Residential Broadband Botnet Uses AsyncSSH to Validate Credentials Across Four Regions

A coordinated credential-harvesting campaign built from someone else’s home internet connections.

Observation window: 2026-05-26 → 2026-06-02 (7 days)

Signal: 5,469 connection attempts from 98 unique IPs across four sensor meshes

Core finding: identical HASSH fingerprint, identical Python SSH library, zero auth successes — pure credential-list construction at scale

Defensive value: 98 IOC IPs, HASSH signature, behavioral detection rules

What we observed

Over seven days, our sensors logged 5,469 connection attempts from 98 unique source IPs against four honeypot meshes deployed in different regions. Every single attempt used the same SSH client fingerprint. Every single attempt failed to authenticate. No post-auth activity was ever recorded.

This is not a brute-force attack. It is credential validation: an operator testing whether a harvested list of username-password pairs opens SSH on internet-exposed servers, producing a filtered list of working credentials for later use.

The 98 source IPs share one property: they are all residential broadband addresses on two Vietnamese ISPs, Viettel and VNPT. They are not rented VPS nodes, not datacenter infrastructure, not Tor exits. They are home internet connections — routers, DSL modems, FTTH CPE — that have been compromised and recruited into a scanning fleet.

Technical fingerprint

SSH client library

Every connection carried the banner SSH-2.0-AsyncSSH_2.1.0.

AsyncSSH is a Python library for asynchronous SSH operations. It is not a compiled scanner. An attacker who builds a credential-validation tool on top of AsyncSSH is writing Python, not C or Go. This matters for attribution and for detection: a Python-based scanner running on compromised residential hardware implies a specific operator profile — one comfortable with Python scripting and able to maintain persistent access to a fleet of home devices.

HASSH fingerprint

All 98 IPs produced the same HASSH value:

fda360b1b4f4d345...

HASSH is a network fingerprint derived from the key exchange algorithms, encryption ciphers, MAC algorithms, and compression methods advertised by an SSH client. A matching HASSH across 98 nodes confirms they are running the same tool version on the same configuration — not independent actors who happen to use AsyncSSH, but a single coordinated fleet.

This fingerprint was consistent across all four sensor meshes and across the full seven-day window with no rotation. The operator did not attempt to vary the fingerprint to evade detection.

No successful logins

Across 5,469 attempts and 98 source IPs: zero successful authentications.

The honeypots accept a range of common credential pairs. The fact that none of the attempted credentials succeeded tells us either that the wordlist used by this operator does not overlap with the credentials accepted by our sensors, or that our sensors are not the primary target and the operator is testing a more specific list against a specific set of services. Either way, the operator was not exploiting anything — they were probing.

Infrastructure

Fleet composition

The 98 IPs distribute across three Autonomous Systems, all corresponding to Vietnamese ISP broadband allocations:

The address ranges involved — 27.64.0.0/10, 116.99.0.0/16, 116.110.0.0/16, 171.231.0.0/16, 171.243.0.0/16 — are all RIPE-registered to Viettel Group or VNPT. These are not datacenter or hosting allocations; RIPE records describe them as end-user broadband and mobile services.

The mobile addresses (171.231.*, 171.243.*) are 4G LTE ranges served via carrier-grade NAT. Attribution to a specific device behind these addresses is not possible without ISP cooperation; the IPs represent NAT gateway exit points, not individual devices.

Cross-region coordination

The same core set of IPs — particularly those from Viettel’s 27.79.0.0/16 range — appeared across all four sensor meshes within the same seven-day window:

Seven IPs appeared on three or more meshes: 27.79.4.89, 27.79.6.236, 27.79.7.132, 27.79.1.116, 27.79.1.226, 27.79.43.128, 116.99.168.7. These are the most active nodes in the fleet, and their cross-regional presence confirms centralized task distribution — a controller is assigning targets to nodes, not each node operating independently.

Assessment

The behavioral profile is consistent with the reconnaissance phase of a credential-stuffing operation:

1. A set of credentials has been harvested from a previous breach, phishing campaign, or purchase.
2. The operator needs to know which credentials are still valid against live SSH servers.
3. The validation tool is deployed on compromised residential devices to reduce detection risk and rate-limiting exposure.
4. Valid credentials are collected for later use — lateral movement, persistence, resale, or integration into a larger botnet.

