Chapter 1: The Script That Doesn't Steal

Let's start with what we found. Here is the exact command sequence, executed 94 times across 11 different source IPs between May 1 and June 15, 2026:

UNAME=$(uname -a)
ARCH=$(uname -m)
UPTIME=$(uptime)
CPUS=$(nproc)
CPU_MODEL=$(grep 'model name' /proc/cpuinfo | head -1)
GPU=$(lspci | grep -i 'nvidia\|vga')
CAT_HELP=$(cat --help 2>&1 | head -1)
LS_HELP=$(ls --help 2>&1 | head -1)
LAST=$(last | head -5)

for d in "$HOME" /var/tmp /tmp /dev/shm; do
  if [ -w "$d" ]; then
    echo "WRITABLE:$d"
    break
  fi
done

Read it carefully. This is not a novice attacker fumbling through commands. This is structured reconnaissance — a function call that returns structured data about the host's compute capabilities. Let's break down what each variable tells the operator:

The last element — the writable directory probe — is the tell. This isn't passive intelligence gathering. This is a logistics team confirming that the warehouse has a loading dock. They're not here to observe. They're here to decide whether to come back.

Chapter 2: The Eleven IPs — A Network That Shouldn't Exist

Here's where it gets interesting. These aren't eleven random bots. Our threat intelligence platform identified them through a shared HASSH fingerprint — a cryptographic signature derived from the SSH client's key exchange algorithms. Same fingerprint = same exact SSH client software = same operator.

Campaign ID: hassh-2ec37a7cc8daf20b

Entity links: 68 shared_hassh edges — a fully interconnected mesh.

Notice the pattern. Six out of eleven IPs are on bulletproof hosting — three on Omegatech (AS202412), three on TechTies (AS197170). Both are Seychelles-registered shell companies. Both use the same German transit provider. Both are on Spamhaus's ASN-DROP list.

The remaining five are on legitimate cloud providers (DigitalOcean, AWS, E2E Networks). These are almost certainly compromised instances being used as scan proxies — providing geographic diversity and IP reputation laundering for the operation.

One IP stands out: 157.230.112.58 (DigitalOcean, Germany). While all others run the generic lspci GPU detection, this one went further:

nvidia-smi --query-gpu=name --format=csv,noheader

This is not reconnaissance. This is inventory confirmation. The operator already knows this host has an NVIDIA GPU (from a previous lspci scan) and is now querying the exact model name — presumably to calculate expected hashrates before deploying a mining payload optimized for that specific card.

Chapter 3: The Geography of a Kill Chain

Map these eleven IPs and a structure emerges:

This is why we only see the reconnaissance and never the payload. Our honeypot is a server without NVIDIA hardware. When the script runs and GPU=$(lspci | grep -i 'nvidia\|vga') returns empty or only a basic VGA controller, the operator marks this host as low-value and moves on. The mining payload is reserved for hosts that pass the GPU check.

We're seeing the casting call. Only the machines with the right hardware get the part.

Chapter 4: The Credential Strategy

The brute-force credentials used by this cluster tell their own story:

root / password
root / 123456
postgres / postgres
oracle / qwerty
admin / admin123
ubuntu / ubuntu

These are not sophisticated. They're not targeted. They're the SSH equivalent of trying every door handle in a hotel corridor. The strategy is volume — hit enough servers, and a percentage will have weak credentials. Of those, a smaller percentage will have GPUs. Of those, some will have writable directories for payload staging.

It's a funnel. A sales funnel for stolen compute.

Chapter 5: E2E Networks — The Interesting One

Among the eleven IPs, one deserves special attention: 216.48.191.18, hosted on E2E Networks (AS132420) in India. E2E Networks is not a generic cloud provider. It's specifically a GPU cloud computing platform — they rent NVIDIA A100, H100, and L40S instances for AI/ML workloads.

Think about what this means. One of the scan nodes in this GPU-hunting botnet is itself hosted on a GPU cloud provider. Two possibilities:

1. Compromised customer instance — an E2E Networks customer had their SSH credentials brute-forced, and now their instance is being used as a scan node. Ironic: a GPU cloud host being used to find more GPUs.
2. Purchased legitimately — the operator rented an E2E instance (cheap in India) specifically as a scan node, knowing it would have excellent network connectivity to other GPU-capable infrastructure in the region.

Either way, it reveals the operator's sophistication. They understand the GPU cloud ecosystem well enough to either target it or use it as staging infrastructure.

Chapter 6: What Happens After — The Payloads We Don't See

Our honeypot catches the reconnaissance. But published research tells us exactly what comes next:

Scenario A: XMRig with CUDA/OpenCL (Gafgyt Pattern)

Aqua Security documented this exact pipeline: SSH brute-force → GPU detection → XMRig deployment with --cuda and --opencl flags. The miner auto-detects the GPU model and optimizes its configuration. Monero is the preferred currency because its privacy features prevent blockchain analysis of payments.

Scenario B: ShadowRay Propagation

If the compromised host runs Ray (the AI framework), the attacker exploits CVE-2023-48022 to gain code execution without authentication. The worm then propagates to other Ray nodes in the cluster — potentially gaining access to entire GPU farms through a single entry point. 230,000+ Ray servers are publicly accessible.

Scenario C: Sysrv-hello Deployment

The Go-based worm checks nvidia-smi (exactly as our IP 157.230.112.58 does), deploys an optimized miner, kills competing miners, steals SSH keys for lateral movement to find more GPU hosts, and uses 20+ CVE exploits for privilege escalation. Active since December 2020, confirmed still operational December 2024.

Scenario D: AI Workload Hijacking (Emerging)

The newest frontier: compromised GPU servers are used not for mining but for unauthorized AI inference — running commercial LLM inference endpoints on stolen compute. A single A100 generates $5-15/hour selling inference via API. This is 10-50x more profitable than mining but requires more sophisticated deployment.

Chapter 7: The Numbers

Chapter 8: Why This Matters Now

In 2020, compute was cheap. In 2026, it's the scarcest resource in technology. NVIDIA GPUs have waiting lists measured in quarters. Cloud GPU instances sell out within minutes of becoming available. The cost of an H100 hour on legitimate markets is $3-8.

This creates an obvious economic incentive: why buy compute when you can steal it?

Our GPU reconnaissance botnet is not an isolated actor. It's a symptom of a structural shift in cybercrime economics. When the most valuable thing on a server is no longer the data it holds but the hardware it runs on, the entire attack model changes:

• Data theft requires exfiltration, monetization, and risk of exposure
• Compute theft requires only stealth — the resource generates value silently, indefinitely
• GPU mining at scale is less detectable than ransomware or data theft
• The victim often doesn't know — they just see higher power bills

This is the shift. And the infrastructure we've mapped — Omegatech, TechTies, Pfcloud, Virtualine — is the backbone that makes it possible at scale.