Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №49 — PLAIN LANGUAGE

Period: 2026-10-11 07:32 – 2026-10-12 07:32 UTC (24h, day 47 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-12.md

What happened (plain)

The Oracle-range census crew came back for a second day in a row: five new Oracle-hosted addresses, one per sensor, each running the same 239-path sweep that hunts for .env files and cloud keys, and each pass handed out fake credentials ("canaries") that we can track. Someone then used one of the fake credentials from yesterday's Bucklog census host in a new way: one stolen key was tried from 4 different AWS-side addresses — the first time a single credential has been used from more than one address in this pipeline. The "Go Web Pentest Tool" phpMyAdmin hammer showed up on three more sensors under three new operators, so six different operators have now run the same tool against six different nodes. The shared IoT dropper list ("MEGA-DICTIONARY") replayed for the sixteenth time on frantech-ts and grew by 33 paths to 13,535. On the fleet side: zero mint failures for a second day, the all-time fake-credential counter passed 2,000 (2,042), and the header-forgery checks all stayed clean.

What it means (plain)

  1. The Oracle-range census is a standing operation, not a one-off. Five new Oracle Singapore addresses (146.235.22.78, 161.118.198.110, 134.185.90.18, 152.69.221.133, 140.245.112.148) ran one pass each on five sensors within 10 hours. Every pass was the same 239-event, 239-path, 65-family sweep under the same honest label WebSiphon/next-0.1 — new addresses, same tool. (High confidence — the pacing, wordlist size, and result mix match briefing №48 exactly.)
  2. The people who steal the fake credentials and the people who use them are now separate. 185.177.72.64 minted 2 canaries on control-1 at 23:36 EDT, and one of them ran 5 AWS operations (sts:GetCallerIdentity ×3 succeeded, bedrock:ListFoundationModels ×2 denied) from 4 distinct AWS-side addresses. Every earlier use event came from one address per credential, so the "same address minted and used it" clue no longer works as a rule. (Moderate confidence — Tracebit ties the operations to that credential with high fidelity, but the 4 addresses are only seen on the AWS side.)
  3. The phpMyAdmin hammer is a commodity tool many people rent or copy. Six windows, six operators, six nodes, six hosting networks (Oracle NL → Contabo FR → a same-/16 neighbour → VNG VN → DigitalOcean IN → Link3 BD), one self-labeled UA, about 151–181 login GETs per pass, and zero password POSTs since №46. The fake login pages absorb it for free. (High confidence — the per-pass count and UA are identical in all six runs.)
  4. The IoT dropper list is alive and shared. The sixteenth replay added 33 paths and dropped none (13,502 → 13,535, the eleventh straight growth), with two new multi-architecture dropper families (/bins/android/akuma_* ×19, /pack/agent/nodewatchd-linux-* ×8). Hosting network 31173 Services AB has now run three of the replays. (High confidence — per-replay path comparison.)

Campaigns (who / what / what it means)

ORACLE-SWEEP — cloud-key hunting sweep from Oracle's cloud

  • Who: five fresh Oracle Singapore addresses, one per sensor: 146.235.22.78 (canary-farm-1, 04:53 EDT), 161.118.198.110 (ru-edge-1, 06:10), 134.185.90.18 (netcup-ts, 09:28), 152.69.221.133 (ai-devbox-1, 14:52), 140.245.112.148 (frantech-ts, 14:12). None of them overlap yesterday's five.
  • What they did: the same under-a-minute census on each node — 239 events, 239 paths, 65 result families, honest UA WebSiphon/next-0.1, GET-only. They walked .env variants, config bundles, CI/CD files, cloud-credential stores (like /.aws/credentials and /.oci/*), infrastructure-as-code files, and AI/LLM configs. They took 3 fake credentials: canary-farm-1 04:53:20, ru-edge-1 06:10:25, ai-devbox-1 14:52:33 EDT.
  • What it means: two windows, two address rosters, one tool — this is scheduled work, not a one-time scan. The two sensors without canaries (netcup, frantech) got the full census but had nothing to steal. The 3 taken canaries are now hostile-held until they expire.

