FLUX FLEET — INTEL BRIEFING №40

Period: 2026-10-02 07:33 – 2026-10-03 07:33 UTC (24h, day 38 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 38-day baseline, main volume moves tied to spot-query evidence, with one pipeline caveat on ai-devbox-1 — Key Judgement 4)

BLUF

The MEGA-DICTIONARY replay returned after one missed window: 98.98.47.133 (Zenlayer MY) pushed 13,327 events through frantech-ts in 2m52s, and the shared wordlist grew by 27 paths to 13,324. Credential use ran for a sixth consecutive window. Three credentials drew 5 successful sts:GetCallerIdentity calls and 4 denied ListFoundationModels calls. First-time users include a LeakIX runner (159.65.144.72) and Feo Prest .154. REGISTRY-HUNT tied its №15 record wave — 24 l9scan IPs collected 23 canaries at one per IP. WP-FORM-BRUTE entered a third window with a rotated roster and a 131-POST numeric burst on ai-devbox-1. Pipeline caveat: ai-devbox-1's log rotated at 05:06 UTC, and the 268 MB rotated file sits outside the digest glob. The aidev cell (−89%) covers only the last 2.5 hours of the window, so read it as an artifact, not a decline.

Key Judgements

1. The MEGA-DICTIONARY wordlist is a maintained tool, not a frozen dump. The anti-join against the pooled prior artifact shows +27 paths: 11 /bin/manta.* architectures, 2 /bins/morte.*, 3 /302/* variants, and 11 dropper scripts. A new host (98.98.47.133) replayed it, and the №37 host returned on a third node. (High confidence — the growth is measured against every path the five replay hosts ever served.)
2. Canary use broadened across actor classes. A LeakIX runner spent a stolen canary in AWS beside the criminal hoarders. Feo Prest .154 used a credential for the first time. Sibling .175 set a 135-credential 6-day hoard record. (High confidence on the events — Tracebit operations are direct evidence. Moderate on the trend — three windows of actor-class breadth is a short series.)
3. WP-FORM-BRUTE is a standing rotating-roster campaign. Four registered runners persisted, six new runners joined, and the roster now mixes an 8-minute 131-POST burst with 11-hour low-and-slow POST runs. (High confidence — bodies, form tokens, and the fixed log=admin carry across all three windows.)
4. ai-devbox-1 went blind to the digest mid-window. The node's log rotated at 05:06 UTC, the rotated file sits outside the digest glob, and the all-time issued counter fell from 2,460 to 1,484. (High confidence — file sizes and first/last timestamps are direct evidence.)

Active Campaigns (day 38 status)

MEGA-DICTIONARY (shared IoT dropper-URL dictionary) ⟳ — REPLAY RETURNED, WORDLIST GREW (Hostile, active)

• Actors: 98.98.47.133 (Zenlayer Inc, MY) — the №37 ru-edge host, now on frantech-ts. Replay 05:20–05:23 UTC (2m52s), 13,327 events / 13,324 paths, 209 rotating UAs (sample 360 Router P2 v2), 0 POSTs, 0 mints. Prior hosts: tzulo US 23.234.117.146/.118.146, 31173 Services AB 193.32.126.191/.131, 185.213.155.227.
• TTPs: one byte-shared dictionary passes between operators. The host rotates per replay, and each replay gets an anti-join. The +27 against the pooled prior artifact (13,298 distinct — the registered manifest was 13,297): /bin/manta.{aarch64,arc,armv6l,armv7l,i686,m68k,mips,mipsel,ppc,sh4,x86_64}, /bins/morte.{arc,spc}, /302/302l|m|w, /Pemex.sh, /backdoor.sh, /brysj/b.sh, /hggseiqwekf.sh, /lmaoWTF/loligang.spc, /pldq.sh, /plx.sh, /q.sh, /rs.sh, /up, /bot-linux-386.
• Assessment: the artifact is under active maintenance, and growth clusters on fresh loader families (manta, morte). The replay drove frantech-ts +65% (14,651 events). Fleet design validation: all 13,324 paths landed on deception surfaces at zero intel cost.

