The Borrowed Face: Tools That Wear a Legitimate Identity

TI-2026-075T · The Armory, Part T Confidence: HIGH — direct honeypot classification + multi-source corroboration Classification: TLP:WHITE

The tier the classifier cannot call

Most of the census sorts cleanly. A libssh scanner is a scanner; a Go swarm client is a botnet; a Hydra fingerprint is an auditor. But beside those confident labels sits a large, awkward population the classifier marks — honestly — as ambiguous. Roughly 958 IPs presenting as OpenSSH_7.4 (HASSH acaa53e0a7d7ac7d1255103f37901306), about 92 as OpenSSH_8.x (98ddc5604ef6a1006a2b49a58759fbe6), and a further group presenting legacy OpenSSH. Over a thousand sources the census refuses to confidently call attacker or legitimate.

The label is not a failure of the classifier. It is the classifier being truthful about a genuine problem: these clients present the banner of a normal OpenSSH build — the identity carried by the overwhelmingly legitimate population of real administrators and real automation. And from the tool alone, there is often no way to tell whether a given one is a sysadmin doing their job or an attacker wearing the sysadmin's face.

That is the subject of this letter. Every other tier of the armory announces something suspicious about itself. This one announces the opposite — I am ordinary — and does so precisely because ordinary is the best disguise there is.

The one identity worth stealing

To see why the OpenSSH banner is the most valuable disguise in the census, think about what a defender does with each client identity. A libssh scanner? Suspicious — nobody's staff uses a raw libssh build to log in. A Go SSH client? Suspicious. A Hydra fingerprint? Openly hostile. Every one of those identities is safe to scrutinise or block, because no legitimate user wears them.

Real OpenSSH is the exact opposite. It is the client a defender sees ten thousand times a day — from their own engineers, their own deployment pipelines, their own monitoring. It is the one client identity that cannot be reflexively blocked, because blocking it breaks the organisation's own access. And that is precisely what makes it worth stealing. To hide an attack, wear the face of the traffic that must be allowed. An attacker announcing OpenSSH is hiding in the single largest blind spot every defender is forced to leave open.

The sheer size of the ambiguous OpenSSH tier — over a thousand IPs — is a direct measure of how attractive that camouflage is. When the disguise is this good, a lot of attackers wear it.

The banner lies; the handshake does not

The disguise has a seam, and finding it is the whole defensive game of this letter. It rests on a distinction the series has used throughout, sharpened here to its point: the banner is controlled by the attacker; the HASSH is not.

An SSH client volunteers a banner string — SSH-2.0-OpenSSH_7.4 — as a plain, self-declared label. It is trivially editable. A scanner can set its banner to anything: OpenSSH 7.4, OpenSSH 9.0, a Cisco device, whatever it wants to appear to be. The banner is a name tag the attacker writes themselves, and a name tag proves nothing.

The HASSH is a different kind of thing. It is computed from the actual list of algorithms the client offers during negotiation — the real key-exchange methods, ciphers, and MACs its code was built to propose, in the exact order it proposes them. That order is a property of the real tool build, not a string the operator types. To forge a convincing HASSH, an attacker cannot just edit a label; they must rebuild their client to negotiate byte-for-byte like the client they want to impersonate — far harder, and far more rarely done, than changing a banner.

So the banner is the mask and the HASSH is the face beneath it — and, crucially, the two do not have to match. A tool can wear an OpenSSH name tag while its handshake betrays that it is something else entirely.

The mismatch is the unmasking

This gives the defender a clean test. When a client's volunteered banner and its involuntary HASSH agree with a known-genuine OpenSSH build — the banner says 7.4, and the handshake matches what real OpenSSH 7.4 actually negotiates — the client is plausibly what it claims. When they disagree — a banner announcing OpenSSH over a HASSH that belongs to some other, portable tooling build — the tool is wearing a borrowed face, and the mismatch is the moment the mask slips.

