Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №69 — PLAIN LANGUAGE

Period: 2026-10-31 07:33 – 2026-11-01 07:33 UTC (24h, day 67 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-11-01.md

What happened (plain)

Someone new showed up, took a bait password, and used it in Amazon's cloud within hours. The tool calls itself RECONX-L2S; it touched 15 different Amazon services. Most calls were blocked (31 of 33), but 2 identity checks succeeded. A second thief checked one of its stolen passwords the same way. Meanwhile a scanner swarm of 199 addresses lied about where its requests came from on 593 requests, almost all aimed at one sensor, frantech-ts. And the operator that set yesterday's record for the biggest data-dictionary replay came back the next day from the same address and ran the same 14,154 downloads again. No fleet equipment changed this cycle.

What it means (plain)

  1. Stolen bait passwords now feed real cloud-recon work, not just quick "does this still work" tests. RECONX-L2S ran 15 distinct read-only Amazon operations within hours of stealing a credential (DescribeDBInstances, DescribeInstances, GetRole, GetUser, ListAccessKeys, ListBuckets, ListSecrets, ListSubscriptions, ListTables, ListTopics, ListUsers, ListFoundationModels, GetSendQuota, LookupEvents, GetCallerIdentity), and 20.51.189.99 ran GetCallerIdentity against a second one. (High confidence that this happened — the Tracebit alert log shows all 33 use events; moderate confidence about intent — all 31 denied calls were read-only, so we know they were mapping the account, not yet destroying or spending anything.)
  2. Attackers now prefer many addresses doing a little each, instead of one address doing a lot. The XFF swarm spread 593 events over 199 addresses (about 3 events each), the CONFIGBUNDLE pools spread 685 events over roughly 102 addresses in 4 network blocks, GOWEB-PENTEST used three addresses that each hit a different sensor, and yesterday's wp-login spray used 201 addresses. Small per-address volume slips under rate-based alarms. The fake origin headers also make the listed source worthless — go by the tool signature and the wordlist instead. (High confidence — these are direct query counts; the pattern claim rests on four separate campaigns across two days.)
  3. The same scanning templates keep changing hands. The "kmonbase" marker moved from 176.65.144.71 (№67) to 93.152.209.6 this window. The l9explore/1.2.2 tool appeared again under CREDSWEEP's 45.138.12.51. The OPENAPI-CENSUS operator minted under a new honest-looking name, db-secret-scanner/parsing.py. (Moderate confidence — the shared markers are directly observed; "these groups share tooling" is an inference, since we cannot see the sharing itself.)
  4. REGISTRY-HUNT has now collected bait credentials for three days running without using this window's batch. At least 13 DigitalOcean addresses ran its 12-step walk, 6 collected new credentials between 20:55 and 21:28 stored, and none called Amazon. (High confidence on the counts; moderate on "they are saving them" — past windows show use can come a day later, so no use yet does not mean no use ever.)

Campaigns (who / what / what it means)

RECONX-L2S — a new kit that steals a bait password and immediately tries it in Amazon's cloud

  • Who: one address so far, 217.60.76.22, only against canary-farm-1. We do not know who hosts it. Its /16 address range once hosted LIBREDTAIL-KIT staging, which is a hint, not proof.
  • What they did: at 18:57:00 stored on 31 October it fired 40+ requests in 0.7 seconds at canary-farm-1, calling itself Mozilla/5.0 (compatible; ReconX-L2S/1.0) and curl/8.6.0, and also rotating fake browser identities. It fetched /.env (the trap answered and minted a real tripwire credential) plus /.env.local, /.env.backup, /.env.production (200), tried Laravel debug paths (/_ignition/health-check, /telescope/requests, /storage/logs/laravel.log, all 200), left two self-markers (/__l2s_debug_probe__, /reconx-790cadc585ee, 404), and posted two fake logins. Then it used the stolen credential in Amazon: 15 distinct read-only operations, 31 blocked (GetSendQuota 9 times, ListSubscriptions 4, ListTopics 4, ListFoundationModels 3, ListAccessKeys 2), 2 GetCallerIdentity calls succeeded.
  • What it means: this is a purpose-built kit: steal, test, map, stop. Every stage hit a decoy, and the cloud side leaked only the account's own identity. The danger sign to watch is a write call (starting servers, spending money) from any future mint.