CREDENTIAL-DRAIN (mint→use pipeline) ⟳ — SIXTH USE WINDOW, SES LAPSED (Hostile, active)

• Actors (use side): Feo Prest .154 used 1 credential from 3 AWS-side IPs — its first use (hoard 73/6d). LeakIX runner 159.65.144.72 used 1 from 1 IP. SS-Net .211 used 1 from 4 IPs with no flux mints in-window, so Tracebit is the only witness. No use IP appears in flux logs — the split persists.
• TTPs: 9 use events across 3 credentials — 5 sts:GetCallerIdentity successes, 4 denied ListFoundationModels. The №38–№39 SES pair (GetSendQuota/GetSMSAttributes, 85 denials each) did not repeat. Hoards: .175 135/6d (record, prior 114), .154 73/6d, 45.148.10.171 19/6d.
• Assessment: use is now standing behavior across three actor classes. Successes stay confined to identity calls and the deny-all policy held. Sender-infrastructure recon paused this window — watch for its return.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — TIES №15 RECORD WAVE (Borderline)

• Actors: 24 l9scan IPs, 1,414 events, 23 mints at one per IP across canary-farm-1, ai-devbox-1, and control-1 — the same 24/23 shape as №15. Runner UA variants: l9scan/2.0.234313… (farm), 2.0.632323… (aidev), 2.0.930323… (control). Cross-node runners: 165.227.84.14 (control+farm), 167.99.181.249 (farm+aidev), and the kiteworks-signature 206.189.19.19 (farm — the abf92a331d66 cluster on lauterbourg held 5 IPs / 195 events). l9explore 45.138.12.51 minted 2 (farm+control).
• TTPs: the registered WebLogic → Confluence → WHM/cPanel → docker-registry journey is intact. The farm POST sample is a GraphQL credential-fields introspection — query Probes{ a_viewer: viewer{ … awsAccessKeyId } … } — classified credential-field on the canary path. Runner 159.65.144.72 then used its canary in AWS (GetCallerIdentity), the first l9scan AWS touch.
• Assessment: collection volume and per-runner cadence are unchanged, but the population now spends what it collects. Honest UA and public service identity keep LeakIX borderline per the registry. The AWS use erodes that distinction.

WP-FORM-BRUTE (distributed wp-login form brute) ⟳ — THIRD WINDOW, ROSTER ROTATED (Hostile, active)

• Actors: persisted — 1.234.27.159 (ru-edge, 12 POSTs), 47.104.246.244 / 198.44.46.229 / 42.193.124.174 (sponge). New — 39.105.208.239 (Hangzhou Alibaba, CN — aidev, 131 POSTs / 131 distinct bodies in 8 minutes), 160.250.204.33 (netcup, 14 POSTs over 11 h), 43.161.222.61 (netcup), 65.109.52.70 (farm), 212.132.101.142 (ru-edge), 47.238.249.137 (sponge). The parallel wp-login+xmlrpc shape ran from 217.60.198.3 (ru-edge — same /16 as the LIBREDTAIL staging host, note only).
• TTPs: the aidev burst body, verbatim: log=admin&pwd=10901&redirect_to=http://217.15.163.226/wp-admin/&testcookie=1 — fixed log=admin, 4–5-digit numeric passwords (observed range 8,890–11,965), testcookie, no _wpnonce, vhost-derived absolute redirect. The ru-edge runner kept the fuller form: _wpnonce=8781a0b699&log=admin&pwd=Admin123&redirect_to=%2Fwp-admin%2F&testcookie=1&wp-submit=Log+In, plus one system.listMethods xmlrpc POST. The aidev wp-login-credentials spike is 11.2× (134 events), and 39.105.208.239 owns 131 of them.
• Assessment: the campaign outlives its original 11-runner wave and now runs burst and low-and-slow modes at once. Pair count stays far below the WP-LOGIN-BRUTE 200-pair alarm.

