Ninety-Nine Addresses, One Fingerprint

THE WILD SIGNALS / EDITION 007

Ninety-nine addresses arrived on Wednesday morning running one build of one tool.

SECTION 01

What the signals mean

At 03:39 on Wednesday 9 September the Venus decoys began recording remote desktop connections carrying an identical TLS fingerprint. By the close of the week 2,015 sessions from 99 addresses had presented it. A TLS fingerprint records how a program constructs an encrypted connection, a property of the software and not of whoever launched it. One fingerprint across 99 addresses therefore describes a single build, deployed ninety-nine times over.

Blocklists count addresses. The decoys recorded 5,477 of them this week against 2,427 last, with 4,368 seen for the first time. Within the RDP cluster that inventory runs a hundred entries deep and describes one program. Address supply is cheap to replenish, and a control built on rotating entries off a list is spending effort against the cheapest thing the other side owns.

Most of the headline number is a new decoy

Total events reached 573,903, more than five times last week. The Windows file-sharing decoy accounts for 502,786 of that, and it was collecting for three days of the comparison period against seven of this one. Everything else rose 17.4%. Volume in this publication will stay unreliable as a measure while the decoy estate keeps growing.

Traversal aimed at one file

Requests using directory traversal rose to 709 from 246. Of the seventy distinct traversal paths recorded, the most frequent were /@fs/../.env, /files../.env and /_nuxt/../.env. Those prefixes belong to JavaScript development servers, which serve files from outside the document root by design. Somebody has turned that design into a route to the environment file, and ordinary paths would not have produced it.

Direct requests for the same class of file reached 16,514 across 917 distinct paths from 221 addresses. Terraform state files were requested again, thirty-two times for the root path alone.

The population turns over faster than it grows

Of the 5,477 addresses recorded, 4,368 were seen for the first time and 1,109 had appeared before. Campaign counts moved the same way: 126 were active against 22 last week, of which 92 were first observed here and 46 resumed after a dormant spell. A population that replaces four fifths of itself each week leaves reputation data very little to work with, while the tooling behind it stays recognisable from one week to the next.

Databases drew the most concentrated attention

MySQL login attempts rose to 2,921 from 647, the sharpest movement of any signal the platform could compare. Eighty-six addresses across twenty-eight networks produced it, with 78% of classified sessions running fully automated. In the same week Medulus recorded a Metabase flaw permitting an unauthenticated attacker to inject SQL through the password reset endpoint and obtain administrator access to whatever database sits behind it.

The Cisco entry moved furthest. An unauthenticated attacker can bypass authentication on the firewall management interface and run script files. A working exploit module was published during the week and the forecast probability of exploitation more than doubled. Artifactory has now appeared in three consecutive editions.

Where to look this week

Development server routes are the new exposure. Anything serving /@fs/ or /_nuxt/ from a public address is a build tool that was never meant to face the internet, and the requests reaching ours were aimed squarely at the credentials behind it.

The fourteen catalogue additions all patch products sitting between an organisation and its own network. Firewall managers, VPN gateways, remote support tooling and artefact repositories fail in one direction, and whoever reaches them inherits the access they were holding.

Blocking the RDP cluster address by address would have taken ninety-nine separate actions and cost its operator an afternoon of reallocation.

573,903 External events. 71,117 Excl. Windows. 5,477 Distinct sources. +125.7% Distinct sources. 126 Active campaigns.

Against Edition 006’s published figures, events rose from 108,026 to 573,903 and distinct sources from 2,427 to 5,477. 4,368 sources, 79.75%, were first observed in this period. The Windows surface carried 502,786 of the events against 47,426, but its feed was declared in 110 of 338 batches in the comparison period and in every batch of this one, so the +960.1% the platform prints for that surface is a restoration of collection. Excluding it, 71,117 against 60,600, a rise of 17.4%. Collection this period was complete with reduced source coverage on 3 of 14 feeds, Web at 57.31% and Shell at 97.61%; parse errors numbered 13,546 against 639.

