Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №47 — PLAIN LANGUAGE

Period: 2026-10-09 07:34 – 2026-10-10 07:34 UTC (24h, day 45 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-10.md

What happened (plain)

The scanner we call METADATA-HUNT came back after 12 quiet days, and it came back changed. One server rented from Google Cloud (34.124.231.201) spent 21 seconds trying known code-execution tricks against canary-farm-1, disguised its requests as 33 different well-known AI crawlers (ClaudeBot, GPTBot, PerplexityBot, Bytespider, Kimi, DeepSeek and others), and picked up 40 fake AWS credentials — more than any single visitor has ever taken from the fleet. REGISTRY-HUNT (the LeakIX scanner family) swept all 8 sensors with about 49 addresses and tried a deeper version of its Jira trick on the new Kiteworks node. CONFIG-SWEEP repeated its one-minute burst against ru-edge-1 and took 6 credentials. GIT-VAULT came back as three synchronized DigitalOcean addresses running identical git-file walks. The shared malware dictionary (MEGA-DICTIONARY) replayed for the 14th time from a new German host, 11 paths bigger than last time. Nobody used any of the stolen credentials in AWS: 84 credentials went to 33 collectors, zero calls.

What it means (plain)

  1. METADATA-HUNT now wants live secrets, not only files. It kept its two calling cards — the fake AI-crawler names and the /@fs/home/ec2-user/.aws/credentials-style file paths — and added attacks that try to make the server run commands: Langflow's /api/v1/validate/code with a body starting {"code":"@exec('raise Exception(__import__("subprocess").check_output("env 2>/dev/null…, Flowise's /api/v1/node-load-method/customMCP, /lib/terminal-xhr.php with command=env&password=bypass&csrf=x, file-read bodies like {"file_path":"/proc/self/environ"} and {"file_path":".env"}, template paths like {"templateFile":"../../../../.env"}, and php-cgi bodies reading <?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>. (High confidence — the calling cards and the bigger 40-credential batch match the registered template; the changed trick list is the upgrade we predicted.)
  2. The LeakIX family is growing tools as well as addresses. About 49 l9scan addresses hit all 8 sensors, and one Tc Datacenter address (45.138.12.51) ran two more LeakIX tools (l9explore/1.2.2, l9tcpid/v1.1.0) against frantech-ts and sponge-01-ts. The deeper Jira path — 5 ..:: climb levels instead of 2 — ran from 10 addresses on one node only, so it is a trial rollout. (High confidence — one self-labeled tool family, 8 name variants, synchronized stage changes.)
  3. The Bucklog group ran its biggest census yet from a new address. 185.177.72.100 looked at 1,433 counted events (1,637 raw), 1,008 paths, and 102 trap families on control-1 in 20 minutes using curl/8.7.1. It owns all 10 of control-1's first-seen paths this window, including xai_config.yml, config/mailgun.yml, brevo_config.json, sparkpost_credentials.json, mongodump.zip, docker-compose.yml.tar.gz, sentry/, rabbitmq/, prometheus/rules, and /internal/configprops. The group used three addresses on two sensors and took 1 credential through 185.177.72.205. (Moderate confidence — one 20-minute window so far.)
  4. For the second window running, the stolen credentials bought nothing we can see. 84 credentials reached 33 collectors; Tracebit logged zero AWS alerts and zero successful calls. The last observed use was two days ago. (High confidence for this window — a use outside the pull window would look the same as no use.)

Campaigns (who / what / what it means)

METADATA-HUNT — a scanner that pretends to be AI crawlers and hunts credentials

  • Who: one Google Cloud server, 34.124.231.201 (Singapore), working alone against canary-farm-1 in a single 21-second pass from 08:05:03 to 08:05:24 UTC on 10-10.
  • What they did: 374 requests across 223 paths and 74 trap families, 36 of them POSTs. They bounced off the tarpit, probed graphql on three paths, sent prototype-pollution forms starting {"then":"$1:__proto__:t…, then ran the code-execution attempts listed above. They also tried the /@fs/home/ec2-user/.aws/credentials and /@fs/home/ubuntu/.aws/credentials file traversals, pulled env-production ×35 and firebase-json ×13, and touched a new debug-trigger path /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show. In 8 seconds (08:05:04–08:05:12 UTC) they collected 40 fake /.env credentials, each request wearing a different fake crawler name — 33 different names across the pass.
  • What it means: they moved from copying config files to making the server run commands, and the commands all read environment variables or /proc/self/environ — secrets that never sit on disk. The 40-credential take is a fleet record for one visitor (the old record was 27). All 40 are now in hostile hands until they expire. The decoys answered every request at no cost to us.

