When the Blueprint Is the Leak

THE WILD SIGNALS / EDITION 009

Requests for infrastructure state files, site backups and configuration endpoints rose sharply on the web decoys.

SECTION 01

What the signals mean

Web activity against the Venus decoys rose 43.0% this week, to 53,049 events from 37,090, and the fastest growth came in requests for files that describe how a system is built.

Requests for backup and archive files rose to 839 from 83. The most requested file in that group was terraform.tfstate, 96 times against 28 last edition. Terraform builds cloud infrastructure, and its state file records every server, database and network it has created, often with the passwords and access keys used to create them. Zipped copies of whole sites under names such as backup.zip and site.zip were next.

Environment files now come in variants

/.env, the conventional file for an application’s passwords and keys, drew 730 requests. Three of the next four most requested paths were its local, production and development variants: .env.local 420 times, .env.production 325 and .env.development 284. A check for the original filename alone misses most of these requests.

Spring Boot configuration endpoints

Requests for admin and management consoles nearly doubled, to 2,912 from 1,468. Among the most requested were /actuator/configprops and /actuator/env, endpoints built into the Spring Boot Java framework that return a running application’s configuration, sometimes including database connection details.

Traversal from 27 addresses

Directory traversal requests, which step outside a website’s public folder to read the files behind it, rose to 1,773 from 564, all from 27 addresses. Each of the five most frequent paths ended at an environment file. The most frequent, /@fs/../.env, uses the Vite development server route recorded here for four editions.

MySQL login attempts fell

Login attempts against the MySQL decoys fell 39.0%, to 1,535 from 2,516. Of the 87 sources, 64 had also appeared the week before, the highest return rate of any signal.

The fingerprint cluster shrank to 90 addresses

The remote desktop tool identified by fingerprint 73ede1f461b6 ran from 90 addresses this week and produced 2,297 sessions. In Edition 008 it ran from 408 addresses across 7,940 sessions, and in Edition 007 from 99. Over the three weeks the software did not change.

Two other remote desktop client signatures ran alongside it: a second TLS fingerprint across 77 addresses and a connection cookie reading “hello” across 89. Address blocking would have reached none of the three tools.

Twelve additions to the exploited catalogue

Between 21 and 27 September twelve vulnerabilities joined the catalogue of flaws confirmed as exploited in the wild. Eight are in products that manage or front a network: Check Point’s management server and its VPN gateway, F5 BIG-IP, Arista VeloCloud, Zyxel switches, MikroTik routers and two separate Citrix NetScaler flaws. Four are in applications: WSO2, Adobe Commerce, Microsoft SharePoint and WordPress. The GitLab file-read flaw from last edition now has a public exploit tool, and its forecast probability of exploitation rose from 0.146 to 0.914.

Most senders were new

The decoys recorded 6,860 distinct addresses, up 18.3% from 5,799. Of these, 4,883 had never been seen before this week.

File-share password guessing kept climbing

Password attempts against Windows file-sharing decoys rose 28.5%, to 265,530 from 206,601. Only 72 addresses produced them, an average of more than 3,600 attempts each. The wider sweep that checks whether file sharing answers at all came from 2,432 addresses and rose 26.1%.

Where to look this week

Terraform state, site archives and every environment-file variant belong outside any path a web server can reach. Spring Boot actuator endpoints should answer on internal addresses only. Remediation for the two Citrix flaws is due 30 September.

866,411 External events. +22.3% Events, week on week. 6,860 Distinct sources. +18.3% Sources, week on week. 184 Active campaigns.

Against Edition 008’s published figures, events rose from 708,299 to 866,411, sources from 5,799 to 6,860 and sessions from 17,694 to 18,230, up 3.0%. Active campaigns rose to 184 from 176, up 4.5%, with 89 flagged recurring. By surface, Web rose 43.0% to 53,049, Windows 22.3% to 760,116, Shell 6.5% to 35,370, and Database fell 33.8% to 1,875. Auth, API, Portal and VPN together reached 16,001 against 13,401, up 19.4%.

