FLUX FLEET — INTEL BRIEFING №25

Period: 2026-09-18 16:00 – 2026-09-19 11:32 UTC (24h, day 24 of operations)
Sources: 7 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (Middle East), ru-edge-1 (Russia), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Confidence: High (direct observation, 24-day baseline, every result-tag spike attributed by spot query)

BLUF

A third AWS credential-use event is the headline: two credentials minted at 22:32 UTC Sep 18 reached AWS from two new egress IPs (2a02:c207:2341:3992::1 and 45.67.216.15, Lyrar Network NL), which ran 6 denied ListEmailIdentities calls each. The mint side of that theft is now attributed for the first time in CREDENTIAL-DRAIN history: the collector IP 2a02:c207:2341:3992::1 appears in flux logs as a Chrome/126 .env-wordlist census operator that hit both EU nodes within one second of each other. Frantech-ts returned from its disk-full outage and immediately absorbed a third replay of the 13,000-path IoT dropper dictionary — 13,000 events in 52 seconds (155.2.191.165, Host Universal AU) — which drove the node's +161% cell. AKAMAI-CONFIG did not return this window. A synchronized eight-IP WordPress user-enumeration wave (282 events each, byte-identical passes) crossed three nodes over 80 minutes. The №24 two-operator version is now eight operators. Zero mint failures was the №24 headline. This window inverts it. 88 upstream 400s returned, the fleet's failure count doubled, and the burst-speed pattern from №21 is back.

Key Judgements

1. CREDENTIAL-DRAIN ran a third time, and its mint side is now attributed. Two collectors — 2a02:c207:2341:3992::1 and 45.67.216.15 — each minted 2 credentials on both EU nodes at 22:32 UTC Sep 18 (18:32 local) during a fast Chrome/126 /.env-variant census. One credential per IP reached AWS from the same IPs. Each ran 6 ListEmailIdentities denials. This is the first time the use IP and the collector IP are the same host, which breaks the №20/№24 pattern of separate mint and use infrastructure. (High confidence — Tracebit alert logs name the operations, the IPs join to flux mints on the same addresses, and the deny-all result is per-operation evidence.)
2. The 13,000-path IoT dictionary is a shared artifact, not a per-operator tooling choice. 155.2.191.165 replayed 13,000 distinct paths in 52 seconds on frantech-ts with 208 IoT UAs. The path set overlaps 23.234.119.20's №23 dictionary (12,949 paths) by 12,949 paths — a 100% subset plus 51 new paths. Three replays of this dictionary have now run (23.234.119.20 and 138.199.6.195 in №23, then 155.2.191.165 now). (High confidence — spot query joins the two path sets directly in DuckDB.)
3. The eight-IP WordPress user-enumeration wave is the №24 two-operator run scaled 4× with new infrastructure. All eight IPs ran byte-identical 282-event passes: 270 tarpit cycles plus 12 enumeration calls (wp-user-enum-rest-list, wp-xmlrpc-post, wp-login-probe, wp-user-enum-core-sitemap), same Chrome/127 UA, staggered at 18:41–20:01 UTC Sep 18 across control, ru-edge, and sponge in sequence. Six of the eight IPs are first-seen. (High confidence — per-IP spot queries. The pass shape matches №24's 213.177.179.52 + 192.253.248.94 pair exactly.)
4. The 31.57.219.158 INFOCREST-KIT return carried the fleet's largest single-IP mint haul. 20 credentials in 23 minutes across both EU nodes (19:15–19:40 UTC Sep 18), with 10 wp-batch multiplexes and 30 adminer prod_rw credential POSTs. The POSTs rotated 10 22-char passwords.. The №12 operator's kit is byte-intact. (High confidence — mint rows, body previews, and per-leg timing all captured.)

