flux fleet — campaign visuals

Period: 2026-09-29 07:32:00 → 2026-09-30 (current 24 h window highlighted) · Generated 2026-09-30 07:33 UTC · CUTOFF 2026-09-29 07:32:00
Companion to flux-digest-2026-09-30.md · briefing 2026-09-30 · registry (registry is markdown in the skill assets)
Fleet events all-time: 916,965 Journey-fingerprint sigs: 80 Issued rows all-time: 2,230 24 h top talkers: 15 XFF mismatches all-time: 15511
frantech-ts 09-17/09-18 counts are floor values — node disk-full outage №24, flux writer died ~07:11 UTC 09-17; digest rerun after ops trims pcaps.

Fleet activity — daily events per sensor, 2026-08-29 → today

Attribution health — daily % named clientIp; XFF peer-mismatch chips

ru-edge-1: 8947ai-devbox-1: 5390frantech-ts: 968canary-farm-1: 193control-1: 6sponge-01-ts: 4lauterbourg-01-ts: 3netcup-ts: 0

Mint volume — issued rows per day; purple = day with Tracebit use events

Campaign lifecycle — 57 journey-fingerprint sigs, bar = first_seen → last_seen (sensor count in label)

Curated kill-chains — registry campaigns, maintained at briefing time

CREDENTIAL-DRAIN active

Mint→use pipeline, not a trap template. №36: use continues — .175 used 5 more (19 use IPs) and 94.26.106.73 (TechTies DE) minted 1 on ai-devbox-1 14:37 and used it IN-WINDOW: FIRST IAM CreateUser attempt on the deny log (+ DescribeRegions denied). №35 ended the ten-window zero-use streak: 7 creds/28 events — .175 used 6, .211 used 1.
flowchart LR
    MINT["Empty-IP mint burst<br/>on one node"] --> COLLECT["Collector harvest<br/>(forged AI-crawler UAs)"]
    COLLECT -->|"minutes later"| USE["AWS use from egress IPs"]
    USE --> S1["ConsoleLogin<br/>GetSigninToken<br/>GetCallerIdentity ✓24"]
    USE --> S2["Denied recon ops<br/>GetAccount ×108<br/>DescribeInstances ×97<br/>ListUsers ×6<br/>CreateUser ×1 (№36)"]
    S1 --- POLICY["legacyOwnerAccess<br/>deny-all policy held"]

NIGHTAGENT dormant

DROPPER RETIRED 09-24: the nightagents/nightshell repo is 404 with its GHSAT token attached — the token was byte-identical across 14 windows. Eighth run (№28) was the campaign's first mint: 105.158.191.248, two full passes on farm 09-21, 1 credential issued, zero AWS use since. Idle three windows and counting; the phpunit verify body <?php echo "NightAgent";?> is the surviving fingerprint — a return must carry a NEW dropper URL.
flowchart LR
    V["phpunit webshell verify<br/>NightAgent echo"] --> D["nightshell dropper<br/>RETIRED 09-24 — 404<br/>repo removed"]
    D -.-> L["form login<br/>user=root&pass=wrong"]
    L --> W["wp-batch SQLi<br/>UNION SELECT"]
    W --> MINT["1 mint №28<br/>(zero AWS use)"]

METADATA-HUNT idle

Idle since №22 as a campaign; 7th marker-light window. №33: 3 @fs marker rows again (136.85.48.119, farm, 2nd window) with a 291-ev credential-family run (firebase/gcp-credentials, graphql, forged AI-crawler UAs, 3 mints) — resumption candidate.
flowchart LR
    SW["GCP template sweep<br/>forged AI-crawler UAs"] --> SSRF["SSRF → IMDS<br/>__aws_leak_probe_*"]
    SSRF --> VITE["Vite /@fs traversal<br/>CVE-2026-39364 ?raw??"]
    VITE --> ENV["/.env · .mcp.json<br/>vite-fs mints"]
    ENV --> HOARD["Credential hoard<br/>zero AWS use"]

OMEGA-SWEEP active

№36: RECORD /46 mint wave — 44 in-window: .246 22 (farm 12 + aidev 10), .245 22 (farm 12 + aidev 10, plus a sponge touch); pool .43.164/.43.125 1 each; WORDLIST GREW into IaC/DevOps paths (helmfile.yaml, terraform.tfvars, saltstack/.env, group_vars/all.yml, jwt.key). №33: .246 census-without-mints + control 6 mints.
flowchart LR
    OP["/46 pool + external ops<br/>forged Googlebot/2.1"] --> SWEEP["1,042-path census<br/>12-s mint bursts"]
    SWEEP --> MINT["/.env mints<br/>35 (№28)"]
    MINT --> HOARD["Standing hoard<br/>~290+ creds, zero use"]