REGISTRY-HUNT — the LeakIX scanner fleet

  • Who: about 49 l9scan addresses spread over all 8 sensors (farm 16, aidev 16, lauterbourg 10, control 2 plus 1 curl client, ru-edge 2, netcup 1, sponge 1, frantech 1), all in DigitalOcean address space. The kiteworks vhost traffic on the new node came from 8 of these runners, about 40 requests each — the regular Kiteworks crawlers stayed away. From 23:46 UTC on 10-09 to 03:12 UTC on 10-10 they collected credentials: 22 of the window's 33 collector addresses were l9scan runners. Repeat visitors: 68.183.9.16 (three passes and 6 credentials in 6 days), 157.230.19.140 (3 sensors), 159.89.12.166, 167.99.182.39, 64.226.65.160.
  • What they did: the usual march — tarpit, WebLogic console, Confluence, then the Jira file path with the deeper 5-level ..::..::..::..::..::META-INF climb (11 requests from 10 addresses, all on lauterbourg), WHM/cPanel paths, docker-registry enumeration (which caused ai-devbox-1's manifest and tags spikes), graphql checks, and one /.env credential per address. A separate address, 45.138.12.51, ran two more LeakIX tools (l9explore/1.2.2 with 87 events and l9tcpid/v1.1.0 with 1) on frantech-ts at 03:11 UTC and sponge-01-ts at 13:07 UTC.
  • What it means: same tooling, new addresses, and a stage change tested on one node before any wider release. None of their credentials reached AWS in this window.

CONFIG-SWEEP — a one-minute config burst disguised as Googlebot

  • Who: 87.120.104.29 (Sino Worldwide, Norway), ru-edge-1 only. It now holds 12 credentials over 6 days, none used.
  • What they did: 1,650 requests across 1,642 paths and 140 trap families in about one minute at 10:12 UTC on 10-09, under a fake Googlebot/2.1 name. It hit env-production decoys 187 times, 12 SSH private-key paths (28 events), webshell probes 39 times — and collected 6 /.env credentials between 10:12:40 and 10:12:50 UTC.
  • What it means: the burst size swings wildly (150, then 300, then 1,650, then 1,650 over four windows) but the credential collection now works — the last burst lost its attempts to rate limiting, this one got paid.

GIT-VAULT — synchronized git-file walks

  • Who: three DigitalOcean addresses working to the same pattern: 178.128.169.110 (ai-devbox-1, 08:21 UTC), 144.126.227.243 (ai-devbox-1, 19:19 UTC), 104.248.163.59 (control-1, 01:55 UTC on 10-10).
  • What they did: each ran the same 144-request, 142-path, one-minute walk through fake git internals — 143 fake-git results plus 1 gitignore — using a stale Firefox/78 disguise. They caused ai-devbox-1's fake-git spike (299 events) and control-1's (191). They took nothing.
  • What it means: this walk shape has now appeared from three different hosting providers (3xK Tech, a Slovenian block, and now DigitalOcean) — it circulates as off-the-shelf tooling. A separate address, 45.148.10.5, produced 20 fake-git errors on ai-devbox-1; that block stayed quiet since №13, so watch it.

BUCKLOG-KIT — the Bucklog group's census arm

  • Who: three addresses from the same French /24 on two sensors. 185.177.72.100 (new) on control-1 from 22:57 to 23:17 UTC on 10-09; 185.177.72.38 on control-1 at 09:25–09:30 UTC (fourth window in a row, 188 events); 185.177.72.205 on the Kiteworks node at 10:07–10:12 UTC on 10-10, plus one /.env credential on control-1 at 23:47 UTC using curl/8.7.1.
  • What they did: the new address ran control-1's largest census of this campaign — 1,008 paths and 102 trap families, GET-only. It spent a lot of time in the tarpit (204 tarpit events plus 204 disconnect records), hit env-production 46 times, walked fake-git 37 times, and pulled backup-archive files 17 times. It owns all 10 first-seen paths listed above.
  • What it means: the group keeps rotating addresses inside its block and its wordlist keeps growing — the mail/billing/monitoring config paths (mailgun, brevo, sparkpost, xai) and backup archives are new ground for this kit. Their only observed AWS use ever remains №44's single session.