OMEGA-SWEEP (/46 census pool, Googlebot forgery) ⟳ — .250 SECOND RUN (Hostile, active)

• Actors: 94.154.46.250 — second run: ru-edge 750 events / 743 paths / 118 families in 12 seconds (09:48 UTC), 5 mints under forged Googlebot/2.1. The 743-path wordlist is the №14 .248 core, not .250's own 1,007-path set. Light passes on frantech-ts: .248 (150 paths / 300 events, 14:50 UTC) and .243 (17:17 UTC).
• TTPs: the kill-chain journey carries /.env [issued], docker-compose.*, /.aws/config, /Jenkinsfile, /.ssh/id_dsa, and yarn.lock — the №36 IaC/DevOps growth plus the credential core.
• Assessment: the ninth block host now runs the shared 743-path template. No observed AWS use from the /46 range. The 6-day hoard leaders are .246 (28) and .249 (12).

GIT-VAULT (git-internals walk) ⟳ — REACTIVATED AFTER 17 IDLE WINDOWS (Hostile, active)

• Actors: 104.207.39.149 + 65.111.3.141 (3xK Tech GmbH, US) — a synchronized pair on canary-farm-1, 1 hour apart (08:23 and 09:26 UTC). Neither IP is blocklisted.
• TTPs: honest git/2.40.0 UA and identical 142-path walks (144 events, 2 families): /.git/HEAD, /.git/index, ORIG_HEAD, packed-refs, COMMIT_EDITMSG, FETCH_HEAD, description, and the full hooks/*.sample set. 0 mints, 0 POSTs.
• Assessment: a new operator runs the GIT-VAULT template with a current git UA (git/2.39.0 was the №13 fingerprint). Exfil intent is unmeasured at this depth. Promote on a secrets-path extension or a mint.

LIBREDTAIL-KIT (phpunit RCE + key-exfil oracle) ⟳ — 21ST WINDOW (Hostile, active)

• Actors: 4 full-kit IPs × 37 events on lauterbourg-01-ts — 167.71.233.141, 102.244.97.185 (№34 repeat), 89.126.214.24, 118.145.104.37. The php-cgi delivery cluster 7e61a9500d8b (⟳ since 08-29) ran 7 IPs / 343 events on farm, frantech, netcup, and sponge.
• TTPs: md5("Hello PHPUnit") eval-stdin probes. The four lauterbourg legs drove that node's phpunit-eval-stdin spike (148 events, 4.8×). Staging host 217.60.103.56 is unchanged since №17.
• Assessment: execution-seeking kit on a slow heartbeat. No bodies quoted this cycle — the lauterbourg legs are probe-stage only.

CREDSWEEP family (.env census and collectors) ⟳ — STANDING SET CARRIES (Hostile, active)

• Actors: 45.148.10.171 — eighth consecutive minting window, 3 mints under Phoenix/0.2, Chrome/72, and Camino/2.2.1 forgeries (19/6d). 102.220.161.87 (VPS Dedicated, SI) minted 2 (control+ru-edge, honest Go-http-client/1.1, 4/6d since 09-30). Feo .175 minted 31 on control-1 in one Android/4.4.2 SM-T211 burst plus 2 under MSIE 3.0B. Sibling .154 added 2 on farm. New collector 41.140.8.33 (ONP MA, Morocco): 3 events on 1 path (/.env), 3 mints. 206.209.210.3 ran a second one-touch sweep (control+lauterbourg+sponge, 1 mint under an Opera/9.60 Opera Mini forgery). №39's operator 188.166.248.40 was absent.
• TTPs: mint concentration sits on control-1 (48 rows / 13 IPs) and canary-farm-1 (24 / 19). Antique-UA forgery rotation stays the family fingerprint.
• Assessment: the census family recruits single-run operators while Feo Prest concentrates minting. 41.140.8.33 joins the ONP-MA collector set (INFOCREST/NIGHTAGENT homeland) — watch for kit correlation.