Active campaigns rose from 22 to 126, of which 92 were first observed in this period, 58 carry a recurring flag and 46 resumed from a prior non-active status. 261 status transitions were recorded across 106 campaigns. Active is defined by session membership rather than span overlap, so the count does not move when the spans are recomputed on a later day; the two largest entries are the SMB access sweep at 4,309 sessions from 2,648 sources and the RDP fingerprint pair at 2,015 sessions from 99. Session-keyed counts here are not restricted to external activity.

Signal grain covered a third of the evidence

The taxonomy reached 35.39% of external events, 203,101 of 573,903, against 79.04% in Edition 006. Uncategorised events numbered 370,444; events carrying no behavioural tag at all numbered 27,866, 4.86%. The gap between the two is the Windows population, whose tags fall outside the category ladder. Twelve of the thirteen signals recorded activity; SQL Injection Probing recorded none against one event last week.

Change is computed here against Edition 006’s published counts. The platform withholds a change factor for nine of the twelve, each resting on a feed declared in fewer than every batch of one or both periods, and ranks those on renormalised remaining factors; the score column reflects that, the change column does not. MySQL Credential Attack ranks first on a saturated change factor of 1.0000 combined with the period’s highest persistence, 24.42%, over 86 sources and 28 networks; its potential consequence is 0.0000 because the mapping carries no rule for credential attacks. PHP Injection ranks second on consequence alone, 1.0000, over 85 events from 19 sources.

* The two SMB figures compare a seven-day collection against three days and overstate the movement.

The RDP fingerprint cluster

Two campaign rows carry the same TLS fingerprint prefix, 73ede1f461b6, one classified as a coordinated operation and one as a tool population. Both cover 2,015 sessions from 99 sources, first session 9 September 03:39 IST, last 13 September 23:58 IST. Neither is flagged recurring and neither appears before this period. A JA3 fingerprint is a property of the client software’s TLS handshake construction, so a shared value establishes a shared build rather than a shared operator; ninety-nine addresses running one build is the observation, and whether one party controls all ninety-nine is not established by the fingerprint.

Path families

All five of the highest traversal paths terminate at an environment file, and three prefixes belong to JavaScript development servers: /@fs/ is Vite’s filesystem escape route and /_nuxt/ is Nuxt’s build asset root. Both serve files from outside the document root by design. Admin Console Discovery was the only family to fall.

Behaviour progression

51,877 external events, 9.04%, carried a behaviour the stage ladder recognises, against 35.30% in Edition 006; the Windows population falls almost entirely outside it. 2,340 of 11,283 sessions carried at least one recognised behaviour and 355 carried two or more distinct stages.

Concentration in the forward ordering continues to fall: one source held 48.84% of it in Edition 005, 26.78% in Edition 006 and 15.57% here, across 158 sources. The reverse ordering carries an evasive share of 22.73% against 1.10% for the forward ordering, and all 66 of its sessions were classified. Sessions are correlated by source address and an idle gap, so an address running two unrelated tools inside that gap merges into one session; an evasive classification and a descending ladder together are equally consistent with a single tool issuing credential attempts before enumeration.

Source profiles

896 of the 5,477 external addresses, 16.36%, carry no score and were excluded from the ranking; the scoring statement joins a tag-exploded selection, so an actor whose every event is untagged is never scored and a stored zero means never measured. Tool signatures were present on 156 of 11,283 sessions, 1.38%.

Automation dominates every signal the classifier reached, reversing Edition 005 where the top signal ran 11.87% fully automated. Cadence was unclassified on 5,956 sessions, 52.79%, the insufficient-data return for fewer than three events; 256 sessions exceeded the 200-event cap and their cadence describes a prefix.