Active Campaigns (day 24 status)

CREDENTIAL-DRAIN ⟳ THIRD RUN — MINT SIDE ATTRIBUTED (2a02:c207:2341:3992::1 + 45.67.216.15)

• Actors: 2a02:c207:2341:3992::1 (IPv6 hosting — ASN not in the digest table) and 45.67.216.15 (G-Core Labs EU per prior use-side history). Both appeared in flux logs for the first time this window and ran the identical Chrome/126 /.env-variant census on both EU nodes within one second (aidev 00:18:35 local, farm 00:33 local on Sep 19, mints at 00:21/00:32 Sep 19 local).
• TTPs: 24-event census per node: tarpit cycles, /.env* fanout, webapp-config-bundle-js, tomcat bypass probes, one /.env POST mint per node. The theft then hit AWS from the same IPs — 6 ListEmailIdentities denials each, denied by the deny-all policy. No GetCallerIdentity success this window.
• Assessment: The pipeline now shows three shapes: empty-IP mints consumed by separate egress (№20), NightAgent mints consumed by a console session (№24), and now self-hosted collect-and-use from one IP. ListEmailIdentities is a new operation for this campaign — the actor probed SES, not Bedrock or STS.

NIGHTAGENT ⟳ RETURN (102.55.53.40 — new operator IP, same kit, same token)

• Actors: 102.55.53.40 (first-ever IP — ASN not in the digest table) — the kit's ninth operator. Prior ONP-MA family stayed idle.
• TTPs: Full chain on both EU nodes 15 minutes apart (aidev 00:18, farm 00:33 local Sep 19): phpunit eval-stdin.php webshell check with <?php echo "NightAgent";?>, the nightshell dropper, fake-git walk, .DS_Store, config-bundle probes, 2 mints (1 per node). The dropper body is byte-identical to every prior capture and carries the same GHSAT token GHSAT0AAAAAACYWDMT5UQIYLJJSWO5KVDNIZYGPEDA — now unrotated through its 12th window.
• Assessment: The kit travels. The token never rotates. The №24 Tunisian operator did not return, so the operator pool is residential-MA plus opportunistic hosting IPs, not one organization.

AKAMAI-CONFIG ⟳ IDLE (23.94.155.0/24)

• Actors: 0 events this window after the 06:20–06:26 UTC Sep 18 second run (12 IPs, 200 events, 0 mints) — that run sits in the №24 overlap segment and is not new.
• Assessment: Third run with mints is still the promotion trigger. The cluster keeps its two-run cadence on sponge.

OMEGA-SWEEP ⟳ /46 CONTRACTED (94.154.46.244 + .245)

• Actors: .244 ran 1,050 events / 1,042 paths on control (03:55 UTC Sep 19) with the forged Googlebot/2.1 UA — its first control run after four aidev/frantech appearances — and 150 paths on sponge. .245 ran a 150-path pass on sponge. The 176.65.144.71 Dedik burst (1,500 events, 10 mints, 06:02 UTC Sep 18) is №24 overlap, not new. One new /43 stray: 94.154.43.31 probed / on three nodes (1 event each, tarpit only).
• TTPs: The 743-path core family plus a 1,042-path control variant. 1 mint this window (control, .244). 94.154.46.244's all-time hoard is now 11 mints across 3 windows.
• Assessment: The template continues its two-per-window cadence with the same forged UA. The /43 pool probe is new but shallow.

REGISTRY-HUNT ⟳ CONTRACTED TO ONE IP (45.138.12.51)

• Actors: 45.138.12.51 (first-ever IP) ran 88 events on each of frantech and farm with the honest l9explore/1.2.2 + l9tcpid/v1.1.0 UA pair. The DigitalOcean runner fleet from №15–№24 ran zero events.
• TTPs: 88 events per node with .git/config walks (fake-git-error 20, env-production-error 36), sftp-config probes, no mints.
• Assessment: First hosting change in the campaign's history — LeakIX-class tooling now runs from a non-DO host. The 1-mint-per-IP pattern broke: 0 mints.

