FLUX FLEET — INTEL BRIEFING №26

Period: 2026-09-19 07:32 – 2026-09-20 07:32 UTC (24h, day 25 of operations)
Sources: 7 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (Middle East), ru-edge-1 (Russia), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Confidence: High (direct observation, 25-day baseline, every result-tag spike attributed by spot query)

BLUF

CRUSADER-SWEEP ended its nine-window idle with a fleet-wide worker wave and a wordlist expansion into AI/CLI credential paths: 4,182 events from 102 crusader-worker/1.0 IPs on 5 nodes, with codex-auth (1,092 events on ai-devbox-1, 7-day average zero) and claude-config/claude-credentials/claude-settings spikes — the fleet's first census of /.codex/auth.json and /.claude.json stores at scale. Frantech-ts took a fourth replay of the 13,000-path IoT dropper dictionary (169.150.201.29, Datacamp DE, 13,006 events in 81 s); the wordlist is byte-stable at version 13,000 plus 4 first-ever /stub.* paths. A Techoff BG operator (195.178.110.104) drove the wp-batch-rejected spike with 257 empty-batch {"requests":[] POSTs in 6 minutes. Zero AWS use: all 49 window canaries sit in hostile-held hoards; the fleet approaches 1,300 all-time mints with no observed consumption since №25.

Key Judgements

1. CRUSADER-SWEEP's return is a capability upgrade, not a schedule restart. The window held 4,182 events from 102 crusader-worker/1.0 IPs on 5 nodes (14:05:17–17:33:03 UTC Sep 19). Per-node: ai-devbox-1 dominant (Workers 41 of the IP census), sponge 1,927 events (14:09–15:44), single-IP passes on farm (2 workers, 60 ev), control (1, 41 ev), frantech (1, 41 ev). The wordlist now carries /.codex/auth.json and /.claude.json//.claude/settings.local.json families on ai-devbox-1 in-window — codex-auth 1,134 / claude-config 324 / claude-credentials 52 / claude-settings 52, all first-hit at scale. Zero CRUSADER-attributed mints in-window: the window's 51 issued/49 creds belong to other campaigns. (High confidence — UA-filtered flux-query joins; mint-to-worker joins ran clean in DuckDB.)
2. The 13,000-path mega-dictionary replayed with a 4-path delta, and the operator pool turned over again. 169.150.201.29 (Datacamp DE, ipsum:1) joined 23.234.119.20, 138.199.6.195, and 155.2.191.165 as the fourth replay host. Anti-join against the full corpus: 13,000/13,000 prior-path overlap, 4 new first-ever paths — /stub.aarch64 (Synology-Download-Station/7.0 UA), /stub.arm (Phicomm K2P), /stub.mips (Cudy L394-V7), /stub.x86_64 (Kimanis O745-P9). Build markers persisted at near-constant rates: /manta.* ×12 (№25: 13), /fvbig/sever1078.* ×17 (№25: 18), /nokillbins/* ×18 (№25: 21), /minerd present. (High confidence — DuckDB anti-join on the node's full env-canary history.)
3. The wp-batch template re-emerged under Techoff hosting, not the INFOCREST kit operators. 195.178.110.104 (Techoff Srv BG) sent 257 wp-batch-rejected + 154 not-handled + 6 gravitysmtp events on ai-devbox-1 in 6 minutes (03:28–03:34 UTC Sep 20); body {"requests":[], Chrome/120.0.0.0 forged. The /24 has now shown this shape four times over 15 days (195.178.110.132 161 ev on 09-05, 195.178.110.53 + 103.215.74.26 78 ev each on 09-10/09-01) — register as a /24-wide automated wave. (Moderate confidence — same /24 and body shape; one more window's proliferation decides.)
4. LeakIX (REGISTRY-HUNT) ran an evening wave across both EU nodes with mints again at 1-per-IP. 14 l9scan/l9explore IPs, 662 events in-window: ai-devbox-1 carried 4 runners at 41 events each (l9scan/2.0.632323…, 1 mint each) and canary-farm-1 5 runners (l9scan/2.0.234313…), 3 at 41 events with 1 mint each and 2 at 39 events mint-less, plus 167.172.232.142 / 138.68.86.32 (39 events each) and the l9explore/1.2.2 pair 45.138.12.51 (86-87 events on netcup and frantech). The census→1-mint→no-use pattern is stable 13 windows. (Moderate confidence — runners sampled by query, not exhaustively journeyed.)