MEGA-DICTIONARY — the shared malware-URL dictionary

  • Who: 193.32.248.142 (31173 Services AB, Germany — a new host class for this campaign) against frantech-ts, 05:21–05:22 UTC on 10-10.
  • What they did: 13,490 requests for 13,489 different paths in about 2 minutes, all GETs, using more than 200 router and gadget names (Linksys, TP-LINK, Xiaomi, MikroTik, Synology, ZTE, Roku, game consoles, smart displays). The wordlist grew by 11 paths against yesterday's replay and dropped none — the growth streak is now nine replays long. The list also carried one request each for other groups' paths (a Bucklog marker, an Ollama marker, a profiler path, an Exchange path).
  • What it means: one shared artifact keeps passing between operator groups, and it keeps getting bigger. The fake server absorbed all 13,490 requests at no cost.

WP-FORM-BRUTE — distributed WordPress login guessing

  • Who: a new pattern, signature 75df0dbb0841: 12 home-internet addresses — 196.189.57.251, 177.244.108.43, 189.121.202.231, 45.190.174.67, 49.207.132.38, 120.28.68.59, 5.30.96.90 (ai-devbox-1); 184.145.82.135, 181.20.147.123, 196.188.229.243, 191.118.42.128, 157.15.228.19 (canary-farm-1). Last cycle's big classes stayed home.
  • What they did: each address sent exactly 3 login guesses (36 total, always as user admin) with a tiny password list — Admin, admin@123, Admin@123, pass, demo, droidx1!, Bot@123456, sso@123, admin1! — spread across the whole day. For the first time, each address pointed its redirect_to at the decoy site name of the node it hit.
  • What it means: a slower, smarter-looking generation: many addresses, few guesses each, tailored to each decoy. The pattern matters more than the addresses.

GOWEB-PENTEST — a tool that announces itself (new campaign)

  • Who: a different address each window: 158.178.159.133 (Oracle, Netherlands) last cycle on frantech-ts; 167.86.124.4 (Contabo, France) this cycle on ai-devbox-1 at 17:57 UTC.
  • What they did: both times the requests honestly named themselves Go Web Pentest Tool, and both times they hammered phpMyAdmin login surfaces about 181 times — last cycle as POSTs to one path in 26 seconds, this cycle as GETs across 3 paths in one minute.
  • What it means: two addresses, two providers, same self-labeled tool, same volume — that is a promoted campaign now, most likely one tool used by more than one operator.

CREDENTIAL-DRAIN — the steal-then-use pipeline

  • Who: 33 collector addresses on the mint side (biggest: 34.124.231.201 with 40, 80.94.92.65 with 6, 87.120.104.29 with 6, 45.148.10.171 with 2). Nobody on the use side.
  • What they did: collected credentials at /.env; no AWS calls happened.
  • What it means: two zero-use windows in a row. The hoards keep standing: 45.148.10.171 has 40 credentials in 6 days (its fifteenth window in a row, now using Lynx and old Nokia phone disguises), 80.94.92.65 has 27 in 6 days across 4 sensors (its partner 80.94.95.211 stayed away a second window), 34.124.231.201 starts at 40, 87.120.104.29 holds 12. Stolen credentials stay dangerous until they expire.

Others worth watching (no campaign name yet)

  • 172.104.241.92 (Akamai, Germany): third window on the Kiteworks node — 219 requests, 183 paths, 28 trap families in one minute, including Kiteworks, ColdFusion, Citrix, and Geoserver paths, under a fake Android phone identity.
  • 172.105.76.7 (Akamai, Germany): third window on the same node — 125 requests, 19 families, 4 POSTs including /mcp_message, two FortiGate device-auth calls, and a Citrix SAML login attempt.
  • 104.251.180.112 (Go-http-client): 3 sensors, 151 requests, took 1 credential on ai-devbox-1 at 01:21 UTC — first-time collector.
  • 187.153.106.106 (Telmex, Mexico, home internet): 4 sensors, 119 requests, most of ai-devbox-1's method-not-allowed spike.
  • 173.239.214.15/.16/.9/.19 and 185.198.240.155/.157: a small cluster on ai-devbox-1 and ru-edge-1 around 19:43–19:46 UTC — phpMyAdmin checks plus one credential each on two of them.
  • 45.148.10.5: 20 fake-git errors on ai-devbox-1 — first activity from that neighbor address in a long time.