REGISTRY-HUNT active

LeakIX l9scan template. №36: 7 full-kit runners (farm 4 / aidev 3, 27 trap families each), 8 mint rows at ~1/IP in the 20:03–20:37 evening wave; 167.99.181.249 crossed to lauterbourg again. №33: 8 full-kit IPs + FIRST lauterbourg visit (4 IPs, 39 ev).
flowchart LR
    L9["LeakIX l9scan<br/>DO IP pool"] --> W1["WebLogic console"]
    W1 --> W2["Confluence · WHM/cPanel"]
    W2 --> DR["Docker registry enum<br/>/v2/internal/..."]
    DR --> GR["/graphql introspection<br/>credential-canary hit"]
    GR --> MINT["Mints 1/IP<br/>6 (№28)"]

CREDSWEEP active

№24: .102 ran 4 quick node passes (widest spread yet, 4 mints). VPS Dedicated /24 holds 3 operators.
flowchart LR
    OP["Feo Prest /24 ·<br/>VPS Dedicated SI"] --> ENV["511-path .env-variant<br/>+ credential census"]
    ENV --> FORGE["Mozlila/5.0 typo forgery"]
    FORGE --> MINT["Mints<br/>4 (№24)"]

XMLRPC-BRUTE active

№36: NEW operator class — 134.209.110.125 (DigitalOcean SG; minted 4 canaries №35) ran TWO legs on lauterbourg: 3,050 system.multicall POSTs in 15 min + 3,049 wp-login form POSTs in 89 min (~1.75 s/POST), fixed admin, site-aware passwords ('kiteworks', 'kiteworksrightabouteverythingshow'), forged Chrome/89. №35: the ORIGINAL operator class returns — 185.19.40.202 (1337 Services GmbH NL) ran the registered 1,000-POST batch on lauterbourg-01-ts 00:14–00:15 UTC: preflight trio, then 1,000 system.multicall POSTs at ~23/s, fixed username admin vs rotating passwords (admin123, 12345678, pass123...), forged Chrome/78. First xmlrpc flood since №28; new node in the target set. №28: fifth operator 119.40.84.186 (BDCOM BD) burst→sustained: 18,063 xmlrpc + 18,063 wp-login POSTs over 6.5 h on netcup.
flowchart LR
    OP["Operator rotates<br/>(1337 Svcs · GCP · Google BE · BDCOM BD)"] --> PRE["Preflight wlwmanifest<br/>+ wp/v2/users"]
    PRE --> FLOOD["system.multicall flood<br/>1,600–18,063 POSTs"]
    FLOOD --> WPL["wp-login phase<br/>one distinct password per POST"]

MALWARE-DICT active

Pfcloud 204.76.203.18 loop RESUMED №26 (first absence was №22): 2,059 ev control + 2,060 ru-edge in 27 h, byte-identical, 569 paths.
flowchart LR
    FEED["URLhaus-style<br/>dropper-URL feed"] --> REPLAY["Dictionary replay<br/>569-path loop"]
    REPLAY --> SIB["204.76.203.31 sibling<br/>4-node light census"]

GIT-VAULT paused

Git-internals walk + secrets files; `git/2.39.0` UA is the fingerprint. №23: new Interserver operator ran a full /.git/hooks/ enumeration.
flowchart LR
    W["Git-internals walk<br/>.git/objects/<2>/<38>"] --> REFS["packed-refs · refs/heads/main<br/>hooks/ enumeration"]
    REFS --> ENV[".env · database.yml ·<br/>secrets.yml"]
    ENV --> MINT["Mints"]

LIBREDTAIL-KIT active

phpunit directory-permutation RCE, honest UA libredtail-http. №36 (18th window): 16 full-kit IPs × 37 ev across 7 sensors (first full-kit lauterbourg visit); repeats 88.218.94.33 + 23.94.192.15; 610 md5 probes, 1 distinct body; oracle bodies 3 hashes; staging host 217.60.103.56 in 18 bodies/17 IPs; mint-fragments 103.75.11.189 (7 in 6d), 159.26.101.60, 149.40.48.71. №35 (17th window): 9 full-kit IPs at 37 ev each + 7-ev php-cgi delivery leg (same IPs, /bin/sh + cmd-injection-php-cgi-rce paths) across ai-devbox-1/netcup/sponge; dropper 12/12 → 217.60.103.56 arg apache; repeat rate fell to 1/16 (69.12.176.117). №33 (15th window): 18 full-kit IPs across ALL 8 sensors.
flowchart LR
    P["md5(Hello PHPUnit)<br/>eval-stdin.php probe"] --> RCE["POST /index.php<br/>shell_exec(base64) →<br/>ed25519 key exfil"]
    RCE --> DROP["POST /bin/sh dropper<br/>217.60.103.56/sh"]
    DROP --> SH["curl | sh -s apache"]