Active Campaigns (day 25 status)

CRUSADER-SWEEP ⟳ REAPPEARED — WORDLIST EXPANDED, SECOND WAVE FROM FRESH IPs (102 IPs, 5 nodes)

• Actors: 102 crusader-worker/1.0 IPs in-window, 852 all-time. Node split (in-window): ai-devbox-1 the wave seat (2,112 ev per 41 workers; first_seen 14:05:17 to 16:02:21), sponge 47 IPs / 1,927 ev (14:09–15:44), canary-farm-1 2 IPs / 60 ev (17:07), control-1 1 IP / 41 ev (16:31), frantech-ts 1 IP / 41 ev (17:33).
• TTPs: crusader-worker/1.0 honest UA, /crusader-404-probe marker, ~30–41 ev per worker on ai-devbox-1, ~41 per worker on the other nodes. Result-mix on ai-devbox-1 spans all-time, in-window: codex-auth 1,092, claude-config 312, claude-credentials 52, claude-settings 52, codex-config-toml 52, plus env-production-error 4,131 and fake-git-error 3,444 (all-time rows). No wp-batch body this run; the old 19-path core list persists at the compact end. Workers rotate but keep one census shape — no stage-2 capability added.
• Assessment: the sweep's record scale comes with its first-ever codex-auth/claude probe legs, a cloud-CLI credential target extension beyond .env variant and git-internals. The 14:05–17:33 UTC scheduling hold (three hour-span, one wave) is the №25 publication counter to compare; the campaign's 9-window idle was broken on a one-sensor record and then repeated fleet-wide in the same window.

MEGA-DICTIONARY ⟳ FOURTH REPLAY (wordlist byte-stable, new operator host)

• Actors: 169.150.201.29 (Datacamp Limited DE, ipsum:1) — fourth replay host after 23.234.119.20 (tzulo US), 138.199.6.195 (Datapacket CH), and 155.2.191.165 (Host Universal AU).
• TTPs: 13,006 GETs all not-handled, 03:14:33–03:15:54 UTC Sep 20, 208 IoT-forged UAs. Anti-join against the corpus: 13,000/13,000 prior-path overlap, 4 new first-ever paths — /stub.aarch64 (Synology-Download-Station/7.0), /stub.arm (Phicomm K2P), /stub.mips (Cudy L394-V7), /stub.x86_64 (Kimanis O745-P9). Build markers persist near-constant: /manta.* ×12 (№25: 13), /fvbig/sever1078.* ×17 (№25: 18), /nokillbins/* ×18 (№25: 21), /minerd present. Wordlist 12,949 → 13,000 held as the 100% superset.
• Assessment: the manifest is the campaign identity, not the host — four replays, four hosts, 100% path overlap each time. Track replay sequence and hosting turnover, not IP.

TECHOFF WP-BATCH ⟳ (empty-batch POST wave, /24, 15 days)

• Actors: 195.178.110.104 (Techoff Srv BG) in-window; earlier runs from the same /24: 195.178.110.132 (161 ev, 09-05), 195.178.110.53 (78 ev, 09-10), plus 103.215.74.26 (78 ev, 09-01).
• TTPs: POST /wp-json/batch/v1 with body {"requests":[] across prefix/case variants (/wordpress/, /blog/, /wp/, Batch case-variants, double-prefixed /blog/blog/…, /wordpress/wordpress/…); 257 wp-batch-rejected + 154 not-handled + 6 gravitysmtp-mock-data on ai-devbox-1 in 6 minutes; Chrome/120.0.0.0 exact forgery. Credential sibling 195.178.110.159 (curl/7.81.0 + git/2.34.1) ran the 372-path fake-git-miss/fire farm census (06:15, 3.7 s, 384 ev — the digest's 6.0× fake-git-miss spike) and minted 1 on canary-farm-1's /.env.
• Assessment: the /24 farms an automated empty-batch wave — no SQLi variant joined, the UNION-SELECT template stays unused. The git-object-walker stage (fake-git-miss on /.git/objects/<2>/<38> paths, real 40-hex object hashes, honest git/2.34.1 + curl/7.81.0 UAs) ran fleet-sibling IP with mints — keep the pair tracked together under one /24 register; promote on the next /24-wide run with stage overlap.