Who stayed home

NIGHTAGENT (second window out since its return), EMPERORS-KIT (second out; its 6 credentials still unused), KEYHUNT (second out; 8 unused), SI-CENSUS (third idle; 27 unused), ENVRC-SWEEP, OMEGA-SWEEP (seventh miss, though pool address 94.154.43.158 took 1), MEVSPACE-GITWALK, XMLRPC-BRUTE, SONICWALL-VPN-PROBE, LLM-ENDPOINT-PROBE, the dedicated Kiteworks crawlers (their traffic this window came from REGISTRY-HUNT instead), the network-layer LeakIX SSH scanner, SS-Net's main address 80.94.95.211 (second miss while its partner minted), the Feo Prest pair (no window mints; their №45 use still stands), the favicon enumerator 141.255.162.236 (out after two growing windows), and the Bochum university crawler (second quiet window).

Standing actors (who keeps coming back)

  • 45.148.10.171 — fifteenth window in a row taking credentials; 40 held in 6 days; still zero AWS use.
  • 87.120.104.29 — fifth window in a row; now holds 12 credentials.
  • The Bucklog block — .38 for a fourth window; .205 and new .100 this window.
  • 204.76.203.18 — still replaying its malware dictionary against control-1 all window long (1,871 requests, 566 paths).
  • The REGISTRY-HUNT repeat minters — 68.183.9.16, 157.230.19.140, 159.89.12.166, 167.99.182.39, 64.226.65.160, each seen in 2 or more windows.
  • Background pools — the /-handshake pool (87 addresses, 605 events), the php-cgi probe cluster (11 addresses, 539 events), and a tarpit pool (10 addresses, 350 events) all returned as usual.

Network sweeps (Arkime) — what hit the fleet from the network layer

The trap servers only see web requests. Port-22 sweeps that read only the SSH banner never touch them, so the fleet watches that traffic with its own pcap sensors (Arkime), grouping it by the client's SSH fingerprint — the fingerprint stays the same while the addresses rotate. This window: 119,961 inbound sessions against the fleet's 8 public addresses.

  • GO-SSH-SWEEP (0a07365cc01f…, banner ssh-2.0-go): 24,292 sessions from 84 addresses in 29 networks and 16 countries — it gave back most of yesterday's record (34,343) and spread out again (70 → 84 addresses). Its busiest addresses were again the 109.160.32.x group and 77.239.124.145, and the frantech honeypot saw the same group run its hardware survey this window (ssh/telnet section below) — sweep, shells, and inventory are one operation.
  • LIBSSH-MASSSWEEP (f555226df196…, banner ssh-2.0-libssh_0.9.6): day 22, 5,952 sessions from 320 addresses across 157 networks in 54 countries. Both sweeps were flagged as dispersed (one port, many networks, no login attempts).
  • control-1 under pressure: the fresh-IP baseline took 29,747 inbound sessions from 269 addresses. Its top fingerprint 4e066189c3bb… stayed below the naming threshold at 14 addresses but pushed its session count to about 13,000 (+5,434 in a day, roughly 928 sessions per address) — fourteenth window without a name.
  • Others: 16443846184e… pulled back to 10,533 sessions from 26 addresses (twelfth unnamed window); 03a80b21afa8… grew to 40 addresses and 807 sessions; 084386fa7ae5… shrank from 69 to 49 addresses; 19532158b559… logged a third growth window (3,165 sessions). No new fingerprints today. A known bookkeeping quirk persists: some Arkime sensor tags mirror other nodes' counts (the pcap pipeline is read-only, so we record it, not fix it).

Canaries (minted and used) — what the stolen credentials did

No canary credentials were used in AWS this window. The fleet minted 84 credentials for 33 collector addresses; none reached AWS, and no AWS call succeeded.

