THE WILD SIGNALS / EDITION 008
The RDP cluster we flagged last week is four times the size it was. Credential attacks against file shares moved with it.
SECTION 01
What the signals mean
Last week the decoys traced 2,015 remote desktop sessions to ninety-nine addresses sharing one TLS fingerprint, 73ede1f461b6. This week the same fingerprint produced 7,940 sessions from 408 addresses. The tool did not change. The number of places it ran from went up fourfold.
External events reached 708,299 against last week’s 573,903, up 23.4%. Distinct addresses reached 5,799, up 5.9%, and 4,142 of them, 71.4%, were seen for the first time. Active campaigns rose from 126 to 176, up 39.7%, well short of how fast the address count moved. Addresses cost the least of anything to multiply.
Credential attacks against file shares moved the most
SMB credential attack rose to 206,601 events from 129,854, up 59.2%, from a narrow set of 68 addresses across 43 networks. SMB access probing, the broader knock-on-every-door version of the same surface, rose to 223,955 from 151,582, up 47.7%, from 2,438 addresses. One is a small number of sources trying hard against specific accounts. The other is a very large number trying once each and moving on.
Dev-server exposure reached public reporting
Two items published this week describe attackers using Vite and Nuxt’s own file-serving design to reach cloud credentials behind development servers, the same exposure this publication has logged for three editions running. Our own traversal count fell slightly, 564 events against 709, even as public reporting on the technique broadened. Our decoys sample the activity rather than record all of it.
Where the fingerprint went
Fingerprint 73ede1f461b6 is a property of the client software, not of whoever is running it: it records how the program builds its encrypted connection, and every copy of the same build produces the same value. Last week ninety-nine addresses carried it. This week 408 did, and the session count behind it grew from 2,015 to 7,940. Whether one operator controls all 408 addresses or several unrelated actors are running the same publicly available tool, the fingerprint cannot say. It says only that this is one build, not 408 different ones.
New and returning addresses moved the same way they have all publication. 4,142 of this week’s 5,799 addresses, 71.4%, were seen for the first time; 785 campaigns were newly observed against 176 active in total. A population that turns over this fast gives address-based blocking very little to hold onto, while the tooling behind it, judged by fingerprint, stays exactly the same from one week to the next.
Where the direct requests landed
Requests for exposed secrets and configuration, the .env and .git/config family, rose to 21,209 from 16,514, up 28.4%, across 1,199 distinct paths. /.env alone drew 419 requests and /.git/config drew 402. Requests for webshell locations rose to 5,642 from 4,359, up 29.4%. Both families have widened for three straight editions.
14 Sep – 20 Sep 2026
14 Sep – 20 Sep 2026
708,299 External events. 5,799 Distinct sources. +5.9% Sources, week on week. 176 Active campaigns. 408 RDP cluster sources.
Against Edition 007’s published figures, events rose from 573,903 to 708,299 and sources from 5,477 to 5,799. Sessions rose from 11,283 to 17,694, up 56.8%. Collection this period was complete with reduced coverage on 1 of 14 feeds, Shell at 96.73%, against 3 of 14 the period before, so this week’s collection is the more complete of the two being compared. The taxonomy reached 40.58% of external events, 287,461 of 708,299, against 35.39% last week.
The fingerprint cluster, in full
Two campaign rows carry fingerprint 73ede1f461b6, one classified as a coordinated operation and one as a tool population. Both cover 7,940 sessions from 408 addresses this period, against 2,015 sessions from 99 addresses the period before: a rise of 294.0% in sessions and 312.1% in addresses. Neither is flagged recurring, and both existed under the same fingerprint last period. A JA3 fingerprint records how the client software constructs its TLS handshake, a property of the build and not of the operator running it. Session counts here are not restricted to external activity.
