The Research Bureau's Spray: A State Science Enterprise Hunting DevOps Credentials

TI-2026-084C · Borrowed Trust, Part C Confidence: HIGH — the institutional anchor and the credential behaviour are documented from RDAP/Cymru and honeypot telemetry; the specific host is characterised, not named. Classification: TLP:WHITE

Three tiers of a good name

Borrowed Trust has now borrowed two kinds of institution. Part A took a teaching university — the University of Chile's open engineering gateway. Part B took a national cyber-defence institute — NASK, the operator of Poland's CERT. This part takes the third tier: a state scientific research enterprise.

The subject is 194.107.115.199, announced by AS197984 — "unicon_uz, State Unitary Enterprise Scientific Engineering and Marketing Researches Center UNICON.UZ," Uzbekistan. A state unitary enterprise is a government-owned entity; this one does scientific and engineering research. Its address space carries the reputation of a state research body.

And what egresses that reputation is the most modern attacker in the series so far. Where Chile sprayed root:1234 and NASK guessed subdomains, this node went hunting for the keys to a devops stack.

The tell is in the credential list

The node made four honeypot sessions between 2026-05-21 and 2026-06-01 and never landed a login. But it left its target list, and the composition is the whole story. Set the ordinary root guesses aside for a moment and look at what else it tried:

Then, yes, the usual filler: root:!qaz@wsx., root:123321.., root:1234.Abc, root:PassW0rd2026, root:Os@123456, root:987987, root:QWERTY#, admin:admin$.

That first table is not a commodity IoT sweep. admin:admin and root:123456 are the vocabulary of Mirai-lineage botnets hunting routers and cameras (see the whole Loader's Trail). oneadmin, n8n, frappe, oracle, postgres, nexus are the vocabulary of someone hunting self-hosted devops and database infrastructure — CI pipelines, automation servers, artifact repositories, cloud controllers, production databases. This is a target list assembled, deliberately, for the modern stack a small company or a lab actually runs. The operator wants a foothold in someone's build system, not a slot in a DDoS cannon.

That qualitative difference — commodity default-spray versus curated infrastructure-account spray — is the reason this node is worth a dossier of its own. It is a more thoughtful adversary wearing a state research enterprise's name.

The institutional anchor — and its crack

Three independent sources (Team Cymru, iptoasn, BGP routing) agree the IP belongs to UNICON.UZ, a State Unitary Enterprise doing scientific/engineering/marketing research in Uzbekistan. AbuseIPDB tags the usage type "education." The RDAP network is UZ-STATE-20241118 — a state-registered block, allocated 2024-11-18. So far, a legitimately-anchored government research body.

Then the anchor cracks. The RDAP record's registered administrative and abuse contact for this state block is:

org:     Admin
email:   nyadgarov@mail.ru
phone:   +998712088151
network: UZ-STATE-20241118

The only registered point of contact for a government scientific enterprise's address space is a free personal @mail.ru mailbox hosted in Russia. That is a documented governance gap, and it cuts two ways. Practically, it makes abuse remediation hard — there is no institutional abuse desk to write to, only one person's personal inbox. Analytically, it is a small window on how loosely the block is administered — and loosely-administered address space is exactly the condition under which a downstream host gets quietly conscripted without anyone noticing.

This is the opposite of Part B's NASK, where the abuse contact was the national CERT. Same series, same borrowed-trust mechanism, but the remediation story is far weaker here — not because the institution is less real, but because the state block is governed through a personal email.

It is not alone: a fingerprinted cluster

The node is not a lone curiosity. It carries the SSH-client HASSH fingerprint hassh-03a80b21afa81068 and the tag actor_cluster_001. HASSH fingerprints the client software build that opens the connection; a shared HASSH across many source IPs means they are all running the same tool, compiled the same way. This one is shared, and the node also shares OTX threat pulses with a globally-distributed set of scanners — hosts on Google Cloud (34.79.35.36), Azure (20.220.34.26), and commercial ranges in several countries (213.165.74.84, 154.205.134.214, 185.113.139.51, 27.79.2.165, 202.39.153.245).

So the state research enterprise's IP is one node of a coordinated, common-toolkit credential-spray operation that also runs on rented cloud instances worldwide. The operator conscripts whatever it can — a GCP VM here, an Azure box there, and a host on a loosely-governed Uzbek state block. The state affiliation is not the operation; it is one address the operation happens to run on.

Shodan also records an unusual open port — 832 — on the host, a non-standard port sometimes used for NETCONF-over-TLS or bespoke management. Combined with the state-block registration, it is consistent with a managed/appliance host rather than a random desktop. We record the detail; we do not over-read it.

Steelman: is this just the enterprise's own security testing?

A fair objection: state research bodies and "engineering research centers" sometimes run their own scanning — vulnerability assessment, internal security testing — and that can spill onto honeypots. Could 194.107.115.199 be UNICON.UZ doing sanctioned research?

The evidence points away from it. Sanctioned security research does not (1) share a HASSH tool-build fingerprint and OTX pulses with a globally-distributed cluster of GCP/Azure scanners, (2) spray production service credentials (postgres:Postgres10!, oracle:oracle19, oneadmin:oneadmin) at random internet hosts, or (3) surface on blocklist.de and ipsum feeds. Legitimate research is scoped, announced, and does not read as one node of an anonymous spray cluster. The counter-narrative keeps one true residue — a state engineering-research enterprise plausibly does run scanners of its own — but this host, on this evidence, is a conscripted node in an external operation, not an in-house assessment.

And the borrowed-trust logic holds regardless: the honeypot, and every other victim, sees only UNICON.UZ, State Unitary Enterprise — the trusted state-research name — while the actual spray comes from one compromised or abused machine on a block governed through a personal mailbox.

What the three tiers add up to

Read A, B and C together and Borrowed Trust has now documented the same failure mode across the full height of institutional respectability:

Three institutions no reputation filter would flag, each with genuinely real provenance, each hosting one compromised device that borrowed the good name. The trust was never faked. It was inherited — and inherited trust is the harder problem, because the provenance checks out and the danger rides on that reality.

Findings

1. A curated devops/database credential spray, not a commodity root sweep. (HIGH) — n8n, frappe, oracle, postgres, oneadmin, nexus, ftpuser.
2. A trusted state-research IP fronts the spray. (MEDIUM) — a compromised/abused host on UNICON.UZ's state block; the enterprise is the abused party.
3. [INST] A state netblock governed through a personal mail.ru address. (HIGH) — UZ-STATE-20241118 contactable only via nyadgarov@mail.ru; a documented governance gap.
4. The node is one member of a HASSH-fingerprinted coordinated cluster. (MEDIUM) — shared tool build with GCP/Azure/commercial scanners.

Cross-references

• TI-2026-084A — Borrowed Trust — the teaching-university tier.
• TI-2026-084B — The Watchman's Own Gate — the national-CERT tier.
• TI-2026-082A — The Tripwire Ledger — the inverse: manufacturing false respectability.

A state research enterprise's name is a good name. It just wasn't the one doing the spraying — only the block it came through, administered from a personal inbox nobody was reading.