Mint volume — issued rows per day; purple = day with Tracebit use events
Campaign lifecycle — 57 journey-fingerprint sigs, bar = first_seen → last_seen (sensor count in label)
Curated kill-chains — registry campaigns, maintained at briefing time
CF-FRONTED CREDSWEEP new
№37: first-seen Cloudflare-fronted ai-devbox credential census over inference.fapthropic.com — 54 Cloudflare edge IPs, 7,245 HTTPS events, 289 paths, 83 result families, and 76 /.env mints. Origin hidden by Cloudflare; all rows use socket peer 172.18.0.1 with no XFF mismatch. Watch the minted credentials for AWS use.
flowchart LR
EDGE["Cloudflare edge IPs<br/>54 in window"] --> HOST["ai-devbox-1 HTTPS<br/>inference.fapthropic.com"]
HOST --> CENSUS["Credential census<br/>289 paths · 83 families"]
CENSUS --> MINT["76 /.env mints"]
MINT --> WATCH["AWS-use watch"]
CREDENTIAL-DRAIN active
№38: FOURTH consecutive use window with a new target service — 4 credentials, 150 use events: 9 sts:GetCallerIdentity successes; denied GetSendQuota ×68 and GetSMSAttributes ×68 (FIRST SES operations on the deny log) plus ListFoundationModels ×5. NEW use-side family: Bucklog 185.177.72.49 minted 1 on control-1 13:50 and used 2 creds from 4 AWS-side IPs within minutes. Feo Prest .154 used 1 from 6 IPs; SS-Net .211 used 1 from 4 IPs (repeat).
flowchart LR
MINT["Empty-IP mint burst<br/>on one node"] --> COLLECT["Collector harvest"]
COLLECT -->|"minutes later"| USE["AWS use from egress IPs"]
USE --> S1["sts:GetCallerIdentity<br/>✓9"]
USE --> S2["Denied ops<br/>GetSendQuota ×68<br/>GetSMSAttributes ×68<br/>ListFoundationModels ×5"]
S1 --- POLICY["legacyOwnerAccess<br/>deny-all policy held"]
NIGHTAGENT dormant
DROPPER RETIRED 09-24: the nightagents/nightshell repo is 404 with its GHSAT token attached — the token was byte-identical across 14 windows. Eighth run (№28) was the campaign's first mint: 105.158.191.248, two full passes on farm 09-21, 1 credential issued, zero AWS use since. Idle three windows and counting; the phpunit verify body <?php echo "NightAgent";?> is the surviving fingerprint — a return must carry a NEW dropper URL.
flowchart LR
V["phpunit webshell verify<br/>NightAgent echo"] --> D["nightshell dropper<br/>RETIRED 09-24 — 404<br/>repo removed"]
D -.-> L["form login<br/>user=root&pass=wrong"]
L --> W["wp-batch SQLi<br/>UNION SELECT"]
W --> MINT["1 mint №28<br/>(zero AWS use)"]
METADATA-HUNT idle
Idle since №22 as a campaign; 7th marker-light window. №33: 3 @fs marker rows again (136.85.48.119, farm, 2nd window) with a 291-ev credential-family run (firebase/gcp-credentials, graphql, forged AI-crawler UAs, 3 mints) — resumption candidate.
№37: single-node ru-edge run from .245 — 1,350 events, 1,342 paths, 138 families, 6 /.env mints in 17 s, forged Googlebot/2.1, no observed AWS use. №36 remains the record /46 mint wave at 44 in-window mints (.246 22, .245 22, pool singles).
flowchart LR
OP["/46 pool + external ops<br/>forged Googlebot/2.1"] --> SWEEP["1,042-path census<br/>12-s mint bursts"]
SWEEP --> MINT["/.env mints<br/>35 (№28)"]
MINT --> HOARD["Standing hoard<br/>~290+ creds, zero use"]
REGISTRY-HUNT active
LeakIX l9scan template. №38: BIGGEST WAVE SINCE №30 — 34 full-kit runners: canary-farm-1 13 IPs / 574 ev (850993125b15), ai-devbox-1 11 IPs / 492 ev, and FIRST lauterbourg cluster 10 IPs / 390 ev under a new kiteworks-root-redirect signature (abf92a331d66). DO-space collectors hold 34 of the window's 69 mint rows, 1–2 mints each, 11:34–18:20 UTC+4 wave. Honest UA; borderline per registry. №36: 7 runners, 8 mints.
flowchart LR
L9["LeakIX l9scan<br/>DO IP pool"] --> W1["WebLogic console"]
W1 --> W2["Confluence · WHM/cPanel"]
W2 --> DR["Docker registry enum<br/>/v2/internal/..."]