CREDENTIAL-DRAIN — stolen fake credentials being used in AWS

  • Who: 29 collector addresses hold this window's 41 credentials. The users: 4 AWS-side addresses behind 185.177.72.64's key, and 1 AWS-side address behind 72.251.220.23's key.
  • What they did: 7 use events across 2 credentials. Four sts:GetCallerIdentity calls succeeded (that call only confirms who the key belongs to). Three calls were denied: bedrock:ListFoundationModels ×2 and s3:ListBuckets ×1 — attempts to list AI models and storage buckets. The .64 credential ran GetCallerIdentity ×3 plus ListFoundationModels ×2 across its 4 egress addresses; 72.251.220.23 (which minted on ai-devbox-1 at 08:43 EDT using curl/8.7.1) drew GetCallerIdentity plus a denied ListBuckets from its one address. Zero mint failures, second clean window in a row.
  • What it means: the deny-all policy held — nothing beyond identity checks succeeded. The 4-address split is new (11 of the 13 earlier use events were same-address), and it points to a handoff between thief and user. Big holders still waiting: 45.148.10.171 (43 credentials in 6 days, seventeenth straight minting window), 34.124.231.201 (40/6d, absent today), 80.94.92.65 (19/6d, minted 4 today).

GOWEB-PENTEST — a shared phpMyAdmin login hammer

  • Who: three new operators in one day: 58.84.1.216 (VNG Corporation, Vietnam) hit sponge-01-ts with 181 GETs on 1 path in 39 seconds (09:50 EDT); 139.59.74.7 (DigitalOcean, India) hit control-1 with 151 GETs on 1 path in 11 seconds (19:32); 27.147.153.210 (Link3 Technologies, Bangladesh) hit canary-farm-1 with 151 GETs on 1 path in 29 seconds (15:32). None are blocklisted.
  • What they did: the same self-labeled UA Go Web Pentest Tool, one phpMyAdmin login path hammered per pass, GET-only, no POSTs, no credential captures.
  • What it means: three new operators and three new nodes in one window settles it — this tool circulates, and the egress is rented per run. Six windows have produced zero captured passwords, so the read stays "probing login pages," not "breaking in."

REGISTRY-HUNT / LeakIX — the long-running leak-scanner wave

  • Who: 12 runner addresses minted 13 canaries in an evening wave (19:57–20:35 EDT) across canary-farm-1 (7), ai-devbox-1 (3), control-1 (2), and ru-edge-1 (2) — all DigitalOcean-hosted. LeakIX's own heavier tool l9explore/1.2.2 at 45.138.12.51 (Tc Datacenter, Lithuania) spread to 5 sensors (440 events) and minted 3 (control 09:02, farm 00:38, aidev 02:50 EDT).
  • What they did: the same 27-step journey (tarpit pause → WebLogic console → Confluence → WHM/cPanel → Docker registry listing), 1 fake credential per address at /.env. Yesterday's self-user 128.199.182.55 came back as a minter.
  • What it means: the wave is smaller but steady, and LeakIX is now a minting class of its own. LeakIX is a public scanning service — we report it separately from criminal actors, per the standing registry note.

MEGA-DICTIONARY — the shared IoT dropper-URL list

  • Who: 185.209.196.172 (31173 Services AB, Germany) on frantech-ts — the third replay run from that hosting network.
  • What they did: 13,535 requests for 13,535 distinct dropper URLs in about a minute (00:48 EDT), GET-only. Compared with yesterday's list: 33 paths added, 0 removed. New: /bins/android/akuma_* across 19 architectures, /pack/agent/nodewatchd-linux-* across 8, /bins/payloads/c.sh and /svc/u.sh, /champ, /miner_setup.sh, /rainii686, /st_x86_64.
  • What it means: the list is maintained and passed between hosting networks; the new paths name live dropper infrastructure. The decoy surface absorbed all 13,535 requests at zero cost.

LIBREDTAIL-KIT — the phpunit exploit kit is back

  • Who: three fresh addresses — 223.123.65.54 (frantech + lauterbourg), 202.155.18.56 (lauterbourg + control), 37.60.225.222 (frantech + ru-edge) — about 98 events and 44 paths each.
  • What they did: the honest libredtail-http UA, then the known chain: phpunit eval-stdin.php probes, PHP-CGI command-injection attempts, and Docker daemon listing; on lauterbourg they also touched the Kiteworks decoy root. No exploit bodies were captured this window, so the dropper stage is unobserved. 0 mints.
  • What it means: an execution-hunting kit resumed after three quiet windows with a fresh address roster. The fake webshells and tarpits held. If the dropper POST comes back, we want the body.