REGISTRY-HUNT / LEAKIX ⟳ (14 IPs across both EU nodes)

• Actors: 14 l9scan/l9explore IPs, 662 events in-window. l9scan/2.0.632323… ran on ai-devbox-1 (4 IPs at 41 ev each: 164.90.208.56, 167.71.175.236, 139.59.136.184, 143.110.217.244); l9scan/2.0.234313… on canary-farm-1 (209.38.208.202, 167.99.210.137, 159.223.132.86 at 41 ev; 167.172.232.142, 138.68.86.32 at 39 ev); l9explore/1.2.2 on 45.138.12.51 (netcup 87 ev + frantech 87 ev). All DigitalOcean.
• TTPs: unchanged 12-step census (WebLogic console → Confluence → WHM/cPanel → docker-registry enum). Mint rows: 8 window mints to unique collector IPs (164.90.208.56, 167.71.175.236, 209.38.208.202, 167.99.210.137, 159.223.132.86 with 1 each) per the Tracebit pull; the 1-mint-per-IP cadence held.
• Assessment: scheduling, not tooling, moves this campaign — the 14-runner wave scales between №13's 24-runner fleet-wide peak and single-digit returns. Keep the borderline-benign/borderline-hostile split: LeakIX is a public leak-scanning service that buys nothing but mints 1/IP each wave.

OMEGA-SWEEP ⟳ /46 census holds, two operators

• Actors: 94.154.46.244 (Omegatech US, forged Googlebot/2.1) ran 2,019 ev/573 paths on ru-edge-1 plus 2,005 ev on control-1, minting 6 on ru-edge (08:50:50–08:51:02 UTC) and 1 on control (03:55). 94.154.46.247 ran a 135-path pass on sponge 15:38–15:43 UTC. .245/.246 stayed silent.
• TTPs: the standing 743-path Googlebot/2.1 template; ru-edge mints landed in a 17-second burst, the campaign's known cadence under census scale.
• Assessment: two operators per window remains the campaign's median shape, with mint-handling identical across hosts — the /46 is a shared template, not independent operators.

MALWARE-DICT-2 ⟳ Pfcloud loop sustained (1,466 ev control + 1,476 ru-edge, byte-identical)

• Actors: 204.76.203.18 ran 1,466 ev/564 paths on control and 1,476 ev/564 paths on ru-edge-1, 11:32→06:14+ (~19 h) — the continuous loop's two nodes. The .31 sibling kept its light 4-node/35-event sibling census.
• TTPs: identical results-with-host family, /not-handled bulk rows, empty UA.
• Assessment: the pair's 2,942 combined events at byte-identical timing continue every cycle; per the registry the wordlist held at 573 paths this cycle — the digest's first-seen table carries no new family.

LIBREDTAIL-KIT ⟳ (10 operators, 6 nodes)

• Actors: 10 fresh IPs, 444 events total; netcup quiet. A 43.155.202.36 libredtail run at 00:53–02 (49 ev) is visible in the ru-edge 00:00 UTC burst alongside the larger .71 OMEGA-SWEEP burst there.
• TTPs: chain unchanged; dropper captured 10/10 to 217.60.103.56 (captured 10/10, arg apache), no selfrep re-swing this window; the fleet held every capture.
• Assessment: tenth+window activity stays a low-fidelity background nuisance. Watch the frantech Chrome/114 crawler and the new 195.177.94.18/nook browser/1.0 pairing — it minted 2 creds (one per node) with no other family action and is a candidate next operator shape.

NIGHTAGENT ⟳ IDLE (first full-Kit miss since №25)

• Actors: zero NightAgent-echo bodies fleet-wide.
• Assessment: ninth window is narrow; the GHSAT token stays pinned; return remains on watch with the 3-mint template's 4-mint/min pacing margin.

WP-LOGIN-BRUTE ⟳ (background)

• ~22 IPs × 3 ev probes on wp-login; no mints. Low; the 200-pair alarm stays armed.