DR --> GR["/graphql introspection<br/>credential-canary hit"]
GR --> MINT["Mints 1/IP<br/>~34 DO rows (№38)"]
CREDSWEEP active
№37: broad return — .102 hit seven sensors with 1,543 events and 7 mints; .139 hit five sensors with 288 events and 6 mints; Feo Prest .154 hit farm with 378 events and 34 mints; 45.148.10.171 returned after one absent window with 5 mints.
№37: 185.19.40.202 (1337 Services GmbH NL) returned on lauterbourg with 1,000 system.multicall POSTs in 89 s, fixed admin username, one password per body, forged Chrome/78. №36: 134.209.110.125 (DigitalOcean SG; minted 4 canaries №35) ran two legs on lauterbourg: 3,050 system.multicall POSTs plus 3,049 wp-login form POSTs with site-aware passwords. №28: fifth operator 119.40.84.186 (BDCOM BD) burst→sustained with 18,063 xmlrpc + 18,063 wp-login POSTs over 6.5 h on netcup.
flowchart LR
OP["Operator rotates<br/>(1337 Svcs · GCP · Google BE · BDCOM BD)"] --> PRE["Preflight wlwmanifest<br/>+ wp/v2/users"]
PRE --> FLOOD["system.multicall flood<br/>1,600–18,063 POSTs"]
FLOOD --> WPL["wp-login phase<br/>one distinct password per POST"]
MALWARE-DICT active
Pfcloud 204.76.203.18 loop RESUMED №26 (first absence was №22): 2,059 ev control + 2,060 ru-edge in 27 h, byte-identical, 569 paths.
Named operator 69.5.20.14 (Byteplus, ID). №24: first idle window. Byte-identical 404-path passes, 9-UA rotation, /.aliyun/* sweep.
flowchart LR
OP["Byteplus 69.5.20.14<br/>9-UA rotation"] --> CENSUS["404-path byte-identical<br/>census + suffix fanout"]
CENSUS --> ALI["/.aliyun/* 21-path<br/>credential sweep"]
ALI --> ZERO["0 mints —<br/>recon only"]
SYNC-ENUM-WAVE active
№25 NEW: 8 IPs ran byte-identical 282-event WordPress user-enum passes (270 tarpit + 12 enum calls), Chrome/127 UA, staggered ~15 min across control, ru-edge, sponge 18:41-20:01 UTC 09-18. №24 2-IP run was the same shape; third run, promoted.
flowchart LR
Q["Scheduler queue<br/>1 IP per ~15-min slot"] --> P["Byte-identical 282-ev pass<br/>270 tarpit cycles + 12 enum calls"]
P --> N1["control"]
P --> N2["ru-edge"]
P --> N3["sponge"]
N1 --- ZERO["0 mints"]
MEGA-DICT active
№38: SECOND consecutive double replay, both legs on frantech-ts this time — 23.234.118.146 (tzulo US; the №37 control host, back inside 24 h on a second node) 18:35 UTC+4 and 193.32.126.131 (31173 Services AB FR) 00:56. Spot query: 13,297 paths each, 13,297 shared, zero POSTs. WORDLIST GREW +5 fleet-new paths (/s/agent.sh, /s/agent-sf.sh, /s/agent-binary, /violet.x86, /wife.aarch64) — 13,292 → 13,297.
flowchart LR
F["13,297-path IoT dropper-URL<br/>dictionary (+5 this window)"] --> R1["Replay 1: tzulo US<br/>frantech-ts · 13,297 paths"]
F --> R2["Replay 2: 31173 AB FR<br/>frantech-ts · 13,297 paths"]
R1 --- B["Byte-identical manifests<br/>0 POSTs · 0 mints"]
WP-BATCH family recurring
Not a standalone campaign since №12: wp-batch bodies ride inside INFOCREST-KIT / AKAMAI-CONFIG / NIGHTAGENT chains (SQLi via author_exclude UNION SELECT).
