Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №62 — PLAIN LANGUAGE

Period: 2026-10-24 07:33 – 2026-10-25 07:33 UTC (24h, day 60 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-25.md

What happened (plain)

Someone took two stolen canary keys into Amazon Web Services and tried hard to use them. The keys ran 672 actions in AWS. AWS blocked 660 of them, including 390 tries to read secret parameters and 4 tries to launch new cloud servers. Nothing beyond an identity check succeeded. A new scanner called AI-CLI-VAULT checked, in one day, whether eight kinds of AI coding tools had left credentials on every one of our eight honeypot servers. It copied nothing. The IoT virus-delivery dictionary called MEGA-DICTIONARY attacked two of our servers it had never touched before, from two fresh hosts, with an identical 13,776-address list. And a WordPress password attacker fired 1,000 requests in 15 seconds at the rebuilt lauterbourg server, the third attack kit that server has drawn in about 29 hours. The fleet itself had a clean minting day: 100 canary keys issued, 44 reached collectors, zero errors.

What it means (plain)

  1. The attacker moved from "who am I?" to "what can I build here?" Earlier break-ins mostly asked AWS who the key belongs to. This one read secret-parameter listings 390 times, described 130 images and 130 networks, and tried to launch servers 4 times. All launches were denied. (High confidence on the events — these are Tracebit alert outcomes; Moderate on intent — blocked actions do not tell us the attacker's plan.)
  2. The new scanner treats AI coding tools as a place to steal from. 919 of its 1,067 checks on each canary sensor asked for files that belong to tools like Kimi Code, Grok, Muse, Goose, HuggingFace, Fabric, Codeium, Claude, Gemini, and Continue. Those paths had never been seen on the fleet before. It only checked; it took nothing yet. (High confidence on the events — spot queries matched every path; Moderate on follow-through — this is its first appearance.)
  3. The big virus dictionary changed targets, not content. A path-by-path comparison against the previous host's list kept 13,776 of 13,776 paths and found 0 new ones. In 21 known runs it had only ever hit frantech-ts. Now it hit control-1 and ru-edge-1 from two different hosts in the same day. (High confidence — full-list comparison.)
  4. The rebuilt lauterbourg server draws about one attack kit per day. The xmlrpc flood at 13:23 on 10-24 follows the Bucklog remote-code kit at 13:53 on 10-23 and the AndroxGh0st upload battery at 18:26 on 10-24. Old target lists still point at this server. (Moderate confidence — three events show a rate, not a schedule.)

Campaigns (who / what / what it means)

MEGA-DICTIONARY — a shared list of 13,776 virus-download addresses, replayed by whichever host holds it

  • Who: 103.125.233.17 (xTom, Hong Kong) hit control-1 at 09:18:30–09:22:03 stored time, taking 3.5 minutes. 169.150.211.193 (Datacamp, Germany) hit ru-edge-1 at 11:04:54–11:05:52, taking 58 seconds. Neither host had run it before, and no earlier run left frantech-ts.
  • What they did: they fetched the same 13,776 paths, byte for byte, using fake router user-agents — 209 different ones on the control leg (names like "Comfast CF-WR625AC AC1200", "Linksys EA7500 AC1900", "ZTE F670L GPON ONT", "D-Link DIR-820L Cloud Router"). Our decoys answered "not handled" 13,772 of 13,777 times on control and 13,771 of 13,776 on ru-edge. The list carries 5 stray one-off paths from other campaigns, as it has since run №47. No passwords were captured, and nothing was downloaded to them.
  • What it means: someone is testing whether the dictionary works against our newer, quieter servers. Watch for a third host, a third node, or any sign of real downloads.

