Everything Came Back in One Afternoon

THE WILD SIGNALS / EDITION 006

A week of silence on the web decoys ended on a Wednesday afternoon. Within hours every category of probing was active again.

SECTION 01

What the signals mean

Last week we reported that every web-facing probe against the Venus decoys had stopped, leaving only login attempts. This week it started again. The first web request of the period arrived at 13:22 on Wednesday 2 September, and by that evening the decoys had recorded secret hunting, webshell probing, admin console discovery, scanner traffic and database credential attacks. Fifteen dormant campaigns reactivated. Seven categories that recorded zero last week recorded 15,340 events between them in four and a half days.

The headline total is 108,026 events, six times last week’s 18,019. Most of that increase is not attacker behaviour. A Windows file-sharing decoy joined the estate on 4 September and produced 47,426 events in under three days, and the platform has withheld every comparison touching it. Ignoring the counts on that surface, the week’s activity from everything else was 60,600 events, roughly three times last week. The web probes returned with a vengeance. 

Same targets as before, plus one new one

The files being hunted were the familiar ones: environment files, Git configuration, admin dashboards. There was one addition. 228 requests from 14 sources went looking for Terraform state files, in five different folder locations. A Terraform state file describes an organisation’s cloud infrastructure and frequently contains the credentials used to build it. It has been added to at least one scanning list.

The Windows decoy heard something on day one

The new file-sharing decoy recorded 47,426 access probes from 793 sources, and 41,905 credential attempts from just 13 of them. Thirteen addresses producing that many attempts indicates a few tools running long password lists against a service found on most corporate networks. Medulus recorded, in the same week, an update to a widely used exploitation module for Windows accounts that have a blank or default password, a weakness catalogued in 1999. The tooling dates from 1999 and is still being maintained.

The vulnerability feed pointed at the systems that grant access

Forty-three vulnerabilities qualified as more important during the week. Twelve were added to the CISA catalogue of flaws known to be exploited. As last week, most of the relevant ones sit in systems that hand out access to other systems.

Three more exploited-list additions were tools used to build AI applications: Kestra, LiteLLM and Starlette. Each allowed an unauthenticated caller past a check that was supposed to stop them. These are recent products, often deployed by teams outside the security function’s view, and they are now scanned for in the same way as a WordPress install.

What organisations should ask this week

Across six editions the volume has swung widely and the list has barely changed. The same files, consoles and password fields are requested each week, the scanners pause and resume, and each return adds an entry or two. The defensive question does not depend on the count.

108,026 External events. 2,427 Distinct sources. 60,600 Events excl. Windows. +92.9% Distinct sources. 22 Active campaigns.

Against Edition 005’s published figures, events rose from 18,019 to 108,026 and distinct sources from 1,258 to 2,427; 1,900 sources, 78.3%, were first observed here. The event comparison is not published as a percentage: the Windows feed was present in 110 of 338 batches, 32.54%, first appearing on 4 September, and the Shell feed in 334 of 338, so neither surface is comparable across periods. With Windows removed, the remaining surfaces recorded 60,600 events against 18,019. Active campaigns rose from 3 to 22: 18 recurring, 15 reactivated, 4 first observed. The taxonomy covered 79.04% of external events, against 100.00% last week; 22,471 events, 20.80%, carried no behavioural tag.

Ranked population: thirteen of thirteen active

Rank 8, SQL Injection Probing, recorded one event from one source and is omitted from the table. Change factors are withheld for the three SSH and two SMB signals, both periods, because a feed each depends on was declared in fewer than every batch; their change is unavailable, not zero, and they are ranked on renormalised remaining factors. The seven web-surface signals carry a saturated change factor of 1.0000 because their comparison-period count was zero. Potential consequence is 0.0000 for every credential-attack category by construction of the mapping.

Path families

The Windows surface

SMB Access Probing recorded 47,426 events from 793 sources across 1,188 sessions, and SMB Credential Attack 41,905 events from 13 sources across 31 sessions. Every event on the surface falls between 4 September 18:02 IST and the period’s close. The credential figure is 3,223 events per source, against 60 per source for access probing. The two populations barely overlap; the credential attack comes from a few tools working long lists. Persistence on the credential signal is 23.08%, the highest of the thirteen, over a window of under three days. Edition 005 has no figure for either signal.

