⚙️ The Two Machines

I. Two Fingerprints, Two Functions

In TI-2026-058A we documented the Go Machine — a 22-node reconnaissance platform sharing HASSH fingerprint 2ec37a7cc8daf20b10e1ad6221061ca5. But our entity crosslink database reveals a second Go cluster with a different HASSH: eff4c24daffc8532c160e86e5f006e53.

Both clusters identify as SSH-2.0-Go. Both are compiled from Go. But they are different binaries — different key exchange negotiation produces different HASSH values. More importantly, their behavior is completely different:

Cluster 2 does not scan. It does not exploit. It does not steal. It sends one credential — admin:admin — and disconnects. Thousands of times. From six machines. With zero commands executed.

This is not a scanner. This is a clock.

II. The ISAEV-SOLDATOV Axis

The six signal nodes are controlled by two individuals, both registered in Kazakhstan:

ISAEV Igor — AS200730, registered in Kazakhstan, RDAP maintainer "ru-avm-1-mnt" (Russian). Three IPs in Polish hosting, all transmitting admin:admin exclusively.

SOLDATOV Alexey Valerevich — AS209702, registered in Kazakhstan, Bulgarian hosting. Previously documented in TI-2026-056E as operating the Codebook Stations network. Same HASSH fingerprint as ISAEV — same compiled binary.

The connection is definitive: ISAEV and SOLDATOV share the same Go binary (identical HASSH), both register their ASNs in Kazakhstan, both use Cyrillic-alphabet maintainer handles ("ru-avm-1-mnt", "soldatov-av-mnt"), and both transmit only admin:admin with zero post-authentication activity.

These are not two independent operators. This is one operation distributed across two legal entities for resilience. If SOLDATOV's ASN is seized, ISAEV's continues. If Poland blocks ISAEV, Russia (Proton66) and UAE (SERVERS TECH) provide redundancy.

III. The Volume Asymmetry

Consider the transmission volumes:

The ISAEV primary transmits 21× more frequently than the SOLDATOV backup. This is a primary/secondary architecture:

• 87.251.64.176 is the primary signal transmitter — high-frequency, continuous
• 80.66.66.10 and 37.77.150.119 are warm standby — low-frequency heartbeat confirming they're operational
• 89.124.97.231 (UAE) was deployed and tested once — it's a cold spare, pre-positioned but dormant

This is military-grade redundancy. The signal network has primary, secondary, and tertiary failover — the same architecture used in nuclear command-and-control systems to ensure message delivery under degraded conditions.

IV. Private Layer: The Swiss Vault

The largest single contributor to the admin:admin signal is not in Cluster 2 at all. It's 179.43.139.58 — a Private Layer INC node in Switzerland:

This station uses libssh2, not Go. It sends both admin:admin AND admin:123456. From our Codebook analysis (TI-2026-056F), the ratio between these two credentials encodes the operating mode:

• Normal mode: admin:admin to admin:123456 ratio = 1.32:1 (4,574 ÷ 3,456)
• This station has been in "normal" mode for its entire observed lifetime
• A shift to near-zero admin:admin (like the June 22 emergency burst) would indicate mode change

Private Layer INC is a Panamanian company operating Swiss infrastructure — the gold standard of bulletproof hosting. Panama provides corporate secrecy (no beneficial ownership disclosure). Switzerland provides data sovereignty (Swiss courts required for any seizure). The combination is effectively untouchable by any single nation's law enforcement.