How the fleet behaved (Fleet Observations) — what the numbers say

  • Credential factory: the raw logs show 99 mint events — canary-farm-1 60 (16 addresses), ai-devbox-1 19 (16), ru-edge-1 14 (9), control-1 6 (6) — which dedupe to 84 credentials for 33 collectors. Failed mint attempts rose to 17 (ai-devbox-1 9, canary-farm-1 7, control-1 1, ru-edge-1 0), all the same known "too fast" rejection from upstream.
  • Nobody lied about where they came from: the header-forgery counters read 3,385 requests with any forwarded-for header, 0 multi-entry chains, 1,815 internal-only cases, and 0 single-entry mismatches — the fifth clean window in a row. Most visitors still address the bare IPs; the three decoy site names carried 1,308, 1,046, and 428 requests.
  • control-1 keeps growing on schedule: day 27 brought 4,416 events from 123 unique addresses — inside its usual 84–157 band for the nineteenth window in a row.
  • Why the big numbers moved: ai-devbox-1 +78% (the 49-address LeakIX wave, the git-walk pair, and the 181-hit phpMyAdmin hammer), control-1 +39% (Bucklog's census plus the dictionary loop), ru-edge-1 +36% (the CONFIG-SWEEP burst), lauterbourg +24% (the deeper-Jira wave, Bucklog, two Akamai scanners), canary-farm-1 +11% (the 21-second credential burst). netcup-ts −80% (393 events) and sponge-01-ts −57% (625) — older census traffic aged out and almost nothing replaced it; both deception nodes ran at the floor.
  • Every spike has an owner: farm's credential spike = the 40-take burst plus the LeakIX wave; ai-devbox-1's phpMyAdmin spike = 167.86.124.4 (181 of 218); its fake-git spike = the git-walk pair (286); its docker-registry and graphql spikes = the LeakIX wave; control's fake-git and tarpit spikes = the git-walk single plus Bucklog.
  • Small things we track: first-seen timestamps still land on the two sync minutes (they show when logs arrived, not when things happened — the 10 new control-1 paths belong to Bucklog's census). ai-devbox-1's rotated log file is still outside the pipeline (ninth window). The report table that missed CONFIG-SWEEP's 6 mints is a formatting bug to fix in the tooling repo.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

One host runs real SSH (port 2222) and telnet (2323) honeypots. This window: 532 addresses sent passwords → 405 got a shell (76%) → 292 typed a command (72% of shell-holders, 55% of all addresses). In raw events: 20,359 password attempts → 4,510 accepted logins → 8,584 commands. Telnet (smart-device botnets): 730 attempts, down from 970.

  • No new commands for the twentieth window in a row (0 of 63 distinct). Two surveys kept running: the GO-SSH group's system-info commands (uname -m | awk '{printf $1}' and uname -s -v -n -r -m, 1,166 events each from 14 addresses — the same group the network sensors flag as the port-22 sweep) and the Techoff group's GPU inventory (uname, lspci, nvidia-smi, uptime, 445 events each from 2 addresses). The most common housekeeping was still SSH key theft preparation: cd ~; chattr -ia .ssh; lockr -ia .ssh (1,158 events, 227 addresses) and the key-replacement chain (1,008 events, 202 addresses).
  • Password guessing re-concentrated: 13,917 different username/password pairs offered, 0 new — and the top pair took 1,106 attempts (345gs5662d34, matching the username), with root/3245gs5662d34 at 838. The fixed-password sprayers that left last window came back.

Open questions

  1. Will the 40 credentials taken by 34.124.231.201 show up in AWS, and will the code-execution kit come back — on the same node, or against ai-devbox-1's AI decoys where its Langflow and Flowise paths belong?
  2. Will the deeper 5-level Jira climb spread from the Kiteworks node to the other LeakIX signatures, and will the 22 collector addresses in this wave use what they took?
  3. Will the three synchronized DigitalOcean git-walkers run again as a set? A second synchronized window pins down another generation of the same tooling.
  4. Why is the unnamed fingerprint 4e066189c3bb… pushing ever more sessions at control-1 from fewer addresses (14 addresses, about 13,000 sessions, fourteenth unnamed window)? We do not know its purpose yet.
  5. Will the Bucklog group's new address return with the same 1,008-path list, and will the Go Web Pentest tool show up from a third address?
  6. Will any of the long-held hoards (45.148.10.171's 40, KEYHUNT's 8, SI-CENSUS's 27, the Feo Prest pair, the new 40) be used beyond a plain identity check? Any real AWS call is a finding.
  7. When will ai-devbox-1's rotated 268 MB log file be folded back into the pipeline so its all-time counts stop running low?
  8. Will the shared malware dictionary keep growing past its 13,489 paths, and when will the report tooling's per-collector table get fixed so it stops dropping rows like CONFIG-SWEEP's 6 mints?

Plain language version of: flux-fleet-intel-briefing-2026-10-10.md