Vulnerability mapping

13 of the mapping’s 17 identifiers were reached, against 15 in Edition 006. CWE-312 cleartext storage led at 13,848 hits from 139 sources, against 7,179. CVE-2021-41773 Apache traversal reached 4,383 from 211 sources and CVE-2019-0232 Tomcat CGI 4,359 from 210, both confirmed tier. CWE-527 exposed Git fell to 730 from 1,145, the only mapped identifier to decline. CVE-2017-9841 PHPUnit rose to 445 from 241. Newly reached this period: CVE-2023-2982 WordPress social-login bypass at 49 hits from 27 sources, and two Apache Solr identifiers, CVE-2017-12629 and CVE-2021-27905, at 10 hits each from 5 sources. Detection is inference from request path and behavioural tag, never observed exploitation. The observation tier grades breadth only.

Medulus correlation

384 vulnerabilities qualified during the period, against 43 in Edition 006. Two qualification signals could not be evaluated this period. Fourteen entries were added to the CISA Known Exploited Vulnerabilities catalogue between 8 and 11 September.

Security management planes. Cisco Secure FMC and SCC Firewall Management CVE-2026-20079 permits an unauthenticated remote attacker to bypass authentication and execute script files; KEV-listed 9 September, Metasploit module exploit/linux/http/cisco_fmc_auth_bypass_rce changed, EPSS probability rose from 0.359 to 0.758. Cisco Secure FMC CVE-2026-20316, static-credential login at low privilege, carries recorded ransomware use. Citrix NetScaler ADC and Gateway CVE-2026-19490 KEV-listed 9 September; Fortinet FortiOS CVE-2025-25249, heap overflow, 9 September, ransomware use recorded.

Remote access and edge devices. MikroTik RouterOS qualified twice: CVE-2026-86060, an argument-handling flaw in the SSH login path, and CVE-2026-67277, which accepts a related btest connection before the primary session authenticates. Both KEV-listed 10 September. N-able N-central CVE-2026-86218, pre-authentication remote code execution, 8 September. ConnectWise ScreenConnect CVE-2026-84869, file transfer and execution through an active session without host confirmation, 11 September.

Software supply chain. JFrog Artifactory qualified twice and reaches a third consecutive edition: CVE-2026-42016, privilege escalation from validating a token’s signature and issuer without its scope, and CVE-2026-42018, an internal anonymous-user token returned to an unauthenticated caller while anonymous access is disabled. Both KEV-listed 11 September. GitLab CE and EE CVE-2026-85706 permits unauthenticated access under certain conditions, 11 September. Adobe Commerce and Magento CVE-2026-75650, template-engine code execution, 8 September.

Database access without credentials. Metabase CVE-2026-72898 permits an unauthenticated remote attacker to inject SQL through the /reset_password endpoint and gain administrator access to the connected instance. MySQL credential attack was the decoy estate’s top-ranked signal this period.

Technical checks for the week

• Expose: No Vite, Nuxt or comparable development server reachable from a public address, and no production deployment serving /@fs/ or /_nuxt/.
• Patch: Cisco Secure FMC, Citrix NetScaler, Fortinet FortiOS, MikroTik RouterOS, N-able N-central, ConnectWise ScreenConnect. All six KEV-listed inside four days.
• Rotate: JFrog Artifactory to 7.133.11 or later, and audit every token issued while the earlier scope validation was in place.
• Restrict: MySQL and Metabase to known network locations. Neither should accept connections from the open internet.
• Reconsider: Address-based blocking as a control. Ninety-nine of this period’s addresses shared one client fingerprint.
• Qualify: Where a change rests on unequal collection, carry the collection caveat with the figure downstream.

Venus records activity reaching Elytra-operated decoy observation infrastructure. Medulus provides public vulnerability and threat-intelligence context. An observed request establishes an attempt, not a successful compromise. Week-on-week comparisons are drawn from the figures published in Edition 006. Session-keyed figures are not external-only; every event-keyed figure is. The ranking constants remain provisional pending a complete uninterrupted baseline week.