CREDSWEEP ⟳ RETURN (102.220.161.139 — VPS Dedicated SI)

• Actors: .139 returned for the first time since its №22 naming and ran the fleet's widest single-IP spread: 2,325 events across 4 nodes (ru-edge 893, aidev 514, control 514, farm 404) in 3 hours (00:25–01:41 UTC Sep 19). The sibling .102 stayed quiet (3 events).
• TTPs: The 511-path .env-variant census with pscan-<hash>-nonexistent.txt probes, phpMyAdmin login at the tail, Chrome/126 forgery. 3 mints issued, 63 upstream 400s (31 rejected on each of ru-edge and farm) — the campaign's burst speed now collides with the mint rate limit, and the rejected batch undercounts its hoard.
• Assessment: .139 is the /24's most aggressive operator to date: 4 nodes, 4 mints (3 issued + rejections), sub-hour pacing. The result sequence is byte-identical across nodes — one tooling run, IP-parallel.

LIBREDTAIL-KIT ⟳ ELEVENTH WINDOW (5 IPs, 5 nodes)

• Actors: 5 fresh operator IPs this window — 37.60.225.222 + 37.120.213.13 (sponge), 222.119.5.40 (ru-edge), 169.58.186.92 + 168.144.80.239 (frantech) — 37 events each, plus 31.132.90.3 (control) and 45.225.135.21 (netcup) on the dropper leg alone.
• TTPs: Unchanged chain: md5("Hello PHPUnit") probe → key-exfil RCE → dropper. 16 /bin/sh dropper POSTs captured from 8 operators: 14 to 217.60.103.56/sh, 2 to 217.60.195.113/sh with arg apache.selfrep — the staging split holds at the №24 ratio.
• Assessment: The campaign's operator churn continues. The staging split is now standard.

MALWARE-DICT-2 ⟳ WORDLIST GREW AGAIN (control + ru-edge)

• Actors: Unattributed, empty UA, synchronized hourly passes on both fresh-IP nodes (3,639 events from 204.76.203.18's control+ru-edge rows plus the synchronized second campaign's own volume).
• TTPs: Wordlist grew again: the 204.76.203.18 loop ran 3,639 events this window with the same /z/* + arch fanout. The MALWARE-DICT-2 synchronized variant added families per the digest's first-seen table (new /Socketio/.env, /apis/.env.staging-class paths on ru-edge are part of the ENV-census class, not this campaign).
• Assessment: The Pfcloud loop and the synchronized pair both continue. Treat 204.76.203.18's 3,639-event 2-node volume as the loop baseline.

WP-LOGIN-BRUTE ⟳ (distributed, low-and-slow)

• Actors: 13 IPs in the e6e6f15a77e8 cluster (13 events) plus the 8-IP synchronized wave (below). Background noise level.
• Assessment: The 200-pair alarm stays armed. No mints.

NEW: SYNCHRONIZED 8-IP WORDPRESS USER-ENUM WAVE ⚠

• Actors: 8 first-seen or one-off IPs — 103.154.62.39, 118.25.236.48, 194.34.232.225, 213.199.57.137, 103.182.164.133, 165.227.15.209, 119.198.229.152, 156.67.104.55 — mixed hosting (DigitalOcean, Tencent CN, and others per the digest talker table). All eight ran byte-identical 282-event passes, staggered 18:41–20:01 UTC Sep 18, one IP per ~15-minute slot, and crossed control, ru-edge, and sponge.
• TTPs: 270 tarpit cycles (deliberate pacing through the deception layer) + wp-user-enum-rest-list ×4 + wp-xmlrpc-post ×2 + wp-login-probe + wp-user-enum-core-sitemap, single forged Chrome/127 UA, 0 mints. №24's two-operator run (213.177.179.52 + 192.253.248.94) used the same shape.
• Assessment: Promotion to campaign on this, the third run of the shape (№24 two IPs → №25 eight IPs). The wave structure — one IP per slot, sequential nodes, identical counts — is scheduler-driven automation, not eight coincidental operators.