The corpus has caught this exact pattern in the wild. Echo BMOK Revisited (TI-2026-015B) documented a portable HASSH — eeca2460 — that appeared on a real, unrelated, legitimate business host while announcing a normal OpenSSH banner. The banner said "ordinary client on an ordinary machine." The handshake said "the same portable attacker tooling seen everywhere else, carried onto this host." The fingerprint was a property of the operator's carried tooling, not of the compromised machine it was running from — and the banner/HASSH relationship was what exposed it. The host looked innocent; the handshake did not.

That is the borrowed face laid bare: an operator's real tool, run under a stolen identity, betrayed by the one part of its identity it could not easily forge.

A disguise you can turn into a thread

There is a defensive gift hidden in the deception. Because a spoofing operator's real tooling produces a consistent HASSH, that handshake becomes an attribution thread that survives the disguise. The banner changes; the host changes; the source IP changes. But the portable HASSH beneath the borrowed OpenSSH banner stays the same, because it is the operator's actual toolkit. So a defender can link a borrowed-face operator across many victims and many hosts by clustering on the handshake, independent of whatever banner it is wearing that day.

The mask is meant to make the attacker look like everyone else. The face beneath it makes them look like only themselves, everywhere they go. Cluster on the face, and the disguise that was meant to grant anonymity instead becomes a fingerprint that follows the operator from host to host.

The disguise hides the tool, not the act

And yet — the series' oldest lesson returns to close the letter — even a perfect impersonation of OpenSSH, banner and HASSH both convincingly matched, cannot hide the thing that actually matters. Because tool identity was never the reliable signal. Behaviour is.

A genuine administrator wearing the OpenSSH face connects to machines they manage and does administrator things. An attacker wearing the identical face still sprays credentials, still runs reconnaissance, still targets machines that are not theirs. The borrowed face can make the tool unreadable — can defeat every attempt to classify the client by its identity — and it still cannot make the act look legitimate, because the act is aimed at strangers, and no name tag changes who you are aiming at.

This is why The Borrowed Face is the deception layer's proof of The Weapon Is Never the Point (075I). When the tool itself can lie — when even the fingerprint can, with enough effort, be forged — the only signals left standing are the ones the attacker cannot fake without ceasing to attack: consent, target, and behaviour. The disguise defeats identity-based defence entirely. It does not touch behaviour-based defence at all. The attacker can borrow any face they like; they cannot borrow a reason to be attacking you.

Reading the borrowed face — for defenders

• Never attribute on the banner. It is attacker-controlled and trivially forged. Maintain known-genuine OpenSSH banner/HASSH pairs and flag any client whose banner and handshake disagree as a likely spoof.
• Do not treat OpenSSH as benign. It is the most valuable disguise precisely because you must allow it. Apply the same behavioural scrutiny to OpenSSH-presenting sources as to any other identity.
• Cluster borrowed-face operators by HASSH across hosts. A portable fingerprint appearing on multiple unrelated hosts under OpenSSH banners is one operator's carried toolkit — an attribution thread the disguise cannot cut.
• Resolve the ambiguous tier on behaviour. Genuine or spoofed, the question that decides it is the same: does the source target machines it is authorised to reach, or strangers? The act is the signal the mask cannot cover.

The census is mostly full of tools that tell you what they are. This letter is about the ones that lie — that wear the trusted face of the ordinary client to walk past a defence built on identity. The mask is good; over a thousand IPs wear it. But the face beneath is harder to forge than the mask, the same face shows up on every host the operator touches, and the act the mask hides is still, unmistakably, aimed at someone who never agreed. You cannot always trust the name a client gives you. You can always ask whose door it is knocking on.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-075A — The Armory: What 12,000 Attackers Carry — the ambiguous, legitimate-presenting tier of the census.
• TI-2026-015B — Echo BMOK Revisited — the portable-HASSH-under-legitimate-banner case.
• TI-2026-071H — H is for HASSH — the harder-to-forge identity that unmasks a spoofed banner.
• TI-2026-075I — The Weapon Is Never the Point — when the tool can lie, only consent, target, and behaviour remain.

This dossier documents observed adversary deception techniques for defensive purposes. OpenSSH is legitimate software; the finding concerns attackers impersonating its client identity, detectable by the banner/HASSH relationship and by behaviour. TLP:WHITE.