Watch-class singles (no campaign yet)

• 51.210.247.58 (OVH, FR): 547 events / 78 paths / 9 families in 0.3 s at 21:50 UTC, 8 rotating browser UAs — owns the netcup wp-user-enum-rest-single inf spike (144 events). One POST, body not captured.
• 217.60.198.3 (12651980 CANADA INC, AE): ru-edge 141 events / 39 paths, 4 POSTs (3 wp-login + 1 xmlrpc), 7 UAs — see WP-FORM-BRUTE. Same /16 as the LIBREDTAIL staging host, note only.
• 87.182.231.18 (Deutsche Telekom, residential): lauterbourg 160 events / 30 paths / 1 family in 22 s under the self-label CameraScannerV3/1.0.
• 35.220.183.213 (Google LLC, HK): lauterbourg 157 events / 71 paths / 3 families in 32 s, 5 UAs — census-watcher shape.
• 64.227.44.191 (DigitalOcean): 10 events on 1 path under the self-label CGrab/v8.24.1-dev-throughput — throughput-test noise.

Absent or paused

ZKILLU-GITWALK (no second window, and no AWS use of its 2 canaries), SONICWALL-VPN-PROBE (0 events), CF-FRONTED CREDSWEEP (third window), METADATA-HUNT (ninth marker-light window), ORACLE-SWEEP (standing-paused), CONFIG-SWEEP (no run since №33), SS-PROBE, NIGHTAGENT (dormant, dropper retired), XMLRPC-BRUTE (silent), CRUSADER-SWEEP, CURL-SWEEP, GCP-ACONF, AKAMAI-CONFIG, ALIYUN-PROBE, ENV-CENSUS-3/4, SYNC-ENUM-WAVE, TOKEN-CRAWLER (no /c/ wave). MALWARE-DICT: 204.76.203.18 ran its 27th control-1 loop — 872 events / 565 paths, down from 1,550.

Standing actors (persistence check)

• 213.209.159.175 (Feo Prest): record hoard 135/6d, plus a 31-mint control burst. Sibling .154 sits at 73/6d and is now a use actor too.
• 80.94.95.211 (SS-Net, RO): fourth consecutive use window — 1 credential, 4 AWS-side IPs, zero in-window flux mints.
• 45.148.10.171: eighth consecutive minting window, 19/6d, zero use.
• 204.76.203.18 (Pfcloud UG, NL): 27th loop window, volume declining (872 events).
• 206.209.210.3 (unattributed): second window of one-touch multi-sensor sweeps — 3 sensors, 1 mint, a fresh forgery per stop.
• 102.220.161.87 / .139 (VPS Dedicated, SI): .87 minted 2 this window (4/6d).
• Benign probers, unchanged: 89.248.172.33 and 93.174.93.12 fixed-cadence / handshakes.

Network-layer recon (Arkime) — 2026-10-02 07:33:00 → 2026-10-03 07:33:57 UTC

Fingerprint field ssh.hassh, destination port 22 · 122,459 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 81,094, frantech-ts 31,587, sensor:frantech-ts 31,587, sensor:lauterbourg-01-ts 20,078, bahrain-sponge-01-ts 15,893, sensor:bahrain-sponge-01-ts 15,893, sensor:sponge-01-ts 12,912, sponge-01-ts 12,912