Standing actors (persistence check)

• 213.209.159.175 (Feo Prest DE) — 13th window in 16: 9 window mints (6 farm, 3 control; 227-path control census at 00:20–00:21), 30 all-time within the 6-day Tracebit pull — the fleet's top persistent collector. Zero AWS use ever.

• 80.94.95.211 (SS-Net RO) — 14th window: 42 ev each on ai-devbox-1 (21:59) and ru-edge-1 (02:09), 6 window mints (3+3), same wordlist share with Feo Prest .175 and the MSIE-9/Chrome forged UA family.

• 102.220.161.139 + 102.220.161.102 (VPS Dedicated SI, CREDSWEEP) — .139 ran 677 ev on ai-devbox-1 (04:20–04:26, Chrome/126.0.0.0 exact UA, 183 paths) plus single-mint touches on farm, control, and ru-edge (all-time 9 in 6d); .102 ran 141 ev on ru-edge (03:42–03:56, stripped Chrome/126 UA, 1 mint, all-time 5). The Chrome/126.0.0.0 exact UA carried 803 rows fleet-wide in-window.

• 195.178.110.159 / .104 (Techoff BG) — git-object walker (384 ev on canary-farm-1 at 06:15 in 3.7 s, curl/7.81.0 + git/2.34.1, the fake-git-miss spike driver, 1 mint) and wp-batch spam (257 ev on ai-devbox-1). Track both under one /24 register; promote next window.

• 193.32.204.199 (Madina IT, git-walker) — 275 events on 3 nodes with the stripped-Chrome forgery; .sSH/ID_* case-variant probes persist.

• 176.65.144.71 (Dedik CH) — 649 events on ru-edge-1 at 00:21 (9-minute 743-class Googlebot/2.1 pass, 95 result families). Sibling 176.65.148.71 minted 1 on ai-devbox-1 (07:03).

• 213.209.159.154 (Feo Prest sibling) — 0 events (fifth idle window).

• Absent: METADATA-HUNT (fourth idle — 0 __aws_leak_probe/@fs rows), AKAMAI-CONFIG (23.94.155.0/24 absent — watch for a third run), GCP-ACONF (fifth idle), ENV-CENSUS-3/4 (no standalone named run), the №25 synchronized 8-IP WP wave (singles only from 165.227.15.209 / 156.67.104.55), NIGHTAGENT operators, CURL-SWEEP (eighth miss).

Fleet Observations

• Mint economics: 51 issued rows / 49 creds to 21 collectors (±2 row/credential gap = the +4h cast boundary; count credentials from the Tracebit pull). 39 failures (farm 9, aidev 15, control 9, ru-edge 6), all 400 Bad Request — failure ratio 0.78:1, the fourth-best band since №16's zero-failure window.
• Node inventory: canary-farm 19 mints/11 IPs; ai-devbox 15/12; ru-edge 12/5; control 5/3; netcup, sponge, and frantech mint nothing (no canaries by design).
• Host census: canary-farm-1 kept the split view (sso.rightabouteverything.show 957 vs 109.123.246.142 956, near-even HTTP/HTTPS). ai-devbox-1 still divides vmi3177282.contaboserver.net (2,091) + inference.fapthropic.com (1,048) + raw IP (810) — TLS durable, TLS split tracks on.
• Attribution: 0 empty-clientIp rows and all four XFF counters at zero in-window — the attribution fix holds through its 15th day. The digest's "any XFF 2,159 / XFF present but ignored 741" are the designed Caddy-appended legitimate background, not flags (registry note).
• Control velocity: 3,937 events / 109 unique IPs. The daily unique-IP ramp holds in its 94–129 band since 09-16; the 129→109 single-day drop is variance within band, not a collapse.
• SSH/telnet (single sensor): funnel 591 sources → 490 shells (83%) → 312 command-runners (53%). Event level: 24,742 attempts → 17,030 accepted logins → 16,019 commands (94% conversion of accepted logins). NO new command and NO new credential pair this window (0 of 63 commands; 0 of 6,927 pairs) — first fully static window in fleet history. The credential pool top stays 345gs5662d34/345gs5662d34 (1,378 attempts) + root/3245gs5662d34 (1,047).