KITEWORKS-CRAWL — fingerprinting the fake Kiteworks server

  • Who: 45.138.12.25 (Tc Datacenter, Lithuania — same block as №43's operator and the l9explore host) on lauterbourg-01-ts, 143 events, 10:14 EDT.
  • What they did: the full crawl — root redirect, fake /login, 23 JavaScript bundle fetches, webshell probes, and a 101-path census.
  • What it means: third window, third operator class, same fingerprinting steps. The Lithuania block now links this campaign's hosting to LeakIX's l9explore tooling — a hosting link, not yet a proven operator link.

AKAMAI-VHOST-SCAN — new campaign, promoted from watch

  • Who: 172.234.162.31 (Akamai Connected Cloud, France) on lauterbourg-01-ts — second window in a row: 231 events, 194 paths, 29 families in about a minute (05:22 EDT). Two Akamai Germany addresses (172.104.241.92, 172.105.76.7) ran the same shape in №46–№47.
  • What they did: Kiteworks root redirect and fake login, then a tour of admin surfaces: Citrix, nmaplowercheck, /cgi-mod/header_logo.cgi, /sdk (one POST of 441 bytes — the body was not captured), a health endpoint, ColdFusion CFIDE, plus single probes for Fortinet, Ivanti, Exchange OWA, Cisco WebVPN, GeoServer, Next.js, OpenAPI, and an ollama version check.
  • What it means: a breadth-first fingerprint sweep of VPN gateways and admin panels, riding the fake TLS server. No credentials taken across the whole class. The unlogged /sdk POST body is the gap to close.

CREDSWEEP — a long-gone census operator returned

  • Who: 45.148.10.238 (Techoff Srv Limited, Netherlands) on netcup-ts — this address's first window in about 25 cycles and its first netcup leg: 617 events, 348 paths in 3 minutes (21:57–22:00 EDT).
  • What they did: the standing .env-variant fanout under an old-browser UA rotation, including the misspelled Mozlila/5.0 (…Bulid…Moblie…) forgery that identifies this family. 4 POSTs to / only (3–15 bytes, eaten by the tarpit, bodies not logged). 0 mints.
  • What it means: the fleet's most persistent census family is back with its typo UA unchanged — that typo is how we know it is the same crew. Family sibling 45.148.10.5 minted its first-ever canary on control at 13:11 EDT.

Watch-class singles (not campaigns yet)

  • 31.56.53.82 (Snowcore Inc, UAE): frantech-ts, 342 events, 325 paths, 12 families over 6.5 hours (07:32–13:58 EDT), Chrome/123. It walked a software-project layout — first-seen paths include /bot/server.js, /frontend/README.md, /server/tsconfig.json, /backend/requirements.txt, /backend/ecosystem.config.js, /src/manage.py, /db/dump.sql, /deploy/Dockerfile, /CODEX.md, and /payment-config, plus 12 OpenAPI skeleton probes and 7 .gitignore checks. 0 mints, 0 POSTs. A second node promotes it.
  • 206.209.210.3 minted in its third straight window (3 canaries: farm ×2, control) and touched 6 nodes — the first collector to ever show that repeat pattern.
  • 94.154.43.74 and .122 (the OMEGA-SWEEP address pool) minted 2 canaries at 18:03 EDT under a forged Chrome/147 — the pool keeps minting singles while the main /46 census stays absent for a ninth window.
  • The TOKEN-CRAWLER pool (45.198.224.124 and .125) touched all 8 sensors again (~85 events each). Background noise per the registry.
  • 204.76.203.18 (Pfcloud, Netherlands) keeps its MALWARE-DICT loop on control-1 (2,122 events, 579 paths); sibling .219 probed all 8 nodes (32 events).
  • Tarpit pools — 3e1c5eb879e7 83 addresses / 579 events on 7 sensors; php-cgi exploit cluster 7e61a9500d8b 14 addresses / 686 events on 6 sensors (includes the LIBREDTAIL runs); 218630667b2c on control + ru-edge.
  • 80.94.92.65 (SS-Net family) minted 4 canaries across farm and aidev, touched 6 nodes, 19 in 6 days; the family's primary address .211 rested a second window.
  • 213.209.159.154 (Feo Prest) ran sponge-01-ts for the first time (326 events, 322 paths, 06:19 EDT); sibling .175 was absent.