Flagged sweeps (1) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 7,308 sessions from 357 source IPs across 182 networks in 61 countries, port 22, avg 4,965 B/session. Networks: AS8075 Microsoft Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS132203 Tencent Building, Kejizhongyi Avenue, AS150436 Byteplus Pte. Ltd., AS16276 OVH SAS. Busiest sources: 185.158.22.150, 163.7.9.84, 189.217.130.86, 201.71.192.108, 201.17.133.138. Last 7 days: 09-27 316 IPs, 09-28 356 IPs, 09-29 355 IPs, 09-30 365 IPs, 10-01 350 IPs, 10-02 332 IPs, 10-03 145 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon notes: GO-SPRAY-SWEEP (06ff3615…) missed for the first time since the №39 re-cross — a single miss does not re-pause it. GO-SSH-SWEEP (0a07365c…) stays the volume leader (24,793 sessions, 63 IPs, −2,809 day-over-day) but sits below the dispersed threshold at 18 networks, and it is the top fingerprint on five nodes. LIBSSH-MASSSWEEP holds its plateau (357 IPs, day 14, band 316–373). The unnamed heavy 16443846184e… grew to 16,230 sessions (+3,295) — sixth cycle without banner characterization. e37f354a101a… jumped +7,632 to 10,881 sessions and is now frantech-ts's top fingerprint — unnamed. 084386fa7ae5… spread from 39 to 57 source IPs across its 14 days on record — unnamed. 4e066189c3bb… returned (4,539 sessions) after two absent windows. One new fingerprint today (5b6167e6ec2e…, banner ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.19, 5 sessions, 1 IP) sits below every threshold. sponge-01-ts inbound fell to 15,893 tagged sessions (from 26,706).

Fleet Observations

Pipeline incident — ai-devbox-1 log rotation. The node's env-canary.jsonl rotated at 05:06 UTC: 268 MB of history moved to env-canary.jsonl.1, and the digest glob (like v_logs) reads only the live file. Effects: the aidev digest cell covers about 2.5 h of the 24-h window (320 events, −89%). The all-time issued counter fell from 2,460 to 1,484. Every aidev campaign before 05:06 UTC is invisible this cycle. The digest is the deployed artifact — the fix (ingest rotated files, or rotate behind the sync boundary) belongs in the ops repo. Until then, read every aidev cell as a floor. No other node rotated. All nodes carry env-canary.jsonl~ backups only.

Canary economics. Digest mint rows: control-1 48 (13 IPs), canary-farm-1 24 (19), ru-edge-1 9 (5), ai-devbox-1 4 (4) — 85 rows. Tracebit dedup sees 42 credentials to 33 collectors. Mint failures: zero, second consecutive window. Hoard leaders: .175 135/6d (record), .154 73/6d, .171 19/6d. №39's open question is resolved: the ssh mint label is a real second type in the farm canary menu (canaryTypes: ["aws","ssh"] appears on 2,683 all-time farm rows), so the 16 labelled rows in №39 were multi-type canary mints, not label drift. Every mint this window carries aws only.

Attribution and TLS posture. XFF counters: any 811 / multi-entry 0 / ignored-internal 7 / single-entry mismatch 0 — no forgery signal this window. Host census: vhost-led on the proxied nodes (sso.rightabouteverything.show 812, kiteworks.rightabouteverything.show 366, inference.fapthropic.com 166 — the last depressed by the rotation) and bare-IP-led elsewhere.

Volume moves and causes. frantech-ts +65% (14,651) — the MEGA-DICTIONARY replay (13,327 events). netcup-ts +110% (2,048) — Bucklog .75's 956-event census leg plus 51.210.247.58's 547-event burst. canary-farm-1 −69% (1,746) — no ZKILLU mass and no CF wave. The l9scan wave (1,414) is the largest single component. control-1 −47% (2,899) — the 7-day average still carries №37's spike days. ru-edge-1 −51% (1,465), lauterbourg-01-ts −49% (1,262), and sponge-01-ts −55% (532) ran no replay-class volume. ai-devbox-1 −89% (320) — rotation artifact, see Key Judgement 4.

control-1 discovery velocity. Day 20: 2,899 events from 128 unique IPs — inside the 62–145 band for the fourteenth consecutive window.