CREDENTIAL-DRAIN — the standing "stolen bait password" pipeline

  • Who: 28 collector addresses took 43 credentials this window (the digest's own count of issued rows is 50: canary-farm-1 25 from 19 addresses, ai-devbox-1 12, control-1 8, ru-edge-1 5).
  • What they did: two credentials were used in Amazon this window — RECONX-L2S's, and one by 20.51.189.99 (GetCallerIdentity, on a credential it took at 09:25 from ai-devbox-1). Mint failures were 19 harmless pacing rejections (400s), no broken keys. 52.161.59.96 — the address that used a credential yesterday with no trace in our logs — now has a matching mint row (ai-devbox-1, 07:32:55 stored), which closes yesterday's open question.
  • What it means: a stolen bait password can be in use within hours. Count every issued /.env as live immediately.

REGISTRY-HUNT — the recurring Amazon/registry walker crew

XFF-SWARM — 199 addresses running one config-scanning wordlist while lying about their origin

  • Who: 199 source addresses, 1–5 requests each (average 3.0), active from 12:35 stored on 31 October to 03:27 stored on 1 November. 588 of the 593 fake-origin requests hit frantech-ts; control-1 got 3, ai-devbox-1 got 2.
  • What they did: each request carried an X-Forwarded-For header naming a different address than the one the connection really came from. They asked for /.env variants, /.gitlab-ci.yml, /.circleci/config.yml, /Jenkinsfile, /.travis.yml, /.git/credentials, /api/config, /v3/api-docs, /nginx.conf, using fake modern browser identities (Firefox 125, Safari 14.4.1, Android 14 Pixel 8 Pro, Windows Chrome). 0 credentials taken, 1 POST.
  • What it means: someone is deliberately poisoning the "who asked" field at scale. The forged-origin counter is the detector: 593 this window versus 2 yesterday. frantech-ts has no bait credentials, so nothing was stolen there; if this wordlist reaches a sensor that does mint, the first forged-origin mint is the moment to treat it as a top-tier campaign.

VPN-CONF-HUNT — a census for VPN and identity-store files (promoted to standing)

  • Who: 85.155.14.14 (SolidCore Hosting, Germany — the same address that started this campaign at №66) hit frantech-ts with 356 requests (356 unique paths) from 17:49 to 17:53 stored; a sibling, 85.155.14.32, hit sponge-01-ts with 356 requests from 21:46 to 21:47.
  • What they did: asked for VPN and cloud-identity files: /surfshark, /zenmate, /warp.conf, /ikev2.conf, /.heroku/credentials, /.config/gcloud/access_tokens.db, /saml.json, /bastion.yaml, /.sso, /.aws/credentials.bak, /.linode, /.age, /.equinix.json, /forcepoint.conf. Fake browser identities across Mac, Linux, and Windows. Nothing was taken (0 mints).
  • What it means: they want tunnel configs, single-sign-on material, and cloud login tokens — the files that unlock a company from the inside. The fleet's decoys answered 404 everywhere. The promotion rules set at №66 (second node, second address) are met.

GOWEB-PENTEST — phpMyAdmin login hammering, now one operator per sensor

  • Who: three fresh addresses, one per sensor: 14.225.220.240 (Vietnam) hit netcup-ts 17:44:47–17:45:22; 217.160.35.149 (IONOS, Germany) hit ai-devbox-1 13:19:19–13:20:24; 51.83.72.125 (OVH, France) hit control-1 00:22:44–00:23:01. A fourth, 103.13.207.81, minted on control-1 at 16:08 and tried 4 phpMyAdmin logins right after.
  • What they did: each ran 151 phpMyAdmin login events on one path in under 70 seconds, honestly calling itself Go Web Pentest Tool. This trio is the whole 68× spike on netcup-ts.
  • What it means: same tool, new deployment style — several sensors hit in parallel instead of one sensor per day. The fake phpMyAdmin served forms and nothing real was exposed.