Who was absent

GIT-VAULT (the Interserver and DigitalOcean git-walkers; their 12 held canaries stay unused), ATLASSIAN-REST-PROBE (first absence after yesterday's debut), METADATA-HUNT (second runner-less window), CONFIG-SWEEP (second miss), NIGHTAGENT, EMPERORS-KIT, KEYHUNT (fourth absences each), SI-CENSUS (fifth), the OMEGA-SWEEP /46 census (ninth), ENVRC-SWEEP, CF-FRONTED CREDSWEEP (ninth), the dedicated KITEWORKS-CRAWL Google/AWS classes, the LEAKIX-SSH network scanner, SS-Net's 80.94.95.211 (second), and the other Bucklog census hosts.

Who keeps coming back (standing actors)

Network sweeps (Arkime) — SSH banner sweeps that never request a web path

These sweeps hit the fleet's public addresses on port 22 and are identified by their client fingerprint, never by source address. Inbound this window: 117,771 sessions.

  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499, banner ssh-2.0-go): 21,638 sessions (−7,120) from 97 addresses (−23) across 37 networks in 25 countries. Busiest sources stay the 109.160.32.x and 77.239.124.x addresses — and that same /24 ran its uname -m and uname -s -v -n -r -m hardware survey on the frantech shell honeypot again (94 events per command from 7 addresses, example 109.160.32.36). Sweep, shell, and hardware inventory remain one operation. Daily address counts: 10-06 98, 10-07 100, 10-08 66, 10-09 88, 10-10 116, 10-11 90, 10-12 41.
  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6): 5,867 sessions from 311 addresses across 152 networks in 53 countries — day 23 of the same ~310-address plateau. Daily: 10-06 297, 10-07 350, 10-08 309, 10-09 317, 10-10 344, 10-11 303, 10-12 99.
  • 16443846184eafde36765c9bab2f4397 (unnamed): 16,506 sessions (+10,220) from 49 addresses (+21) across 21 networks in 15 countries — the day's biggest mover, now netcup's top fingerprint, 15 days on record, still below the 50-address "dispersed" naming line.
  • 4e066189c3bb… (unnamed concentrator): sixteenth day on control-1, 11,068 sessions (−7,083) from 18 addresses.
  • 98f63c4d9c87… (lauterbourg's top fingerprint): 3,886 sessions from 16 addresses.
  • Smaller singles: 084386fa7ae5… 65 sessions / 44 addresses; e54ef3ec27fe… 128 / 32; acaa53e0a7d7… 28 / 28 across 22 networks; dd9bcf093c35… 28 / 28 from one network; 03a80b21afa8… 367 / 22.
  • Two fingerprints were new to the collection today, both small and single-source: be81bea24ed4… (banner ssh-2.0-openssh_10.0p2 debian-7, 9 sessions) and e1d88fdd485f… (banner ssh-2.0-openssh_8.9p1 ubuntu-3ubuntu0.17, 8 sessions).

Only the two flagged sweeps crossed the dispersed-sweep thresholds (50+ addresses and 20+ networks on one port). Nothing new was named in recon-names.tsv this cycle.

Canaries (minted and used) — fake credentials that page us when used

Sensors minted 47 log rows = 41 real credentials to 29 collector addresses; 2 credentials reached AWS (7 events: 4 GetCallerIdentity successes, 2 denied ListFoundationModels, 1 denied ListBuckets). Zero mint failures, second clean window. All-time mints: 2,042. This was a use window — the second in a row.

