volcano Engine infrastructure, libssh tooling consistent with known Chinese APT clusters, and architectural patterns matching documented Flax Typhoon successor operations.

This attribution changes nothing. China does not extradite cybercriminals. It does not respond to diplomatic protests about cyber operations. It does not participate in the Budapest Convention. Sanctions against Chinese entities have not demonstrably reduced Chinese cyber operations. The attribution is intellectually satisfying and operationally irrelevant.

This is not cynicism. This is empirical observation. In the 26 years since the Moonlight Maze investigation (the first major state-sponsored cyber espionage case), not a single state-sponsored cyber operation has been permanently disrupted through diplomatic or legal channels. The attacker's identity is known. The attacker continues.

Finding 3: The Enabling Infrastructure Is The Real Target

If attribution doesn't lead to consequence, then the lever for disruption must be applied elsewhere. Our investigation identified the critical enablers:

Finding 4: Honeypot Intelligence Works

A single SSH honeypot, costing €120/year, generated sufficient intelligence to:

• Identify and characterize a 1,313-node botnet
• Map a multi-jurisdiction corporate front network spanning 7 countries
• Reconstruct operator work patterns with hourly precision
• Identify 22 named actors including companies, individuals, and state entities
• Generate 15 forensic dossiers totaling over 1 million words
• Produce actionable blocklists, IOC feeds, and STIX bundles

If every ISP in the world deployed a single honeypot — cost: approximately $1 million globally — the resulting intelligence network would provide near-complete visibility into global botnet operations. The cost of this defense is less than what a single ransomware victim pays in an average incident. The fact that this hasn't happened tells you everything about the misallocation of cybersecurity resources.

Finding 5: The Truth Is Distributed

No single data source told the story. The investigation required:

The truth about the Phantom ASN Ecosystem was distributed across dozens of databases, registries, intelligence platforms, and public records systems. No single source contained more than 10% of the picture. The investigation's value came from correlation — connecting an IP address in a honeypot log to a company in Companies House to a name in the Panama Papers to a BGP session in PeeringDB. This is the methodology of modern intelligence: not secret sources, but public data, intelligently combined.

The Final Question

The Complete Series: Phantom ASN Ecosystem Investigation

This is the fifteenth and final installment in the TI-2026-026 series. Each dossier built upon its predecessors, creating the most comprehensive publicly-available analysis of a state-affiliated botnet operation ever published from a single honeypot sensor.

Methodology

This investigation was conducted using the following sources and methods:

• Primary Collection: Cowrie SSH honeypot deployed in Romania, capturing full session transcripts, credentials, commands, file downloads, and SSH fingerprints. Collection period: May 2026 – ongoing.
• Enrichment Sources: AbuseIPDB, Shodan (InternetDB), GreyNoise, AlienVault OTX, VirusTotal, Censys, Pulsedive, ThreatFox, DShield, IPInfo, RDAP/WHOIS, Team Cymru, and passive DNS.
• Corporate Intelligence: UK Companies House, ICIJ Offshore Leaks Database, PeeringDB, BGP routing tables, certificate transparency logs (crt.sh).
• Active Reconnaissance: Tor-routed nmap, httpx, and nuclei scans against identified attacker infrastructure. All scans conducted through Tor to prevent attribution to the investigator.
• Government Sources: CISA advisories (AA24-038A, AA24-190A), FBI/CISA joint statements, Microsoft Security Blog reports, CrowdStrike Global Threat Report 2026.
• Intelligence Platform: Custom-built threat intelligence platform with PostgreSQL database (7,942 enriched IPs, 86,530 entity links, 3,735 SSH keys tracked), automated enrichment pipelines, and entity-link graph analysis.
• Attribution Analysis: Temporal pattern analysis, geographic distribution modeling, credential dictionary linguistics, SSH client fingerprinting (HASSH), and behavioral clustering.

Ethical Framework: No offensive operations were conducted against any infrastructure. Active reconnaissance was limited to port scanning and vulnerability identification (no exploitation). All data is derived from publicly available sources, the investigator's own honeypot, and legitimate intelligence platforms. Named individuals are identified based on public corporate filings and published records.

Confidence Calibration: Throughout this series, findings are explicitly tagged with confidence levels (HIGH/MEDIUM/LOW) and evidence quality indicators. Implications are consistently labeled as [DOCUMENTED] (directly supported by evidence) or [INFERRED] (logical conclusion from evidence, not directly proven).

Limitations: Single-sensor deployment provides incomplete visibility of the total botnet fleet. Attribution to specific state agencies is inferred from behavioral patterns, not direct evidence of government direction. Corporate connections identified through public records may not reflect current ownership or control structures.