INFOCREST-KIT active

Composite kit, operator + password rotate per run. №23: fifth operator 41.249.4.249 (first residential). №24: absent.
flowchart LR
    T["Tarpit cycling"] --> PMA["phpMyAdmin enum"]
    PMA --> ADM["Adminer POSTs<br/>prod_rw + 22-char pw"]
    ADM --> CFG["Config-bundle enum"]
    CFG --> WP["wp-batch multiplex"]

AKAMAI-CONFIG active

№23–№24: 23.94.155.0/24 cluster, 12 IPs, per-leg IP separation. Second run 09-18 (200 ev, 0 mints); watch for a third run with mints.
flowchart LR
    CL["23.94.155.0/24<br/>per-leg IP separation"] --> ENV["53-path .env fanout<br/>+ config JSONs"]
    ENV --> ADM["Adminer POSTs<br/>joomla_app + 22-char pw"]
    ADM --> PMA["phpMyAdmin enum"]
    PMA --> WP["wp-batch SQLi"]

ALIYUN-PROBE paused

Named operator 69.5.20.14 (Byteplus, ID). №24: first idle window. Byte-identical 404-path passes, 9-UA rotation, /.aliyun/* sweep.
flowchart LR
    OP["Byteplus 69.5.20.14<br/>9-UA rotation"] --> CENSUS["404-path byte-identical<br/>census + suffix fanout"]
    CENSUS --> ALI["/.aliyun/* 21-path<br/>credential sweep"]
    ALI --> ZERO["0 mints —<br/>recon only"]

SYNC-ENUM-WAVE active

№25 NEW: 8 IPs ran byte-identical 282-event WordPress user-enum passes (270 tarpit + 12 enum calls), Chrome/127 UA, staggered ~15 min across control, ru-edge, sponge 18:41-20:01 UTC 09-18. №24 2-IP run was the same shape; third run, promoted.
flowchart LR
    Q["Scheduler queue<br/>1 IP per ~15-min slot"] --> P["Byte-identical 282-ev pass<br/>270 tarpit cycles + 12 enum calls"]
    P --> N1["control"]
    P --> N2["ru-edge"]
    P --> N3["sponge"]
    N1 --- ZERO["0 mints"]

MEGA-DICT paused

PAUSE LIFTED №34: eleventh + twelfth replays in ONE window — 23.234.117.146 (tzulo US) 10:53 and 193.32.126.191 (31173 Services AB FR) 00:44, each 13,195 GETs/paths, identical sets. WORDLIST GREW +6 after the №32 freeze (/beacon_linux_amd64_p_<hex> ×2, /mass.sh, /lel.sh, /x64s, /mirai.arm64). №35–№36: two consecutive misses — no replay in-window; frantech −95% (615 ev) on the second. Pause re-opened per the №35 rule.
flowchart LR
    F["13,195-path IoT dropper-URL<br/>dictionary (shared artifact)"] --> R1["Replay 1: tzulo US<br/>13,195 in 52 s"]
    F --> R2["Replay 2: 31173 FR<br/>13,195 in 1m54s"]
    R1 --- B["NEW: /beacon_linux_amd64_p_*<br/>+/mass.sh · /lel.sh · /x64s<br/>+/mirai.arm64 — +6 after freeze"]

WP-BATCH family recurring

Not a standalone campaign since №12: wp-batch bodies ride inside INFOCREST-KIT / AKAMAI-CONFIG / NIGHTAGENT chains (SQLi via author_exclude UNION SELECT).
flowchart LR
    MP["/wp-json/batch/v1<br/>multipost requests body"] --> SQLI["UNION SELECT<br/>author_exclude SQLi"]
    SQLI --> HOST["Rides inside INFOCREST ·<br/>AKAMAI-CONFIG · NIGHTAGENT"]

ORACLE-SWEEP paused

UN-MERGED from METADATA-HUNT in №33 per the registered trigger. №34–№35: two consecutive absences since the un-merge — the №34 rule fired, status is standing-paused. Un-pause on a 140.245.x/161.118.x run carrying the ~94-path core.
flowchart LR
    OP["5 Oracle SG hosts<br/>one per sensor"] --> SW["~94-path .env +<br/>config census<br/>Chrome/126"]
    SW --> MINT["/.env mints<br/>1/IP (3 sensors)"]
    SW --> REJ["farm burst<br/>32 tracebit-http-error"]