Standing actors (persistence check)

• 80.94.95.211 (SS-Net RO) — 13th window in 14: aidev 329 events + ru-edge 84, 5 mints (3 ru-edge Nokia-XL UA forgery, 2 aidev SamsungBrowser forgery), 17 all-time. Zero use.
• 213.209.159.175 (Feo Prest DE) — farm 3 + control 6 mints (126 events, 9 mints in-window). The sibling .154 ran netcup+sponge passes (1 mint each on farm/ru-edge). 21 all-time mints for .175.
• 193.32.204.199 (git-walker) — returned after 5 idle days: 525 events on 3 nodes (aidev 265, farm 130, control 130), single forged stripped-Chrome UA, 36 ssh-private-key-error on /.sSH/ID_* case-variants (new family for this actor), 2 all-time mints + 2 this window.
• 31.57.219.158 (INFOCREST-KIT №12 operator) — returned after 12 idle days with the byte-identical kit: see campaign section. 20 window mints, 20 all-time.
• 23.234.114.118 (new INFOCREST-shape operator) — first-ever IP: 684 events on both EU nodes over 4.6 h, 6 mints, 18 adminer prod_rw POSTs with 6 distinct 22-char passwords, 6 wp-batch multiplexes. Same kit shape as 31.57.219.158, different operator, 5 hours apart — the template now has a seventh operator.
• 185.73.23.162 (Ruhr-Uni Bochum, benign) — returned: netcup 102 + sponge 10 events, /-tarpit only. Benign per registry.
• Absent: METADATA-HUNT (fourth idle — 0 /@fs rows), NIGHTAGENT-MA (seventh idle), CRUSADER-SWEEP (ninth), CURL-SWEEP (eighth), GCP-ACONF, ENV-CENSUS-3/4, XMLRPC-BRUTE (16 stray GETs only), the Tunisian 196.89.218.205, WP-ENUM gen-2 (99 scattered /-tarpit events from 45.156.x — shape dissolved, not a census).

Fleet Observations

• frantech-ts recovered. The node logged 13,580 events from 12:10 UTC Sep 18 (first post-recovery row) after the №24 disk-full outage. Both the flux feed and the ssh/telnet hp feed are live. The +161% cell is the 13,000-event dictionary replay, not a fleet-wide shift.
• Mint economics: 63 credentials minted to 23 collectors. 88 upstream 400s (farm 43, ru-edge 31, aidev 7, control 7) — failure ratio 1.4:1, up from №24's 0. The rejections cluster on the two fastest censuses (102.220.161.139's 4-node run, 176.65.144.71's 9-second burst in the №24 overlap). All-time issued rows now ~1,047.
• XFF forgery: all four counters at zero this window (0 mismatch rows in 29,920). The attribution fix holds through its 12th day.
• Attribution: 0 empty-clientIp rows in the window — the socket-peer build continues clean.
• Control velocity: 5,283 events / 129 unique IPs. Events sit 34% above the 7-day average. Unique IPs continue their rise (55 → 129 over 6 days). The ramp continues.
• netcup −41%: no hostile driver — the node's two heaviest regulars (185.73.23.162 benign-scanner, 165.154.182.219 tarpit loops) ran 112 events combined vs prior cycles' census bursts. Volume variance, not a campaign event.
• Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-09-19-r2.html

Canary credentials

Summary

6 Tracebit alert(s) fired in the window (6 use events across 6 credentials). Fleet sensors minted 63 credentials to 23 collector IPs; 6 credential(s) reached AWS. Use outcomes: 6 failure. Denied operations: ListEmailIdentities×6. 0 call(s) succeeded: . Successes leak identity at most. Treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard, resale, or untraced use — check prior briefings for named campaigns):