AI-CLI-VAULT — a first-time scanner mapping where AI coding tools keep their keys

  • Who: 195.182.16.183 (Amarutu Technology Ltd, Germany), seen for the first time ever. A lighter prober from the same network block, 195.182.16.23, made its usual round at the same time.
  • What they did: in one window (07:07–10:13 stored time) it checked all 8 sensors. On each canary sensor it ran a 1,067-path list with 42 families (1,720 events on ai-devbox-1, control-1, and ru-edge-1; 1,501 on canary-farm-1). On each of the 4 deception-only nodes it ran a shorter 162-path list. 919 of the 1,067 paths ask for AI-tool key files: /root/.kimi-code/credentials/kimi-code.json and config.toml, /proc/self/cwd/.grok/auth.json, .muse-code/credentials.json, .config/goose/config.yaml, .cache/huggingface/token, .config/fabric/.env, .codeium/windsurf/mcp_config.json, plus the claude-settings, gemini-oauth-creds, continue-config, gh-hosts-yml, and huggingface-token families (28 events each per sensor). It also checked developer files: shell histories, SSH keys, Docker config, git credentials, .npmrc, .kube/config, and a web app folder. It used a plain Go downloader plus a fake Firefox/146 identity. It only sent GET requests: 0 captures, 0 uploads. Its /root/docker-compose.yml checks caused the docker-compose spikes on 4 sensors (4.5× to 6.5×).
  • What it means: someone is drawing a map of where AI-tool keys live, probably to come back and take them. Every decoy held. One captured key, one AWS use, or a second operator IP turns this into a top-priority hunt.

CREDENTIAL-DRAIN — stolen canary keys being worked inside AWS

  • Who: mint side: our sensors handed 44 keys to 27 collector IPs this window (100 issued rows: canary-farm-1 62, ai-devbox-1 17, control-1 13, ru-edge-1 8). Use side: one IP, 95.111.225.106, used 2 keys for 672 events.
  • What they did: 660 actions were denied and 12 succeeded. Denied: read secret parameters 390 times (ssm:GetParameter), describe images 130, describe networks 130, list regions 4, and — the new part — try to launch servers 4 times (ec2:RunInstances). Succeeded: 12 identity checks (sts:GetCallerIdentity). The same IP had picked up 1 key from canary-farm-1 at 07:37 on 10-24, so mint and use happened inside one window. Where the second used key came from is not in the pull.
  • What it means: this actor moved past "is the key valid?" into mapping the account and trying to rent capacity. AWS blocked the launches. Fast mint-to-use inside one window matches runs №20 and №36.

XMLRPC-BRUTE — the seventh operator of a WordPress password flood

  • Who: 194.26.192.113 (1337 Services GmbH, Netherlands — the same network as the AndroxGh0st kit's lead IP) hit lauterbourg-01-ts at 13:23:57–13:24:12 stored time.
  • What they did: preflight checks (wp-wlwmanifest, wp-user-enum-rest-list), then 1,000 POSTs to /xmlrpc.php in 15 seconds. Bodies were 400 bytes calling wp.getUsersBlogs with a username starting admi (the capture cuts off there), under a fake Chrome/78 identity, plus 4 touches of the php2shell-root decoy. 0 captures.
  • What it means: same single-account dictionary shape as run №35, at about 6× the speed, against the fresh node's fake WordPress. Third kit on that node in about 29 stored-digit hours.

REGISTRY-HUNT / LeakIX — the recurring cloud-server census, still minting

  • Who: the same 25-family walk (tarpit, then WebLogic, Confluence, WHM/cPanel, Docker registry checks) ran across 7 sensors from DigitalOcean runners: 138.68.82.23, 139.59.132.8, 164.92.107.174, 167.99.181.249, 206.189.19.19, 206.81.24.227, 147.182.149.75, 157.245.113.227.
  • What they did: the unchanged walk under the two usual l9scan identities. About 12 of the window's 44 canary keys went to DigitalOcean addresses.
  • What it means: the crew keeps collecting keys runner by runner. AWS activity after the window closes is still the thing we are waiting to catch.