Ranked signals
| Rank | Signal | Events | Ed. 007 | Change | Sources | Score |
|---|---|---|---|---|---|---|
| 1 | Webshell / RCE Script Probing | 5,642 | 4,359 | +29.4% | 187 | 0.4451 |
| 2 | Sensitive File & Secret Exposure | 21,209 | 16,514 | +28.4% | 202 | 0.3648 |
| 3 | PHP Injection / Remote Include | 54 | 85 | −36.5% | 13 | 0.3609 |
| 4 | SMB Credential Attack | 206,601 | 129,854 | +59.2% | 68 | 0.2889 |
| 5 | Automated Scanner / Recon Tooling | 817 | 1,219 | −33.0% | 115 | 0.2876 |
| 6 | SQL Injection Probing | 1 | 0 | returned | 1 | 0.2750 |
| 7 | MySQL Credential Attack | 2,516 | 2,921 | −13.9% | 88 | 0.2539 |
| 8 | SMB Access Probing | 223,955 | 151,582 | +47.7% | 2,438 | 0.2344 |
| 9 | Admin Console Discovery | 1,468 | 1,267 | +15.9% | 127 | 0.1855 |
| 10 | Directory / Path Traversal | 564 | 709 | −20.5% | 18 | 0.1553 |
| 11 | SSH Invalid-User Enumeration | 32,200 | 25,529 | +26.1% | 401 | 0.1401 |
| 12 | SSH Campaign Targeting | 3,122 | 2,236 | +39.6% | 249 | 0.1148 |
| 13 | SSH Access Probing | 33,223 | 26,611 | +24.9% | 842 | 0.1101 |
Change is computed against Edition 007’s published counts, not the platform’s own comparison column: this week that column disagreed with last week’s published webshell figure by eleven events. SQL Injection Probing had no events in Edition 007 and one this period, so a ratio is not meaningful. MySQL and SMB Credential Attack carry the period’s highest persistence and recurrence; both score zero on potential consequence because the mapping has no rule for credential attacks.
Path families
| Family | Events | Ed. 007 | Change | Paths | Sources | Most requested |
|---|---|---|---|---|---|---|
| Sensitive File & Secret Exposure | 21,209 | 16,514 | +28.4% | 1,199 | 202 | /.env (419) · /.git/config (402) |
| Webshell / RCE Script Probing | 5,642 | 4,359 | +29.4% | 1,016 | 187 | /index.php (246) · /blog/index.php (192) |
| Admin Console Discovery | 1,468 | 1,267 | +15.9% | 285 | 127 | /dashboard (181) · /admin (152) |
| Directory / Path Traversal | 564 | 709 | −20.5% | 70 | 18 | /media../.git/config (49) · /static../.git/config (49) |
| Backup & Archive Download Probing | 83 | 389 | −78.7% | 17 | 24 | /terraform.tfstate (28) · /.terraform/terraform.tfstate (17) |
| SQL Injection Probing | 1 | 0 | returned | 1 | 1 | /Sistema-Clinico–com-Laravel-master/.env (1) |
Backup and archive requests fell furthest of any family, a decline now running two editions straight. Traversal fell too; the other three sensitive-path families widened again.
Behaviour progression
63,821 external events, 9.01%, carried a behaviour the stage ladder recognises. 2,448 of 17,694 sessions carried at least one, and 346 carried two or more distinct stages.
| Ordering | Sessions | Ed. 007 | Sources | Busiest source | Evasive |
|---|---|---|---|---|---|
| Discovery, then Exploitation | 280 | 289 | 159 | 26 (9.29%) | 3.14% |
| Exploitation, then Discovery | 66 | 66 | 56 | 4 (6.06%) | 27.27% |
Concentration in the forward ordering keeps falling: one source held 48.84% of it in Edition 005, 26.78% in Edition 006, 15.57% in Edition 007 and 9.29% here, spread now across 159 sources. The reverse ordering, which runs down the ladder rather than up, holds steady at 66 sessions and its evasive share rose to 27.27% from 22.73%. That ordering is consistent with one tool issuing credential attempts before enumeration, and equally consistent with a genuine escalation.