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-09-20.html

Canary credentials

Summary

No canary credentials were used in AWS during the window. Fleet sensors minted 49 credentials to 21 collector IPs; none reached AWS.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 213.209.159.175: 30 mints, 2026-09-15 23:33 → 2026-09-20 05:20
• None: 26 mints, 2026-09-13 06:19 → 2026-09-15 10:51
• 136.117.52.210: 26 mints, 2026-09-14 00:41 → 2026-09-14 00:41
• 80.94.95.211: 23 mints, 2026-09-16 21:23 → 2026-09-20 02:09
• 31.57.219.158: 20 mints, 2026-09-18 19:15 → 2026-09-18 19:38
• 94.154.46.244: 16 mints, 2026-09-17 09:24 → 2026-09-19 08:51
• 94.154.46.242: 12 mints, 2026-09-15 15:58 → 2026-09-17 08:56
• 176.65.144.71: 10 mints, 2026-09-18 06:02 → 2026-09-18 06:02
• 94.154.46.243: 10 mints, 2026-09-15 20:50 → 2026-09-15 20:50
• 102.220.161.139: 9 mints, 2026-09-15 21:00 → 2026-09-20 03:44
• 129.222.206.62: 8 mints, 2026-09-15 18:35 → 2026-09-15 21:40
• 2a01:e0a:3be:cec0:f54c:335a:8d29:be: 8 mints, 2026-09-17 17:04 → 2026-09-17 17:04
• 8.234.173.27: 7 mints, 2026-09-16 00:03 → 2026-09-16 00:03
• 23.234.114.118: 6 mints, 2026-09-18 12:28 → 2026-09-18 14:07
• 94.154.46.247: 6 mints, 2026-09-16 04:01 → 2026-09-16 04:02
• 102.220.161.102: 5 mints, 2026-09-18 00:13 → 2026-09-20 03:42
• 167.99.79.44: 5 mints, 2026-09-19 18:01 → 2026-09-19 20:02
• 94.154.46.250: 5 mints, 2026-09-16 12:34 → 2026-09-16 12:34
• 178.16.54.184: 4 mints, 2026-09-17 14:21 → 2026-09-17 14:21
• 196.89.218.205: 4 mints, 2026-09-18 00:57 → 2026-09-18 01:39
• 69.5.20.14: 4 mints, 2026-09-16 09:23 → 2026-09-16 15:50
• 167.99.181.249: 3 mints, 2026-09-15 18:13 → 2026-09-17 20:23
• 176.65.148.71: 3 mints, 2026-09-16 17:48 → 2026-09-19 07:02
• 209.38.208.202: 3 mints, 2026-09-15 21:40 → 2026-09-19 20:46
• 213.209.159.154: 3 mints, 2026-09-17 20:33 → 2026-09-18 18:58
• 41.249.4.249: 3 mints, 2026-09-17 03:54 → 2026-09-17 03:55

Gaps / Next Collection

1. CRUSADER mint attribution. The ai-devbox-1 codex/claude census legs minted nothing in-window; the 15 window-mint rows on ai-devbox-1 come from other campaigns' collectors. Run ip-journey on the two 2-mint IPs by count (34.169.20.182, 136.108.99.225) to separate the standing single-IP collector pattern from the wave seat. Whether codex/claude canvassers hit keyed canary paths or only the wordlist is unmeasured this window.
2. The Techoff /24 as one campaign cell. 195.178.110.104/.159/.132/.53 plus 103.215.74.26 span 15 days — a next window showing both the batch and the git-walker on one node upgrades the /24-wide automation claim to permanent registry status.
3. MEGA-DICTIONARY version diff. Anti-join the 13,006 paths against №25's stored 13,000 and the two 12,949 sets; confirm stub.* groups with the build-tag families so the standing version tracker stays accurate.
4. The empty-IP None collector hoard TTL. 26 mints, 2026-09-13 06:19 → 2026-09-15 10:51; risk window roughly closed — verify the alert pull returned zero use before closing the ledger.

Digest: /data/flux-logs/reports/flux-digest-2026-09-20.md
Briefing: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-09-20.md

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-09-20.html

Watch next cycle: (1) CRUSADER-SWEEP's second consecutive day — the 14:05–17:33 UTC scheduling hold and any first observed mint→use. (2) The Techoff /24 (195.178.110.x) — stage-2 batch shape, or /24-wide census coalescing. (3) 213.209.159.175's 30-mint no-use hoard against its TTL.