Smaller watchers worth naming

  • 130.12.180.117 (Omegatech, Netherlands) — second window in a row: 279 events on lauterbourg-01-ts at 03:39–03:48 stored (868 all-time, 0 captures). The two minting IPs from that block did not come back.
  • 45.148.10.238 (CREDSWEEP's main operator) — 909 events / 392 paths / 8 POSTs on netcup-ts at 19:51–19:57. Not new: that netcup leg has run 3,964 events since 10-11.
  • 185.158.148.234 — 151 phpMyAdmin login POSTs on one path in 0.9 seconds — the whole lauterbourg spike (17.2×). No owner identified yet.
  • A new slow WordPress crowd on control-1 — 32 password tries + 33 probes from at least 5 IPs (187.237.178.130 11+11, 103.47.145.26 9+9, 49.235.161.59 5+5, 103.47.145.27 4+4, 120.48.142.55 3+3) spread over 00:07–06:10. Our alarm level stays at 200 pairs.
  • 45.138.12.35 (Tc Datacenter, Lithuania) — second window, now on two nodes: 384 events on ru-edge-1 at 03:46 (all 264 of ru-edge's fake-git-miss spike) and 384 on canary-farm-1 at 16:47. It looks for real git data our decoys do not serve.
  • New key collectors — 193.32.162.164 (1+1 on ai-devbox-1 and ru-edge-1; same /24 as a frantech honeypot actor), 217.60.76.167 (2+2, the LIBREDTAIL staging /16), 169.150.196.6 (3+3, Datacamp), 74.0.42.54 (2+2), 146.70.98.138 (1+1), 91.92.41.32 (2 on control-1), 140.245.97.208 (4 across 3 sensors), and one each for 80.87.206.148, 207.154.212.47, 68.183.9.16, 142.93.129.190.
  • A KrebsOnSecurity user-agent (94.154.43.12) — 1 event on each of 6 sensors: the known OMEGA-SWEEP probe pool wearing a joke name. Not a new actor.

Standing actors (who keeps coming back)

  • 213.209.159.154 (Feo Prest, Germany) minted keys in every recent window: 2+2 this window, 18 in 6 days, plus 340 events on sponge-01-ts. Its sibling 213.209.159.175 (34 keys in 6 days) was absent — its first miss.
  • 45.148.10.238 keeps its netcup-ts leg running (see above).
  • 195.182.16.23 (Amarutu) keeps its light daily round on all 8 sensors.
  • The 94.154.43.x probe pool (OMEGA-SWEEP) touched nodes with single events, including the KrebsOnSecurity identity.
  • Censys 71.6.155.70, 89.248.172.33, and 195.182.16.23 ran their usual honest scans.
  • The Bochum research crawler missed its second window in a row, which is why netcup-ts (−63%) and sponge-01-ts (−69%) sit below normal.

Quiet: AI-EXEC-HUNT (its 649-event line in the digest is a repeat of the previous briefing's tail, not a new burst), Bucklog, AndroxGh0st, 213.209.159.175, ADMINER-SWARM, CENSUS-284, CONFIGBUNDLE-KIT, CLAUDE-CRED-HUNT, METADATA-HUNT's named runners, OMEGA-SWEEP's census operators, NightAgent, MALWARE-DICT, EXCHANGE-DICT, JNDI-FIELD-INJECT, WEBSIPHON, KEYDROP-SCANS, and the GO-SPRAY-SWEEP network crew.

Network sweeps (Arkime) — password prompts nobody typed: banner reads on port 22

These attackers never ask for a web page, so the web traps never see them. Arkime watches the connection itself and groups it by the client's fingerprint — the tool, not the address, because addresses rotate.

  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6): 3,486 sessions from 611 source IPs in 268 networks across 69 countries. The pool grew by 104 IPs and 28 networks in a day while sessions fell by 622 — more addresses, fewer connections each. Day history: 418 IPs on 10-19, 402, 327, 314, 443, 617 on 10-24, 244 on 10-25.
  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499, banner ssh-2.0-go): 33,642 sessions from 61 IPs in 21 networks, 17 countries — up 12,753 sessions, and it crossed the "dispersed sweep" line again. Its busiest addresses, 109.160.32.x, are the same network that runs the uname hardware survey on the frantech honeypot (1,853 events each from 3 IPs) — the scanning and the break-in tooling are one operation. Day history: 71 IPs on 10-19 down to 34 on 10-25.
  • LIBSSH-011-SWEEP (03a80b21afa810682a776a7d42e5e6fb, banner ssh-2.0-libssh_0.11.1) — named this week: 265 sessions from 50 IPs in 34 networks, 17 countries, on day 15 of its record, its first time over the sweep line. Day history: 23–42 IPs over the past week, 20 on 10-25.
  • GO-SCATTER-SWEEP (16443846184eafde36765c9bab2f4397): 21,788 sessions from 37 IPs in 21 networks — still counted as single-source shaped.
  • Smaller single-source groups: dd9bcf093c35… (28 sessions / 27 IPs / 1 network), 084386fa7ae5… (31 / 26 / 6), e54ef3ec27fe… (25 / 20 / 10), 2ec37a7cc8da… (1,644 / 18 / 3).
  • GO-SPRAY-SWEEP did not appear. No new fingerprints showed up. An unflagged heavy, 4e066189c3bb…, kept control-1's top spot (24,378 sessions from 11 IPs, under the spread line). The contabo-sponge-02-ts/proxy labeling glitch continues (23,203 sessions) — it needs an ops fix, open since briefing №59.