MEGA-DICTIONARY — the record replay operator came back

  • Who: 135.136.19.27 (M247 Europe, Germany) — yesterday's record holder.
  • What they did: replayed the exact same 14,154-download dictionary about 20 hours later (14,204 events in the 00:00 UTC hour of 1 November; 28,326 in the 24-hour window counting yesterday's pass in the overlap). GETs only, no credentials taken.
  • What it means: yesterday's watch question is answered — this is persistent infrastructure, not a one-off. The address is now a named watchlist entry; a third pass would show a schedule.

OPENAPI-CENSUS — the API-spec scanner took its first bait credentials

  • Who: 193.47.62.29 (BestDC, Bulgaria), with 193.47.62.32 from the same block working the four no-canary sensors.
  • What they did: minted 4 credentials (one per canary sensor, 10:44–10:51 stored) under a new honest label, db-secret-scanner/parsing.py. Yesterday's watch item asked for exactly this.
  • What it means: four more credentials are in hostile hands from this group; their Amazon-side use is the first thing to check in coming windows.

XMLRPC-BRUTE — the WordPress XML-RPC flood is back

  • Who: 45.94.31.16 (1337 Services, Netherlands) — the same hosting family as the campaign's earliest operators.
  • What they did: 1,000 multicall POSTs at /xmlrpc.php on ai-devbox-1 from 20:15 to 20:22 stored, pretending to be Chrome 78, plus two single WordPress probes. Underneath, a slow background spray of residential addresses sent one multicall each (bodies start <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName>…; the rest is routine XML).
  • What it means: the known 1,000-POST batch shape, third hosting block to run it. The fake WordPress held; nothing was exposed.

CONFIGBUNDLE-SWARM — the many-address config scanner returned from new networks

  • Who: four address pools, about 102 addresses total: 194.5.53.x (36 addresses, canary-farm-1 + lauterbourg-01-ts, 311 events, 1 mint from 194.5.53.193), 163.5.241.x (16 addresses, both EU nodes, 150 events, 1 mint from 163.5.241.4), 82.197.193.x (21 addresses, 2 nodes, 103 events, 3 mints — .60 and .98 on canary-farm-1, .143 on ru-edge-1), 185.132.187.x (29 addresses, canary-farm-1, 121 events, 0 mints).
  • What they did: 2–10 requests per address, rotating fake browser identities ending in python-requests/2.34.2. They caused canary-farm-1's webapp-config-bundle-js spike (66 events, 3.9× normal).
  • What it means: 5 more credentials entered the drain from this campaign. Whether they get used in Amazon is the check.

CONFIG-SWEEP — the one-minute config census, run by a new operator

  • Who: 93.152.209.6 (Omniline Investment, Bulgaria), canary-farm-1 only.
  • What they did: 94 requests, 94 unique paths, 40 trap families, in 63 seconds (18:15:47–18:16:50 stored), pretending to be Googlebot/2.1, including the "kmonbase" marker paths. This same address collected 3 credentials between 24 and 27 October.
  • What it means: the kmonbase template changed hands (yesterday's holder was 176.65.144.71) — the second template hand-off this window. The fleet minted against it before and gave up nothing.

CREDSWEEP — the .env-variant walkers, eighth window

  • Who: 45.138.12.51 (Tc Datacenter, Lithuania) using l9explore/1.2.2; 45.138.12.35 on canary-farm-1 (385 events); 194.180.49.41 (MEVSPACE) on 5 sensors.
  • What they did: 45.138.12.51 minted on ai-devbox-1 at 04:24 stored; 194.180.49.41 minted on control-1 at 23:24 stored. The other two regulars (.16, .6) stayed home. The digest's new /.env [not-handled] cluster is this same template seen from the three sensors that have no /.env trap — not a new group.
  • What it means: eight windows, still no observed use of any credential this class took. The l9explore tool remains the shared link to REGISTRY-HUNT.