Result-tag spike attribution. All four spikes ≥3× have causes. The aidev wp-login-credentials spike (11.2×) is 39.105.208.239. The lauterbourg phpunit-eval-stdin spike (4.8×) is LIBREDTAIL-KIT's four lauterbourg legs. The netcup and ru-edge wp-user-enum-rest-single inf spikes are 51.210.247.58 and 217.60.198.3.

Fleet-side changes this cycle. The CHAINS dict in flux-visuals.py gained updates for MEGA-DICT, CREDENTIAL-DRAIN, REGISTRY-HUNT, CREDSWEEP, GIT-VAULT (reactivated), LIBREDTAIL-KIT, OMEGA-SWEEP, WP-FORM-BRUTE, SS-NET TOOLING, ZKILLU-GITWALK (idle), and SONICWALL-VPN-PROBE (idle). TALKER_CAMPAIGNS gained the six new WP-FORM runners, the Bucklog pair, the GIT-VAULT pair, and 51.210.247.58. recon-names.tsv is unchanged (no new network-layer names). The visuals dashboard reran twice after CHAINS corrections and saved as -r3. Style note: the skill's style-editing step is unavailable on this host, so the technical-prose house style and its banned-phrase list were applied instead.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 564 sources sent credentials → 439 got a shell (78%) → 279 ran a command (64% of shell-getters, 49% of sources). Event level: 38,999 credential attempts → 3,657 accepted logins → 5,515 commands (151% of accepted logins go on to run something, down from 194%).

Thirteenth fully static window. New commands: 0 of 48 distinct. New credential pairs: 0 of 29,925. Telnet commodity attempts rose to 736 from 611. The .ssh replant pair stays dominant: cd ~; chattr -ia .ssh; lockr -ia .ssh ran 1,140 events from 225 IPs, and the key-replace companion ran 976 from 211. The uname inventory pair ran 370 events each from 8 IPs led by 195.178.110.217 (Techoff block), and the GPU/host survey set (lspci | grep VGA, nvidia-smi -q, /bin/./uname, uptime -p) ran 250 events each from 2 IPs led by 195.178.110.218. Credential concentration is unchanged: 345gs5662d34/345gs5662d34 drew 1,092 attempts and root/3245gs5662d34 drew 828.

Gaps / Next Collection

1. Restore ai-devbox-1 history. Ingest env-canary.jsonl.1 (268 MB, closed 05:06 UTC 10-03) into the digest view, or move rotation behind the sync boundary. Until then every aidev cell is a floor.
2. CREDENTIAL-DRAIN seventh window. Watch for a LeakIX use repeat. Enrich 159.65.144.72's AWS-side IP against LeakIX scan infrastructure. Check whether the SES pair returns.
3. MEGA-DICTIONARY growth tracking. Anti-join the next replay against the 13,324-path mark. 98.98.47.133 replayed on two nodes so far (ru-edge №37, frantech №40) — a third host or a same-host repeat would firm up the operator model.
4. WP-FORM-BRUTE roster census. Re-count runners next window and diff against this cycle's ten. Check whether 39.105.208.239's numeric wordlist recurs.
5. Network-layer banner characterization, cycle six. 16443846184e… (16,230 sessions), e37f354a101a… (10,881, frantech top), and 084386fa7ae5… (57 IPs, up from 39) are unnamed. Confirm whether 4e066189c3bb… returns again.
6. GIT-VAULT pair. Watch for a third 3xK Tech IP, another node, or a secrets-path extension beyond the hooks set.
7. ZKILLU-GITWALK and SONICWALL-VPN-PROBE second windows. Both went quiet after №39. A Sonicwall return with credential POSTs triggers promotion.

Digest: /data/flux-logs/reports/flux-digest-2026-10-03.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-03.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-03-r3.html

Watch next cycle: (1) ai-devbox-1 rotation fix, and its true window volume after the ops fix restores its history. (2) CREDENTIAL-DRAIN — a seventh use window, the LeakIX use repeat, an SES return. (3) MEGA-DICTIONARY — anti-join the next replay against 13,324. The growth rate now has two data points in two windows.