The choice of AsyncSSH (a Python library) over commodity Go-based scanners (the dominant choice for well-resourced actors) suggests either a smaller-scale operator with Python tooling preferences, or deliberate selection of a less-detected library. AsyncSSH’s legitimate use cases mean it is less likely to appear in threat intelligence feeds than purpose-built scanners.

The residential broadband infrastructure adds a layer of operational security: blocklists for residential CIDRs are rarely deployed in production environments because blocking large ISP ranges produces unacceptable false-positive rates. An operator who can maintain persistence on dozens of home routers or CPE devices gets a fleet that is harder to block than a datacenter cluster.

We do not attribute this campaign to a specific threat actor. The operator responsible for distributing the scanning script to these 98 devices is not identified by this data. The ISPs involved (Viettel, VNPT) are the owners of the compromised end-user devices, not the campaign operator.

Detection

HASSH-based rule

Any SSH connection bearing HASSH fda360b1b4f4d345... is associated with this campaign. This fingerprint is stable and has not changed over the seven-day observation window.

# Suricata / Zeek
event ssh_client_banner where banner == "SSH-2.0-AsyncSSH_2.1.0"
  and source_ip in [see IOC list below]

Behavioral signature

A simpler behavioral rule that does not require HASSH: AsyncSSH 2.1.0 banner with no successful authentication within the session. This distinguishes scanning traffic from legitimate AsyncSSH use.

IP-based blocking

The 98 IPs listed below can be used as a blocklist. Given the residential nature of these addresses, consider rate-limiting rather than hard-blocking if your environment requires allowing residential ranges.

IOCs

All 98 source IPs observed during the 2026-05-26 → 2026-06-02 window. ASN column: V = Viettel Group, N = VNPT.

# Viettel — 27.79.0.0/16 (broadband)
27.79.0.124     27.79.1.65      27.79.1.70      27.79.1.116
27.79.1.172     27.79.1.226     27.79.2.0       27.79.2.162
27.79.3.46      27.79.3.91      27.79.3.251     27.79.4.10
27.79.4.89      27.79.4.105     27.79.6.157     27.79.6.170
27.79.6.190     27.79.6.236     27.79.7.132     27.79.40.139
27.79.41.68     27.79.43.38     27.79.43.128    27.79.43.182
27.79.46.25     27.79.47.53     27.79.47.247

# Viettel — 116.110.0.0/16 (broadband/mobile)
116.110.4.233   116.110.6.44    116.110.6.117   116.110.9.224
116.110.9.235   116.110.12.29   116.110.13.192  116.110.16.136
116.110.145.228 116.110.149.21  116.110.149.99  116.110.149.239
116.110.150.50  116.110.151.68  116.110.154.109 116.110.155.201
116.110.158.146 116.110.209.157 116.110.213.45  116.110.214.118
116.110.215.105 116.110.215.157 116.110.215.253 116.110.217.136
116.110.218.173 116.110.223.91

# VNPT — 116.99.0.0/16 (broadband)
116.99.168.7    116.99.171.109  116.99.171.123  116.99.171.151
116.99.172.85   116.99.172.203  116.99.173.214  116.99.173.243
116.99.174.29   116.99.175.107  116.99.175.117  116.99.175.167

# Viettel — 171.231.0.0/16 (mobile 4G)
171.231.177.8   171.231.177.110 171.231.178.7   171.231.180.42
171.231.180.190 171.231.182.249 171.231.183.42  171.231.184.7
171.231.185.84  171.231.187.124 171.231.192.106 171.231.193.84
171.231.196.145 171.231.199.130

# Viettel — 171.243.0.0/16 (mobile 4G)
171.243.148.70  171.243.148.101 171.243.148.154 171.243.149.8
171.243.149.206 171.243.149.250 171.243.150.23  171.243.150.200
171.243.151.24

HASSH: fda360b1b4f4d345...
SSH client banner: SSH-2.0-AsyncSSH_2.1.0

Responsible disclosure

This report was shared in advance with VN-CERT, SingCERT, and JPCERT/CC under a 30-day coordinated disclosure window beginning 2026-06-02. The IOC list and behavioral signatures were provided to allow ISP-level remediation of compromised customer devices before public release.

The ISPs involved (Viettel Group, VNPT) were notified separately with a structured list of affected customer IP ranges.

Sensor data: HIIH distributed SSH honeypot mesh, 4 regions. Observation window: 2026-05-26 → 2026-06-02. Methodology: passive capture, no active probing.