Smaller watchers (kept for the record)

  • 45.148.10.120 (Techoff, Netherlands) took 4 credentials on canary-farm-1, 12 over six days.
  • 154.162.45.255 took 5 credentials (3 canary-farm-1, 2 control-1) with a stripped, identity-less browser string — new collector, no known group.
  • 150.241.66.127 took 3 on ai-devbox-1; 217.60.195.235 (same /16 as RECONX-L2S) took 1; 212.56.54.43 took 1 claiming to be Chrome 143 — a version that does not exist yet, which dates the fake.
  • /-hammering loopers: 91.92.40.12 (all 8 sensors, 551 events), 93.174.93.12 and 89.248.172.33 (7 sensors each, 367 and 333 events, Python aiohttp), and 45.138.12.19 (1,241 events on 5 sensors under osint-scanner/1.0 — this one is on our verified-benign list).
  • A scattered webshell-checker wave caused frantech-ts's 11.7× spike (55 events): about 25 light addresses probing /info.php, /phpinfo.php, /0.0_phpinfo.php, /1_1_PhpInfo.php, /config.inc.php — leftovers of some earlier compromise, not one operator.
  • On lauterbourg-01-ts the ANDROXGH0ST cluster (4 addresses, 164 events, running since 24 October) and the /bin/sh command-injection cluster (8 addresses, 24 events across 5 sensors) persist quietly.

Standing actors (who keeps coming back)

  • REGISTRY-HUNT's DigitalOcean crew — every window on record; collecting for three straight days.
  • 45.138.12.x (Tc Datacenter, Lithuania) — eighth window.
  • Techoff blocks (45.148.10.x) — the mint arm keeps working.
  • 194.180.49.41 (MEVSPACE) — light census, now also collecting credentials.
  • 102.220.163.241 (SI-CENSUS) — back after two quiet windows, 4 mints, 74 over six days.
  • 23.132.164.201 — a hoarder candidate, 9 credentials over six days, minted 2 more under a 2007-era phone identity and an Android 4.4 fake.
  • 93.152.221.96 (TechTies/JNDI) — static at 1,088 collected credentials, third idle window.

Absent this window: WIDE-CONFIG-CENSUS, METADATA-HUNT runners, OMEGA-SWEEP, CF-FRONTED CREDSWEEP, NIGHTAGENT, BUCKLOG-KIT, CENSUS-284, CRUSADER-SWEEP, KEYDROP-SCANS, WP-XRPC-WALK, EXCHANGE-DICT, and the lauterbourg heavyweights 121.40.140.50 and 136.70.193.85.

Network sweeps (Arkime) — the view of machines that knock on SSH and never send a web request

Three sweep campaigns crossed the alarm line this window. All numbers below come from the fleet's own traffic sensors.

  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6): 3,513 sessions from 422 addresses in 197 networks across 61 countries, all on port 22. It is shrinking: 616 addresses yesterday, 455 the day before, 168 so far today. Top networks: UCloud (HK), Microsoft, OVH, DigitalOcean, Byteplus.
  • GO-SPRAY-SWEEP (06ff3615a51b2af343ec22abc8e30bbc, banner ssh-2.0-go): 1,911 sessions from 101 addresses in 47 networks, 24 countries — back above the dispersed alarm line after dropping to 20 addresses yesterday. Its daily series: 41, 183, 119, 164, 20, 101, 13 addresses.
  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499, banner ssh-2.0-go): 33,648 sessions from 85 addresses in 34 networks, 23 countries — the top inbound fingerprint on 6 of 8 sensors, up 3,870 sessions day-over-day. Its busiest addresses sit in 109.160.32.x, the same block that runs the uname discovery commands on the frantech-ts honeypot below, so the scanners and the shell operators share machines.
  • No new fingerprints; 41 standing campaigns on record. CTL-MASS-SSH (4e066189c3bb…) again points mostly at control-1 (33,077 sessions).

What it means: these sweeps request no web path, so the web traps see none of it — this traffic layer is the only place the fleet can watch them. Identity goes by the tool fingerprint, never the address.

Canaries (minted and used) — what happened to the bait passwords

Fleet sensors minted 43 credentials to 28 collector addresses this window (the digest's raw issued count is 50). Two credentials were used in Amazon: 33 use events, 31 blocked, 2 GetCallerIdentity identity checks succeeded. A success like that leaks only the account's own identity; anything beyond it would be a real finding. This was a use window, not a zero-use window.

Every collector, with its sensor, mint count, and six-day history:

Long-term holders with no observed Amazon use (possible hoarders or resale): 93.152.221.96 with 1,088 credentials, 102.220.163.241 with 74, 136.65.203.248, 34.95.21.228, and 136.66.182.42 with 41 each, 45.148.10.120 and 46.151.178.15 with 12 each, and 27 more addresses listed in the technical version.