Every collector this window, with per-sensor mints and 6-day history:

  • 185.177.72.64 — control-1, 2 mints since 2026-10-11 23:36 — 1 used from 4 AWS addresses (GetCallerIdentity, ListFoundationModels)
  • 72.251.220.23 — ai-devbox-1, 1 mint since 2026-10-11 08:43 — 1 used from 1 address (GetCallerIdentity, ListBuckets)
  • 45.148.10.171 — ai-devbox-1 2, canary-farm-1 1, control-1 1 (43 mints since 2026-10-05 16:36)
  • 80.94.92.65 — ai-devbox-1 2, canary-farm-1 2 (19 mints since 2026-10-05 03:33)
  • 159.89.127.165 — ai-devbox-1, 2 (3 mints since 2026-10-05 20:07)
  • 157.245.113.227 — canary-farm-1 1 + ru-edge-1 1 (4 mints since 2026-10-05 20:27)
  • 45.138.12.51 — ai-devbox-1, canary-farm-1, control-1, 1 each (5 mints since 2026-10-08 00:50)
  • 206.209.210.3 — canary-farm-1 1 + control-1 1 (5 mints since 2026-10-10 08:02)
  • 109.205.176.10 — ru-edge-1, 1 (6 mints since 2026-10-05 21:33)
  • 128.199.182.55 — control-1, 1 (5 mints since 2026-10-08 20:14)
  • 135.136.20.12 — control-1, 1 (first, 2026-10-12 01:34)
  • 139.59.231.238 — ai-devbox-1, 1 (3 mints since 2026-10-07 20:33)
  • 143.110.213.72 — canary-farm-1, 1 (3 mints since 2026-10-07 20:25)
  • 143.244.168.161 — canary-farm-1, 1 (first, 2026-10-11 20:35)
  • 146.190.63.48 — ru-edge-1, 1 (2 mints since 2026-10-07 20:25)
  • 147.182.200.94 — canary-farm-1, 1 (first, 2026-10-11 20:15)
  • 152.69.221.133 — ai-devbox-1, 1 (ORACLE-SWEEP, first, 2026-10-11 14:52)
  • 157.245.204.205 — canary-farm-1, 1 (3 mints since 2026-10-08 18:42)
  • 162.254.24.228 — canary-farm-1, 1 (2 mints since 2026-10-07 16:41)
  • 165.22.34.189 — control-1, 1 (first, 2026-10-11 19:58)
  • 172.93.215.8 — control-1, 1 (4 mints since 2026-10-05 08:29)
  • 206.81.24.227 — ai-devbox-1, 1 (4 mints since 2026-10-05 20:27)
  • 209.38.248.17 — canary-farm-1, 1 (first, 2026-10-11 20:32)
  • 217.60.76.167 — ai-devbox-1, 1 (3 mints since 2026-10-05 07:48)
  • 45.148.10.5 — control-1, 1 (first ever, 2026-10-11 13:11)
  • 74.208.99.178 — ai-devbox-1, 1 (first, 2026-10-11 11:49)
  • 80.87.206.148 — ai-devbox-1, 1 (first, 2026-10-12 05:22)
  • 94.154.43.74 — ai-devbox-1, 1, and 94.154.43.122 — canary-farm-1, 1 (both first, 2026-10-11 18:03)

Who they are: 185.177.72.64 is the Bucklog census host (its family's second mint-then-use, after №44). 72.251.220.23 arrived with curl/8.7.1 and used its own credential the same day. The REGISTRY-HUNT evening wave supplied 13 of the 47 mint rows. Per-sensor mint rows: canary-farm-1 17 (15 addresses), ai-devbox-1 15 (12), control-1 11 (9), ru-edge-1 4 (4). The other 39 credentials were not observed in AWS this window — they stay hostile-held until they expire, and a credential can be used outside our pull window, so "unused" means "not observed."