UN-MERGED from METADATA-HUNT in №33 per the registered trigger. №34–№35: two consecutive absences since the un-merge — the №34 rule fired, status is standing-paused. Un-pause on a 140.245.x/161.118.x run carrying the ~94-path core.
REGISTERED №33. №34: 105.115.10.78 returned solo (4 markers / 4 mints on ai-devbox-1) — its second run; 23.234.77.64 and the №32 originals absent. Operator ledger: 4 operators / 4 ASNs, every marker suffix fresh per run.
flowchart LR
P["GET /__ss_probe_<32-hex>__<br/>python-requests/2.31.0<br/>guarantees first-seen"] --> E["GET /.env → 200<br/>canary mint"]
E --> END["Run ends<br/>no POST · no fanout"]
CONFIG-SWEEP active
87.120.104.29 (Sino Worldwide NO, Googlebot/2.1 forgery). №33: SECOND mint run — 12 mints inside farm's 2,950-ev 1-minute burst + 6 on control's 1,239-ev census. №34: NO NEW RUN — the window's control rows and 6 mints are the №33 run seen through the 24-h seam.
flowchart LR
B["1-minute census burst<br/>1,600+ paths, 121 families"] --> W["wp-config · app-config ·<br/>aws-credentials paths"]
W --> MINT["/.env mints<br/>18 in-window"]
WP-FORM-BRUTE new
№38 ⚠ NEW: sustained distributed wp-login FORM brute — 11 runners, one per sensor (canary-farm-1, netcup-ts, ru-edge-1, sponge-01-ts), all starting 10:26–10:45 UTC 09-30 and running ~23 h; 5 rotating browser UAs each (Chrome 126/127 mac/win/linux, Firefox 128); 636 wp-login-credentials POSTs with 635 distinct bodies, fixed log=admin, one password per POST, testcookie + _wpnonce form tokens; redirect_to names the fleet vhost (sso.rightabouteverything.show on farm). Distinct from XMLRPC-BRUTE (system.multicall) and WP-LOGIN-BRUTE (GET probes, identical Chrome/151 UA).
flowchart LR
Q["11 runners · one per sensor<br/>5-UA rotation each"] --> G["GET /wp-login.php probe<br/>harvest nonce + testcookie"]
G --> P["POST log=admin<br/>one password per body · 636"]
P --> R["redirect_to = fleet vhost<br/>~23 h low-and-slow"]
TOKEN-CRAWLER recurring
⟳ /24 45.198.224.x — /c/<100-char token> + .env directory variants, forged Chrome/114, 0 mints. №38: 7 IPs (.230–.233, .237–.239), three synchronized frantech waves 05:28 / 12:59 / 20:02 UTC+4; the bare tarpit-module one-touch pass on the other nodes is the /24's scout shape.
flowchart LR
T["45.198.224.x /24<br/>forged Chrome/114"] --> C["/c/<100-char token> walk<br/>+ .env directory variants"]
C --> Z["0 mints · census only<br/>3 synchronized waves"]
Mint → use sankey — sensor → minted → used-in-AWS / unused (all-time)
Network-layer recon — inbound sweeps on the fleet's public IPs (Arkime); not visible to the HTTP traps
Arkime window 2026-09-30 07:33:00 → 2026-10-01 07:33:37 UTC · 81,402 inbound sessions on 8 fleet public IPs. Identity is the client tool (fingerprint), never the source IP — sweep operators rotate addresses and keep the tool. Last column = source IPs per day.
fingerprint
campaign
sessions
src IPs
networks
countries
ports
src IPs/day
f555226df196…
LIBSSH-MASSSWEEP dispersed sweep (one port, many networks)