How the fleet behaved (Fleet Observations) — the fleet's own health this window

  • Volume: frantech-ts ran 173% above its weekly norm — entirely the two dictionary replays. Everything else ran below normal (ai-devbox-1 −52%, canary-farm-1 −85%, control-1 −74%, lauterbourg-01-ts −77%, ru-edge-1 −93%) because yesterday's heavy hitters all stayed home; netcup-ts (+17%) and sponge-01-ts (+11%) ran slightly high on light scanning. We checked that every sensor's logs are current (latest events 10:48–12:33 stored on 1 November), so the drops are real quiet, not missing data.
  • Canary economics: 50 bait credentials issued (digest count), 19 rejections that are harmless rate-limit pacing, no broken keys. netcup-ts, sponge-01-ts, and frantech-ts carry no credentials by design; lauterbourg-01-ts has its key intentionally empty.
  • Attribution: 2,070 requests carried fake-forwarded-origin headers; 593 claimed an origin different from the real connection (the XFF swarm), against 2 yesterday. For anything in that wave, trust the connection, not the header.
  • control-1 (the fresh-IP baseline node) is 50 days old. Its latest full day: 1,566 events from 138 addresses; the 7-day band runs 892–16,293 events per day. The ramp continues.
  • No fleet changes were made this cycle.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

This is one machine running fake SSH (port 2222) and fake telnet (port 2323). Of 612 addresses that tried passwords, 473 got a fake shell (77%) and 415 typed commands (88% of those who got in). In total: 9,136 password attempts, 4,671 accepted logins, 11,390 commands. Telnet botnets tried 583 times.

No command was typed for the first time this window (0 new of 4,292 known), and no new password pair appeared (0 of 3,457 offered). The same small family keeps trying: 345gs5662d34/345gs5662d34 758 times and root/3245gs5662d34 554 times. Familiar commands continue: the uname hardware checks (1,718 + 1,705 events, example source 109.160.32.148), the SSH-key planting pair (chattr -ia .ssh, then replacing .ssh — 791 and 661 events), and GPU lookups (nvidia-smi, lspci | grep VGA) from 179.43.153.10 and 3 others.

C2 download addresses (frantech-ts — one host, not fleet-wide)

One new staging host appeared: 45.90.163.37. It served two downloader scripts, http://45.90.163.37/wget.sh (sha256 starts cf0b50b8b7a8, 1,476 bytes) and http://45.90.163.37/curl.sh (sha256 starts a8db671b58d0, 1,477 bytes), each fetched by 17 different honeypot visitors between 11:22 and 22:05 on 31 October. It also advertised tftp://45.90.163.37 and ftp://45.90.163.37/ftpget.sh, but nothing came back over those. Both scripts download 11 versions of a program named jkl<arch> (arm, mips, ppc, x86 and more), run it with selfrep, then delete themselves — this is the known jklarm self-spreading family, and 45.90.163.37 is its third known hosting address. The jkl program files themselves were not captured this window. Totals for the whole inventory: 77 endpoints on 22 hosts, 22 captured payloads. One host — never a fleet number.

Open questions

  1. Will RECONX-L2S (217.60.76.22) come back, reach a second sensor, or try a write action in Amazon with its 2 held credentials? A write attempt is the escalation signal.
  2. Will the XFF swarm reach a sensor that mints credentials? So far it hit only the sensor with none. If a forged-origin request ever produces a mint, that mint's Amazon side tells us what the swarm is for.
  3. Three groups now hold fresh credentials they have not used: REGISTRY-HUNT's 6, OPENAPI-CENSUS's 4, and the CONFIGBUNDLE pools' 5. Which group uses theirs first, and when?
  4. What is inside the jkl program files from 45.90.163.37? We only captured the downloader scripts; the programs themselves were not fetched by the honeypot this window.
  5. Will GO-SPRAY-SWEEP keep growing (20 → 101 addresses in one window)? Past 200 addresses it would be the fleet's widest SSH sweep on record.

Plain language version of: flux-fleet-intel-briefing-2026-11-01.md