How the fleet behaved (Fleet Observations) — volume, attribution, and the baseline node

  • Canary economics: 47 mint rows → 41 credentials to 29 collectors; 2 used; 0 mint failures (second straight clean window); all-time 2,042.
  • Attribution: header-forgery counters — requests with any X-Forwarded-For 1,068; multi-entry chains 0; header ignored 2; single-entry mismatch 0. A clean window. The host census stays led by bare-IP requests on all 8 nodes; the fake TLS servers carried lauterbourg kiteworks 696 and canary-farm sso 387 events.
  • Volume shifts with known causes: ai-devbox-1 −39% (1,045) — yesterday's big hammers left. canary-farm-1 −20% (1,644) — thinner ORACLE + REGISTRY load. ru-edge-1 −53% (808), netcup-ts −23% (1,353), sponge-01-ts −16% (1,109) — the old census waves stay gone. control-1 +3% (3,089) — the Pfcloud loop (2,122) offsets a quiet day. frantech-ts +2% (14,687) — this cycle's dictionary replay matches last cycle's. lauterbourg-01-ts +15% (1,678) — Akamai scanner, Kiteworks crawler, and libredtail legs.
  • Every big result-tag spike got a named cause: the phpMyAdmin spikes on canary-farm-1 (152 events, 8.9×), control-1 (152, 13.2×), and sponge-01-ts (182, 39.0×) are all GOWEB-PENTEST, plus 1 phpMyAdmin GET per sensor from l9explore's 45.138.12.51 and 3 from 31.56.53.82. Nothing is unexplained.
  • control-1 discovery ramp: day 29 brought 3,089 events from 115 unique addresses — inside the 84–157 band for the twenty-first straight window.
  • Digest quirks: the fleet-24h burst histogram is labeled hour_utc but its buckets hold local −04 times (the 00:48 EDT dictionary burst lands in the 10-12 00:00 bucket) — read those hours as local until the ops repo fixes the label. The +4-hour ingest overlap means late-window actors can appear in two digests; everything counted new here was checked against №48. First-seen timestamps cluster at the 03:15/03:16 sync minutes, so they are an inventory, not a timeline. The ai-devbox-1 rotated-file gap is in its eleventh cycle.
  • Fleet-side changes: the visuals dashboard gained the AKAMAI-VHOST-SCAN chain and refreshed eight campaign notes and 23 talker labels; no new network-layer names.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

One host runs real SSH (port 2222) and telnet (port 2323) honeypots next to the web decoys. Funnel: 554 addresses tried passwords → 415 got a shell (75%) → 324 ran a command (78% of shell-getters). By events: 17,657 password attempts → 3,011 accepted logins → 3,545 commands. Telnet: 1,216 attempts, up from 866.

  • No new commands for the twenty-second straight window (0 of 92 distinct). The usual suspects repeat: the .ssh re-plant pair (cd ~; chattr -ia .ssh; lockr -ia .ssh, 1,128 events from 246 addresses; the key-replace chain, 1,004 from 230), the SS-Net uname loops (80.94.92.55, 293 + 292), the Techoff survey (62.171.133.1, 101 + 101), and the GO-SSH /24 hardware survey (uname -m | awk '{printf $1}' and uname -s -v -n -r -m, 94 events each from 7 addresses, example 109.160.32.36). New commands are the only window into what attackers do after a shell — none appeared.
  • Passwords: 11,296 distinct pairs offered, 0 new. Concentration, not variety: 345gs5662d34/345gs5662d34 at 1,074 attempts and root/3245gs5662d34 at 818 — the same sprayers for a fourth window.

Open questions

  1. Who is behind the 4 AWS-side addresses that used the Bucklog-minted credential, and will that key draw more operations — or a console login — before it expires?
  2. Will ORACLE-SWEEP run a third window on schedule, with which address roster, and will any of its 6 held canaries reach AWS?
  3. What is the unnamed 16443846184e… SSH sweeper on netcup (16,506 sessions, 49 addresses)? It gets a name if it crosses the 50-address dispersed line — and its client banner would settle how it relates to GO-BANNER-SWEEP.
  4. Will the AKAMAI-VHOST-SCAN class leave lauterbourg, and can we capture the body of that 441-byte /sdk POST next time?
  5. Is 31.56.53.82's software-project census a one-off, or the start of a new standing actor?
  6. When will a GOWEB-PENTEST operator finally send a password POST, so we can see what the tool submits?
  7. When will the ai-devbox-1 rotated history file (268 MB) be ingested, or rotation moved behind the sync boundary, to close the eleventh-cycle gap?
  8. When does the 22-window drought of new shell commands end? New commands remain the only tripwire for post-compromise behavior on the honeypot host.

Plain language version of: flux-fleet-intel-briefing-2026-10-12.md