Source profiles
793 of 5,799 external addresses, 13.67%, carry no score and were excluded from the ranking, against 896 of 5,477, 16.36%, last period. Tool signatures were present on 182 of 17,694 sessions, 1.03%. Cadence was unclassified on 9,224 sessions, 52.13%, the classifier’s insufficient-data return for fewer than three events; 456 sessions exceeded the 200-event cap and their published cadence describes a prefix.
Vulnerability mapping
14 of the mapping’s 17 identifiers were reached, against 13 in Edition 007. CWE-312 cleartext storage led at 18,540 hits from 130 sources, up 33.9% from 13,848. CVE-2021-41773 Apache traversal reached 5,657 from 189 sources, up 29.1%, and CVE-2019-0232 Tomcat CGI 5,642 from 187, up 29.4%. CWE-527 exposed Git rose sharply to 1,929 from 730, up 164.2%. CVE-2017-9841 PHPUnit fell to 348 from 445, down 21.8%. Newly reached this period: CVE-2012-1823 PHP-CGI argument injection, CVE-2022-22963 Spring Cloud Function, CVE-2021-42013 Apache double-encoded traversal, CWE-22 path traversal, CVE-2022-22965 Spring4Shell, and CWE-89 SQL injection, all at single-digit to low double-digit hit counts. Six of the fourteen reached identifiers are on the Known Exploited Vulnerabilities catalogue.
Medulus correlation
17 vulnerabilities qualified this period, against 384 in Edition 007. The correlation logic withdrew one of its qualification signals this period, new malware or actor association, after it was matching on name collisions rather than genuine links; that withdrawal accounts for most of the drop and is not a fall in what actually changed.
Identity and email infrastructure. Cisco Identity Services Engine CVE-2026-76460, an API authentication bypass carrying the maximum CVSS score of 10.0, was added to the KEV catalogue on 16 September 2026. Cisco Secure Email Gateway CVE-2026-76461 lets an unauthenticated attacker run arbitrary commands as root through crafted email parsing; KEV-listed 14 September. Both are Cisco, the second consecutive edition in which a Cisco product has reached the catalogue.
Kernel and platform. Three Linux kernel fixes were added to KEV inside four days: a TLS zero-length record handling flaw, a netfilter bridge ARP-rewrite write issue, and a crypto socket concurrent-write flaw. Google Pixel’s cellular modem carries a proximity privilege-escalation flaw needing no user interaction, KEV-listed 16 September.
Backup tooling and continuing exposure. Acronis Backup’s plugins for cPanel, Plesk and DirectAdmin carry a local privilege escalation from insecure file permissions, KEV-listed 16 September. GitLab’s path traversal flaw, covered last edition, remains active: its EPSS probability climbed from 0.011 to 0.146 this week, now in the 96th percentile.
Technical checks for the week
- Patch: Cisco Identity Services Engine and Secure Email Gateway. Both KEV-listed inside the same week.
- Patch: Acronis Backup plugins for cPanel, Plesk and DirectAdmin, if any control panel runs one.
- Apply: The three Linux kernel fixes for TLS, netfilter and crypto socket handling, on any affected kernel.
- Restrict: SMB shares from the open internet. Both SMB signals rose sharply again this week.
- Watch: Vite and Nuxt development servers reachable from the open internet. Public reporting on this exposure broadened this week.
- Assume: GitLab’s path traversal flaw is already being probed. Its EPSS score has climbed for two consecutive weeks.
Venus records activity reaching Elytra-operated decoy observation infrastructure. Medulus provides public vulnerability and threat-intelligence context. An observed request establishes an attempt, not a successful compromise. Week-on-week comparisons throughout this edition are drawn from Edition 007’s published figures, not from the platform’s own comparison column. Session-keyed figures are not external-only; every event-keyed figure is.