← Back to archive
TLP : RED ∙∙ AVCON ∙∙ NO-FLOCK
Document TEARLINE-2026-03 Originator █████████████████ Date acquired 2026.03.04 Date received 2026.03.11 Pages 1 of 1 (tearline) Distribution ornithos archive only
Discovery of persistence anchors in APT-AVIAN operations
A clustering analysis of stationary low-altitude contacts in the AD-001 feed, with one further observation regarding a non-clustered anomaly.
Source description (sanitized): The same passive 1090 MHz feed that produced AD-001, reviewed for a second time approximately three weeks after initial publication. This review was conducted by a different analyst — a ██████████████ with twelve years of geospatial-pattern-of-life experience — who applied tradecraft to the dataset that the original collector did not. The reanalysis surfaced a structural feature that had been present in the data all along.

Summary

The AD-001 feed contains, in addition to the three migrating contacts addressed in TEARLINE-2026-02, six contacts whose reported ground speed is zero, whose altitude is uniformly low (under 50 ft), and whose squawk code is the non-standard value 7747. These six contacts do not occupy six distinct locations. Spatial clustering reveals that they occupy three locations, in pairs, separated by approximately 400 metres within each cluster and thousands of kilometres between clusters.

The three cluster centroids correspond to specific geographic locations in three different theatres. Each location, when researched against open sources, has a strategic-signals significance that pre-dates APT-AVIAN's activity by decades.

Method

The stationary contacts in AD-001 were filtered with three predicates: gs == 0, alt_baro < 50, squawk == "7747". The filter yielded six contacts. A simple unweighted nearest-neighbour clustering with a 1-kilometre threshold yielded three clusters of two contacts each. The centroid of each cluster was computed as the arithmetic mean of the two member coordinates, rounded to four decimal places.

The three centroids resolve to:

The three sites are designated, internally, Nest α, Nest β, and Nest γ. These designations are not derived from any property of the data — they are sequential and arbitrary. The clustering itself is what matters.

The ghost is separate

A seventh stationary contact in AD-001, ICAO 194707, callsign ORN-1947, does not cluster with the six nest contacts. Its position is approximately 770 km offshore in the western Atlantic, beyond plausible perch infrastructure. Its altitude is reported as 1947 ft — a value that, taken as a year, corresponds to the founding date attributed to APT-AVIAN in the case material accompanying the FEATHERFALL threat brief. Its squawk is reported as 0xb1, a hexadecimal encoding that is not a valid ADS-B Mode S code (which requires four-digit octal).

The combination of these three anomalies, in a single contact, is not consistent with random noise or transmitter malfunction. It is consistent with a deliberate signature. The ghost contact appears to be saying — in three different fields simultaneously — we know you are looking and we are leaving you a marker.

Why this matters

Each nest, in isolation, is just a coordinate. The three together establish that APT-AVIAN maintains persistent operator presence at strategically-located sites in three theatres, on three continents, separated by thousands of kilometres. This is not an opportunistic actor. The operators have been at these locations long enough to be observed from passive collection, and the pattern of paired stationary contacts at each site suggests rotation — when one operator departs on a migration, another remains at the nest. Continuity is preserved.

The relationship between nests and the cable-landing targets addressed in TEARLINE-2026-02 is not co-location. Nests are roughly 30–100 km from their closest cable landings. The hypothesis is that nests serve as operator residence while landing-station targets are operator destinations. The migrations addressed in TEARLINE-2026-02 are the commute between the two.

— ∙ tearline ∙ —

Collection requirements (downstream)

This tearline drops five Requests for Information. RFI-η₀ gates the three coordinate-recovery RFIs that follow it — solving η₀ unlocks η₁ through η₃. RFI-δ stands alone.

RFIs derived from this report

Editor's note (ornithos)

The nest designations α, β, γ are mine. The contacts in the AD-001 feed do not carry these labels. They never have. If, having recovered the centroids, you also research what each location is in the real world, you will draw your own conclusions about why APT-AVIAN chose those particular sites. I will not write those conclusions down here.

TLP : RED ∙∙ AVCON ∙∙ NO-FLOCK