V. The Architecture Emerges

We can now map the complete operational hierarchy:

┌─────────────────────────────────────────────────────────────┐
│                    COMMAND LAYER                              │
│                    (Unknown)                                  │
└──────────────────────────┬──────────────────────────────────┘
                           │
         ┌─────────────────┼─────────────────┐
         ▼                 ▼                  ▼
┌─────────────────┐ ┌───────────────┐ ┌──────────────────┐
│  SIGNAL ARM     │ │ PRIMARY RELAY │ │  RECON ARM       │
│  (Cluster 2)    │ │ (Private Lyr) │ │  (Cluster 1)     │
│                 │ │               │ │                  │
│ ISAEV (PL) x3  │ │ CH: 7,963 ses │ │ TechTies x7      │
│ SOLDATOV (BG)  │ │ admin:admin   │ │ Omegatech x2     │
│ Proton66 (RU)  │ │ admin:123456  │ │ DMZHOST x2       │
│ SERVERS (AE)   │ │ ratio=mode    │ │ UNMANAGED x3     │
│                 │ │               │ │ +8 misc nodes    │
│ admin:admin     │ │ BOTH creds    │ │                  │
│ ONLY            │ │ 0 commands    │ │ 9-phase payload  │
│ 0 commands      │ │               │ │ GPU/Telegram/GSM │
│ PURE TIMING     │ │               │ │ mdrfckr backdoor │
└─────────────────┘ └───────────────┘ └──────────────────┘
         │                 │                  │
         └────────┬────────┘                  │
                  ▼                           ▼
        ┌──────────────────┐        ┌──────────────────┐
        │ COORDINATION     │        │ ASSET DATABASE   │
        │ Wednesday 02:00  │        │ GPU inventory    │
        │ Sync/Mode/Order  │        │ Telegram accounts│
        │                  │        │ GSM gateways     │
        └──────────────────┘        │ Router access    │
                                    └──────────────────┘

Three arms, one organism:

1. Signal Arm (ISAEV/SOLDATOV): Transmits timing beacons. admin:admin only. No commands. The heartbeat that says "network operational."
2. Primary Relay (Private Layer): Transmits both credentials. The ratio encodes mode. Zero commands. Acts as the bridge between signaling and execution — it can switch modes.
3. Reconnaissance Arm (TechTies/Omegatech/mdrfckr): Executes the 9-phase payload. Inventories assets. Plants backdoors. The only arm that actually does something on target.

VI. The Latin American Proxy Layer

Beneath the three arms, a fourth layer operates: compromised residential machines in Latin America transmitting Chinese-language credentials through consumer ISPs:

The Mexican actor's credential vocabulary is a Chinese-language codebook:

A Chinese-speaking operator is routing traffic through compromised Latin American consumer connections. The credentials are not brute-force attempts — they're vocabulary. City names (foshan, yinchuan) as location codes. Service names (aliyun, zhihu) as platform identifiers. Game names (honkai3, pubg) possibly as product codes in an underground marketplace. And "yamaguchi" — the Yamaguchi-gumi is Japan's largest yakuza syndicate.

The Romanian vulgarism "sugipula" mixed with Chinese geography and Japanese organized crime references creates a linguistic fingerprint that points to a multi-ethnic criminal marketplace where the communication layer uses Chinese as its base vocabulary but the customer base spans continents.

VII. The Third HASSH: libssh Variants

Beyond the two Go clusters, the entity crosslinks reveal additional SSH client fingerprints tied to this network:

Six different SSH implementations. Six different roles. One network. The diversity is deliberate — if a threat intelligence vendor fingerprints one tool, the others continue operating. The only commonality visible without deep crosslink analysis is the temporal pattern (Wednesday primary, Tuesday setup) and the credential vocabulary overlap.

VIII. Named Individuals

Three named individuals have now been identified across this investigation series:

Two Kazakhstani registrations with Russian-language maintainers (ISAEV, SOLDATOV) operating the signal arm. One Ukrainian phone behind a UK front operating the secondary reconnaissance arm. All feeding the same Wednesday transmission schedule.

IX. Conclusions

The organism has differentiated cells. Signal cells that keep time. Relay cells that encode mode. Reconnaissance cells that harvest assets. Proxy cells that launder geographic origin. And somewhere, command cells that issue orders through the Wednesday window. The body is mapped. The brain is next.