Canaries (minted and used) — fake keys: who picked them up and who used them

The summary: our sensors minted 44 canary credentials to 27 collector IPs (100 issued rows). 2 keys reached AWS and produced 672 events: 660 blocked, 12 identity-only successes. No key minting failed anywhere.

Who picked up keys this window (theft IP — sensor — keys — used in AWS):

  • 169.150.196.6 — ai-devbox-1 — 3 — none (6 mints since 10-25 03:05)
  • 169.150.196.6 — canary-farm-1 — 3 — none (6 since 10-25 03:05)
  • 140.245.97.208 — canary-farm-1 — 2 — none (7 since 10-20 23:51)
  • 213.209.159.154 — canary-farm-1 — 2 — none (18 since 10-19 06:24)
  • 213.209.159.154 — control-1 — 2 — none (18 since 10-19 06:24)
  • 91.92.41.32 — control-1 — 2 — none (2 since 10-24 14:15)
  • 138.68.144.227 — canary-farm-1 — 1 — none (4 since 10-18 20:21)
  • 138.68.82.23 — canary-farm-1 — 1 — none (2 since 10-20 20:09)
  • 139.59.132.8 — canary-farm-1 — 1 — none (1 since 10-24 20:52)
  • 140.245.97.208 — ai-devbox-1 — 1 — none (7 since 10-20 23:51)
  • 140.245.97.208 — ru-edge-1 — 1 — none (7 since 10-20 23:51)
  • 142.93.129.190 — canary-farm-1 — 1 — none (2 since 10-20 20:31)
  • 146.70.98.138 — ai-devbox-1 — 1 — none (2 since 10-24 20:46)
  • 146.70.98.138 — control-1 — 1 — none (2 since 10-24 20:46)
  • 157.230.19.140 — ai-devbox-1 — 1 — none (2 since 10-19 20:25)
  • 157.245.113.227 — canary-farm-1 — 1 — none (4 since 10-20 20:04)
  • 157.245.113.227 — ru-edge-1 — 1 — none (4 since 10-20 20:04)
  • 164.92.107.174 — ru-edge-1 — 1 — none (1 since 10-24 20:08)
  • 165.227.102.187 — control-1 — 1 — none (5 since 10-21 16:37)
  • 167.99.181.249 — ai-devbox-1 — 1 — none (1 since 10-24 20:54)
  • 193.32.162.164 — ai-devbox-1 — 1 — none (2 since 10-24 09:12)
  • 193.32.162.164 — ru-edge-1 — 1 — none (2 since 10-24 09:12)
  • 206.189.19.19 — control-1 — 1 — none (2 since 10-22 19:02)
  • 206.81.24.227 — canary-farm-1 — 1 — none (4 since 10-18 20:01)
  • 207.154.212.47 — control-1 — 1 — none (1 since 10-24 20:03)
  • 217.60.76.167 — ai-devbox-1 — 1 — none (2 since 10-24 07:47)
  • 217.60.76.167 — control-1 — 1 — none (2 since 10-24 07:47)
  • 45.138.12.51 — control-1 — 1 — none (6 since 10-18 13:12)
  • 45.148.10.5 — canary-farm-1 — 1 — none (3 since 10-22 00:28)
  • 64.227.70.2 — ai-devbox-1 — 1 — none (3 since 10-18 20:10)
  • 68.183.9.16 — ai-devbox-1 — 1 — none (2 since 10-20 20:39)
  • 74.0.42.54 — ai-devbox-1 — 1 — none (2 since 10-24 12:01)
  • 74.0.42.54 — ru-edge-1 — 1 — none (2 since 10-24 12:01)
  • 80.87.206.148 — canary-farm-1 — 1 — none (1 since 10-24 16:10)
  • 93.152.209.6 — canary-farm-1 — 1 — none (3 since 10-22 02:01)
  • 95.111.225.106 — canary-farm-1 — 1 — 2 used from 1 use IP (DescribeImages, DescribeRegions, DescribeVpcs, GetCallerIdentity, GetParameter, ListRegions, RunInstances; 1 mint since 10-24 07:37)