SS-PROBE active

REGISTERED №33. №34: 105.115.10.78 returned solo (4 markers / 4 mints on ai-devbox-1) — its second run; 23.234.77.64 and the №32 originals absent. Operator ledger: 4 operators / 4 ASNs, every marker suffix fresh per run.
flowchart LR
    P["GET /__ss_probe_<32-hex>__<br/>python-requests/2.31.0<br/>guarantees first-seen"] --> E["GET /.env → 200<br/>canary mint"]
    E --> END["Run ends<br/>no POST · no fanout"]

CONFIG-SWEEP active

87.120.104.29 (Sino Worldwide NO, Googlebot/2.1 forgery). №33: SECOND mint run — 12 mints inside farm's 2,950-ev 1-minute burst + 6 on control's 1,239-ev census. №34: NO NEW RUN — the window's control rows and 6 mints are the №33 run seen through the 24-h seam.
flowchart LR
    B["1-minute census burst<br/>1,600+ paths, 121 families"] --> W["wp-config · app-config ·<br/>aws-credentials paths"]
    W --> MINT["/.env mints<br/>18 in-window"]

Mint → use sankey — sensor → minted → used-in-AWS / unused (all-time)

sankey-beta

ai-devbox-1,minted credentials,979
canary-farm-1,minted credentials,957
control-1,minted credentials,200
ru-edge-1,minted credentials,94
minted credentials,used in AWS (411 events),411
minted credentials,unused / hoarded,1819

SSH/telnet honeypot funnel — frantech-ts only, not fleet-wide

flowchart LR
    SRC["ssh sources<br/>5017 IPs"] --> AUTH["281070 auth events"]
    AUTH -->|accepted| LOGIN["152240 logins<br/>4449 IPs"]
    LOGIN --> SHELL["132837 commands<br/>2236 IPs"]
    TEL["telnet<br/>1020 IPs"] --> TAUTH["13471 auth events"]

Recent hp commands — newest first (state.hp_commands)

first_seenipeventshead
2026-09-30 03:3114.103.118.1501"echo \"root:7YIIx1eTK6MO\"|chpasswd|bash"
2026-09-30 03:3161.171.65.2191"echo \"root:tBQFv8tfAXkC\"|chpasswd|bash"
2026-09-30 03:16125.122.102.1481"echo \"root:LNg89MlUDigw\"|chpasswd|bash"
2026-09-30 03:16180.76.143.2031"echo \"root:J9Ui6gkwe4cR\"|chpasswd|bash"
2026-09-30 03:16101.89.76.2491"echo \"root:m1PHWQ1kmDWF\"|chpasswd|bash"
2026-09-30 03:16115.190.192.1121"echo \"121212\\nRHhrOe1YyLni\\nRHhrOe1YyLni\\n\"|passwd"
2026-09-30 03:1645.198.224.1412"echo OK"
2026-09-30 03:1645.198.224.1412"ps aux 2>/dev/null | head -10"

Network-layer recon — inbound sweeps on the fleet's public IPs (Arkime); not visible to the HTTP traps

Arkime window 2026-09-29 07:32:00 → 2026-09-30 07:32:32 UTC · 125,383 inbound sessions on 8 fleet public IPs. Identity is the client tool (fingerprint), never the source IP — sweep operators rotate addresses and keep the tool. Last column = source IPs per day.
fingerprintcampaignsessionssrc IPsnetworkscountriesportssrc IPs/day
f555226df196…LIBSSH-MASSSWEEP dispersed sweep (one port, many networks)7,005365183462209-25 339 · 09-26 321 · 09-27 316 · 09-28 356 · 09-29 355 · 09-30 138
98f63c4d9c87…—63797762209-20 13 · 09-21 13 · 09-22 14 · 09-23 4 · 09-29 6 · 09-30 94
084386fa7ae5…—10437762209-25 23
03a80b21afa8…—5163319122209-25 34 · 09-26 31 · 09-27 28 · 09-28 33 · 09-29 33 · 09-30 10
0a07365cc01f…GO-SSH-SWEEP26,4773212112209-25 38 · 09-26 41 · 09-27 35 · 09-28 60 · 09-29 57 · 09-30 12
16443846184e…—11,1533113132209-25 37 · 09-26 40 · 09-27 46 · 09-28 39 · 09-29 34 · 09-30 18
dd9bcf093c35…—28281122—
2ec37a7cc8da…—2,01917342209-25 17 · 09-26 17 · 09-27 17 · 09-28 16 · 09-29 17 · 09-30 11
19532158b559…—1,2461414142209-25 13 · 09-26 19 · 09-27 20 · 09-28 23 · 09-29 17 · 09-30 7
e54ef3ec27fe…—22134322—
873a5fb5fedc…—11113122—
acaa53e0a7d7…—11119822—

Top talkers — 24 h window from CUTOFF, named clientIp only

Result-tag heatmap — top 25 tags × 21 days, fleet-wide (all sensors summed)