Cadence, by signal

The agentic share (cadences are calculated by a built-in behavioural analysis, not verified) on webshell probing, 15.66% of 83 classified sessions, is the highest recorded for any signal in six editions; Edition 005’s top signal carried none. The base is small, and 38 of the 114 sessions exceeded the 200-event classification cap, so their cadence describes a prefix. Unclassified sessions across the period number 2,001 of 3,769, 53.09%, which is the classifier’s insufficient-data return for fewer than three events and not an observed style.

Behaviour progression

239 of the period’s 3,769 sessions carried behaviour from two or more stages, against 121 of 1,832 in Edition 005. 183 ordered discovery before exploitation and 56 ran in reverse. 38,129 events, 35.30%, carried a behaviour the ladder recognises; the SMB population falls largely outside it.

The forward ordering is more widely distributed than last week: 94 sources against 25, and the busiest source’s share fell from 48.84% to 26.78%. One source still accounts for a quarter of it. The remaining three quarters, spread across 93 sources, is consistent with independent tools each working a list. The source report’s alternative explanation still applies: most tooling requests what-exists paths before payload paths, which produces this ordering without any decision being taken.

Vulnerability mapping

15 of the mapping’s 17 identifiers were reached this period, against none in Edition 005. Confirmed-tier observations: CWE-312 cleartext storage, 7,179 hits from 69 sources; CVE-2021-41773 Apache traversal, 3,343 from 97, KEV-listed; CVE-2019-0232 Tomcat CGI, 3,336 from 95; CWE-527 exposed Git, 1,145 from 58. Probable tier: CVE-2017-9841 PHPUnit, 241 hits; CVE-2022-22963 Spring Cloud Function, 36 hits from 20 sources; CVE-2012-1823 PHP-CGI, 30 hits. Possible tier includes CVE-2022-22965 Spring4Shell, CVE-2021-42013 and CVE-2021-44228 Log4Shell at 3 hits from a single source. The tier grades observation breadth only. Detection is inference from request path and behavioural tag, never observed exploitation.

Medulus correlation

43 vulnerabilities qualified as more important during the period. Medulus reports its NVD feed as failed for the period, with 41 of 51 runs succeeding, so descriptions and scores below are as held at the last successful load. Four of them correlate with what the decoys observed.

Windows credential attack tooling. The Metasploit module exploit/windows/smb/psexec changed on 31 August. It targets CVE-1999-0504, a Windows account with a blank, default or missing password, and is the standard follow-on to a successful SMB credential guess. The decoy estate’s SMB Credential Attack signal began four days later.

Remote-access appliances exploited in the wild. SonicWall SMA1000 CVE-2026-83548, a pre-authentication SSRF in the Work Place interface, CVSS 10.0, and CVE-2026-83549, post-authentication OS command injection in the management console, were both added to KEV on 2 September with a three-day remediation deadline. Rapid7 published an emergent-threat advisory confirming exploitation in the wild. SimpleHelp CVE-2026-48558, an OIDC authentication bypass, gained a Metasploit module ranked Excellent.

Administrative access without credentials. JFrog Artifactory CVE-2026-82329 allows an unauthenticated network attacker to obtain administrative privileges under default configuration, KEV-listed 2 September. PaperCut NG/MF CVE-2026-81578 and CVE-2026-82078 were KEV-listed on 31 August with a shared Metasploit module. Sangoma Switchvox CVE-2026-9586, unauthenticated SQL injection, KEV-listed the same day.

AI application tooling. Kestra CVE-2026-49869, an authentication filter bypass via path suffix, CVSS 10.0; LiteLLM CVE-2026-59822, fabricated authorisation accepted on the MCP endpoint; Starlette CVE-2026-48710, unvalidated Host header, EPSS percentile 0.98; all KEV-listed 2 September. Outside KEV but with public exploit code this week: Langflow CVE-2026-9198 and CVE-2026-5027, Marimo CVE-2026-39987, Metabase CVE-2026-59827 and MCPJam Inspector CVE-2026-23744, each unauthenticated or near-unauthenticated remote code execution.

Technical checks for the week

Venus records activity reaching Elytra-operated decoy observation infrastructure. Medulus provides public vulnerability and threat-intelligence context. An observed request establishes an attempt, not a successful compromise. Week-on-week comparisons are drawn from the figures published in Edition 005. Session-keyed figures are not external-only; every event-keyed figure is. The ranking constants remain provisional pending a complete uninterrupted baseline week; two feeds had reduced coverage this period.