Hoarders with no AWS use seen yet (keys they hold, with dates): 136.66.182.42 — 41 (10-24 05:03 to 05:03); 34.58.160.181 — 41 (10-19 16:03 to 16:03); 213.209.159.175 — 34 (10-18 08:41 to 10-23 15:04); 45.148.10.171 — 19 (10-18 06:25 to 10-22 00:53); 213.209.159.154 — 18 (10-19 06:24 to 10-25 02:52); 37.60.226.187 — 17 (10-20 02:15 to 10-21 21:45); 143.244.165.105 — 9 (10-21 18:02 to 10-23 21:39); 80.94.92.126 — 8 (10-19 11:21 to 10-20 10:36); 140.245.97.208 — 7 (10-20 23:51 to 10-24 16:12); 169.150.196.6 — 6 (10-25 03:05 to 03:29); 195.178.110.22 — 6 (10-24 06:41 to 06:53); 217.60.198.111 — 6 (10-21 03:45 to 03:54); 45.138.12.51 — 6 (10-18 13:12 to 10-24 18:42); 80.94.92.65 — 6 (10-19 06:23 to 10-21 09:39); 165.227.102.187 — 5 (10-21 16:37 to 10-25 04:14); 138.68.144.227 — 4 (10-18 20:21 to 10-24 20:54); 157.245.113.227 — 4 (10-20 20:04 to 10-24 20:05); 159.26.101.138 — 4 (10-23 16:04 to 16:21); 185.177.72.64 — 4 (10-20 01:57 to 08:44); 206.81.24.227 — 4 (10-18 20:01 to 10-24 20:54); 206.81.24.74 — 4 (10-20 20:43 to 10-23 21:05); 23.234.78.109 — 4 (10-20 05:35 to 14:00); 45.148.10.125 — 4 (10-23 01:44 to 04:39); 104.251.180.112 — 3 (10-18 16:27 to 10-21 12:15); 150.228.105.248 — 3 (10-20 17:58 to 18:02); 157.245.36.108 — 3 (10-18 19:57 to 10-23 21:05); 185.177.72.17 — 3 (10-18 22:42 to 22:42); 185.177.72.9 — 3 (10-23 13:14 to 13:14); 45.148.10.5 — 3 (10-22 00:28 to 10-25 02:19); 64.227.70.2 — 3 (10-18 20:10 to 10-24 20:54); 64.89.163.14 — 3 (10-21 08:34 to 10:53); 72.167.41.202 — 3 (10-21 17:47 to 18:25); 93.152.209.6 — 3 (10-22 02:01 to 10-24 19:57); 93.152.221.96 — 3 (10-21 23:57 to 10-22 04:22).

One open question stays open: where the second used key came from. The pull lists 95.111.225.106 as both a key collector (1 farm key at 07:37 on 10-24) and the only AWS user, but it does not show the mint row for the second key. We say "unresolved", not "not stolen".