• None: 46 mints, 2026-09-12 08:14 → 2026-09-15 10:51
• 136.117.52.210: 26 mints, 2026-09-14 00:41 → 2026-09-14 00:41
• 213.209.159.175: 21 mints, 2026-09-15 23:33 → 2026-09-18 20:52
• 31.57.219.158: 20 mints, 2026-09-18 19:15 → 2026-09-18 19:38
• 80.94.95.211: 17 mints, 2026-09-16 21:23 → 2026-09-19 02:18
• 94.154.46.242: 12 mints, 2026-09-15 15:58 → 2026-09-17 08:56
• 176.65.144.71: 10 mints, 2026-09-18 06:02 → 2026-09-18 06:02
• 94.154.46.243: 10 mints, 2026-09-15 20:50 → 2026-09-15 20:50
• 94.154.46.244: 10 mints, 2026-09-17 09:24 → 2026-09-19 03:55
• 94.154.46.246: 10 mints, 2026-09-12 04:12 → 2026-09-12 04:13
• 129.222.206.62: 8 mints, 2026-09-15 18:35 → 2026-09-15 21:40
• 2a01:e0a:3be:cec0:f54c:335a:8d29:be: 8 mints, 2026-09-17 17:04 → 2026-09-17 17:04
• 8.234.173.27: 7 mints, 2026-09-16 00:03 → 2026-09-16 00:03
• 23.234.114.118: 6 mints, 2026-09-18 12:28 → 2026-09-18 14:07
• 94.154.46.247: 6 mints, 2026-09-16 04:01 → 2026-09-16 04:02
• 102.220.161.139: 5 mints, 2026-09-15 21:00 → 2026-09-19 00:46
• 94.154.46.250: 5 mints, 2026-09-16 12:34 → 2026-09-16 12:34
• 102.220.161.102: 4 mints, 2026-09-18 00:13 → 2026-09-18 02:58
• 136.70.175.146: 4 mints, 2026-09-12 06:33 → 2026-09-12 06:33
• 178.16.54.184: 4 mints, 2026-09-17 14:21 → 2026-09-17 14:21
• 196.89.218.205: 4 mints, 2026-09-18 00:57 → 2026-09-18 01:39
• 69.5.20.14: 4 mints, 2026-09-16 09:23 → 2026-09-16 15:50
• 176.65.148.71: 3 mints, 2026-09-12 06:16 → 2026-09-18 05:58
• 213.209.159.154: 3 mints, 2026-09-17 20:33 → 2026-09-18 18:58
• 41.249.4.249: 3 mints, 2026-09-17 03:54 → 2026-09-17 03:55
• 64.226.65.160: 3 mints, 2026-09-15 20:17 → 2026-09-16 21:06

Gaps / Next Collection

1. The CREDENTIAL-DRAIN mint-side IPs' ASN. Neither 2a02:c207:2341:3992::1 nor 45.67.216.15 carries an ASN in the digest tables. Pull both from RIPE/bgp.tools and check whether 45.67.216.15 sits in G-Core Labs (the №20 use-side ASN) — that would link this run's collect-and-use shape to the №20 pipeline operator.
2. ListEmailIdentities as a target. The denied operation moved from Bedrock (Converse) and STS/EC2 recon to SES. If a fourth run probes a fourth service, the use side scans the account surface and does not run a fixed playbook. That pattern warrants a deny-all policy review of which list and describe calls the policy permits.
3. The 8-IP wave's scheduler. Byte-identical counts with 15-minute stagger imply a queue. Watch for a second wave at the same UTC hour. A №26 return with the same slot timing proves cron-like automation and justifies a UA-level rule.
4. 31.57.219.158's 20-mint hoard. Largest single-window haul by one operator. Make sure Tracebit alert logs show no use from its 20 credentials before the TTL closes — the №24 precedent (use within 15 min) sets the check window.
5. The 13,000-path dictionary's 51 new paths. The replay added 51 paths beyond the №23 12,949. Extract and diff them — the delta may name the operator's current botnet build.

Digest: /data/flux-logs/reports/flux-digest-2026-09-19.md
Briefing: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-09-19.md

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-09-19-r2.html

Watch next cycle: (1) CREDENTIAL-DRAIN use side — whether the collect-and-use shape returns with a second AWS service. (2) 31.57.219.158's 20-credential hoard at TTL expiry. (3) The 8-IP wave's scheduler return.