How the fleet behaved (Fleet Observations) — the traps worked and nothing broke

  • Key minting was perfect. 100 issued rows, 44 keys to 27 collectors, zero failures of any kind. All keys were AWS-type. The all-time counter reached 2,980 issued rows. lauterbourg-01-ts minted 0 because it carries no key by design.
  • One header lie, four times. 4 requests claimed in X-Forwarded-For to be 1.2.3.4 (a reserved example address) while the connection came from 162.243.83.227 (DigitalOcean): 2 on control-1 at 22:20:29 on 10-24 and 2 on ai-devbox-1 at 00:43:34/36 on 10-25, all on /. Watch that one real address, not the fake one.
  • Encryption mix. canary-farm-1 took 1,085 HTTPS vs 3,375 HTTP events; ai-devbox-1 201 vs 2,471; lauterbourg-01-ts 268 vs 3,040; the rest were plain HTTP. The lauterbourg bait hostname cloud.wafflehouseindex.us drew 1,370 events, close to the node's own 1,525.
  • control-1's discovery ramp, day 42. 16,293 events from 114 unique IPs. The event count is almost all the xTom dictionary replay (13,777); the 114 unique IPs sit in the normal band for the 13th window.
  • Why the big number moves happened. control-1 +464% and ru-edge-1 +48% — the two dictionary replays. canary-farm-1 +80% — AI-CLI-VAULT plus REGISTRY-HUNT plus 62 mints. ai-devbox-1 +48% — AI-CLI-VAULT. lauterbourg-01-ts +117% — the xmlrpc flood plus tarpit traffic plus 130.12.180.117. The three drops (frantech-ts −94%, netcup-ts −63%, sponge-01-ts −69%) are absences: no dictionary replay on frantech this time, and the Bochum research crawler skipped its second window.
  • Every spike got a name. docker-compose on 4 sensors — AI-CLI-VAULT. The not-handled jumps — the replays and AI-CLI-VAULT. wp-xmlrpc-post 1,000 — 194.26.192.113. phpmyadmin-login 162 — 185.158.148.234. control's wp-login spikes — the new slow crowd. ru-edge's fake-git-miss 264 — 45.138.12.35.
  • Two reading traps in the digest. Events from the last hours of the previous window appear in both digests — AI-EXEC-HUNT's 649 events belong to yesterday's briefing. And first-seen times cluster at 03:16, which is when the logs arrive, not when they happened.
  • Changes we made this cycle. Registry rows updated for XMLRPC-BRUTE, CREDENTIAL-DRAIN, MEGA-DICTIONARY, and GO-SSH-SWEEP; two rows added (AI-CLI-VAULT, LIBSSH-011-SWEEP). The visuals script got a new chain entry, two status flips, and corrected dictionary counts. The recon name map gained one entry. The style-checking skill named style-editing is not on this host, so the technical-prose rules and its banned-phrase list did that job.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

681 addresses tried passwords. 525 got a shell (77 percent). 460 ran a command (88 percent of shell-getters). In events: 13,011 password tries → 3,896 accepted logins → 7,776 commands (200 percent of logins). Telnet bots tried 924 times.

No command appeared for the first time this window (0 of 1,481 distinct). That distinct count is about 20× last window's 75, with nothing new in it — we log it as a volume note, not a finding, until it repeats.

Busy repeats: the uname -s -v -n -r -m + uname -m | awk hardware survey ran 1,853 events each from 3 IPs led by 109.160.32.49 — the same network as the GO-SSH-SWEEP port scanner, so the scanning and the post-break-in inventory are one crew. The .ssh folder replant ran 546 times from 422 IPs and the key-replace chain 463 times from 365. A GPU check (lspci, nvidia-smi) ran 175 events each from 45.148.10.61 (a Techoff address). Password guessing offered 7,295 distinct pairs, 0 new; the top pair 345gs5662d34/345gs5662d34 got 522 tries and root/3245gs5662d34 got 468.

Open questions

  1. What exactly did 95.111.225.106 do with the 2 keys, in order? Where did the second key come from? Did anything beyond the identity check succeed?
  2. Will AI-CLI-VAULT come back — and will a key go missing, an AWS account light up, or a second operator IP appear? Does the same-block prober 195.182.16.23 share its tooling?
  3. Is the MEGA-DICTIONARY replay a one-off test of control-1 and ru-edge-1, or the start of wider targeting? A third host or node would tell us.
  4. Will the 162.243.83.227 peer behind the four fake 1.2.3.4 headers show up again?
  5. Can we capture one lauterbourg upload or command POST that the decoy answers with real output? That is the escalation signal.
  6. The Arkime session tags contabo-sponge-02-ts and proxy still label the wrong traffic (23,203 sessions). The fix lives in the ops repo, open since briefing №59.

Plain language version of: flux-fleet-intel-briefing-2026-10-25.md