Ranked signals

Rank	Signal	Events	Ed. 008	Change	Sources	Score
1	PHP Injection / Remote Include	166	54	+207.4%	21	0.5780
2	Directory / Path Traversal	1,773	564	+214.4%	27	0.4311
3	MySQL Credential Attack	1,535	2,516	−39.0%	87	0.3508
4	Webshell / RCE Script Probing	6,682	5,642	+18.4%	201	0.3451
5	Sensitive File & Secret Exposure	27,901	21,209	+31.6%	208	0.3319
6	Admin Console Discovery	2,912	1,468	+98.4%	130	0.3052
7	Automated Scanner / Recon Tooling	984	817	+20.4%	104	0.2378
8	SMB Credential Attack	265,530	206,601	+28.5%	72	0.2352
9	SMB Access Probing	282,365	223,955	+26.1%	2,432	0.1859
10	SSH Invalid-User Enumeration	34,156	32,200	+6.1%	863	0.1777
11	SSH Access Probing	35,370	33,223	+6.5%	1,314	0.1534
12	SSH Campaign Targeting	4,544	3,122	+45.5%	579	0.1480
–	SQL Injection Probing	0	1	none	0	–

Change is computed against Edition 008’s published counts. PHP Injection ranks first on the period’s highest consequence and one of its sharpest rises, with every classified session fully automated.

Remote desktop fingerprint campaigns

Client signature	Sessions	Sources	Ed. 008 sessions	Ed. 008 sources
TLS 73ede1f461b6	2,297	90	7,940	408
RDP cookie “hello”	441	89	not published	not published
TLS 43e25370946f	415	77	not published	not published

For 73ede1f461b6, sessions fell 71.1% and sources 77.9%. Source counts cannot be added across the three signatures because one address may carry more than one.

Windows file sharing

Signal	Events	Ed. 008	Change	Sources	Events per source
SMB Credential Attack	265,530	206,601	+28.5%	72	3,688
SMB Access Probing	282,365	223,955	+26.1%	2,432	116

Path families

Family	Events	Ed. 008	Change	Paths	Sources	Most requested
Sensitive File & Secret Exposure	27,901	21,209	+31.6%	2,753	208	/.env (730) · /.env.local (420)
Backup & Archive Download Probing	839	83	+910.8%	179	37	/terraform.tfstate (96) · /.terraform/terraform.tfstate (51)
Webshell / RCE Script Probing	6,682	5,642	+18.4%	1,531	201	/index.php (289) · /phpinfo.php (154)
Admin Console Discovery	2,912	1,468	+98.4%	717	130	/admin/.env (118) · /actuator/configprops (106)
Directory / Path Traversal	1,773	564	+214.4%	322	27	/@fs/../.env (70) · /static../.env (47)
SQL Injection Probing	0	1	none	0	0	–

Distinct paths rose faster than events in every web family: sensitive-file paths to 2,753 from 1,199, admin paths to 717 from 285 and traversal paths to 322 from 70. The wordlists behind the requests grew longer. Traversal remains narrow at 27 sources, with 41 of its 62 sessions exceeding 200 events. Backup and archive requests rose after two editions of decline. The root and nested Terraform state paths together drew 147 requests against 45 in Edition 008.

Representative paths

Secrets and configuration	Events	Backup and archive	Events
/.env	730	/terraform.tfstate	96
/.env.local	420	/.terraform/terraform.tfstate	51
/.git/config	363	/backup.zip	40
/.env.production	325	/backup.tar.gz	39
/.env.development	284	/site.zip	38

/.git/config fell to 363 from 402 while exposed-Git requests rose overall, so those requests spread across more paths.

Medulus correlation

42 vulnerabilities qualified this period, against 17 in Edition 008, with the actor and advisory association signal still withdrawn. Twelve entries were added to the CISA Known Exploited Vulnerabilities catalogue between 21 and 27 September.

Management and gateway products. Check Point Management Server CVE-2026-93616 combines directory traversal with file upload to let an unauthenticated attacker run arbitrary scripts; EPSS 0.197, 97th percentile. Check Point Quantum Security Gateway CVE-2026-85102 fails to validate certificate trust during VPN negotiation, permitting unauthenticated code execution. F5 BIG-IP APM CVE-2026-94127 permits code execution where an access policy and an OAuth profile share a virtual server. Arista VeloCloud Orchestrator CVE-2026-93952 carries CVSS 10.0. All four were KEV-listed 22 September. Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 were published and KEV-listed on 27 September with remediation due 30 September. Zyxel GS1900 switches were KEV-listed 21 September, and MikroTik RouterOS CVE-2026-67279, SSH session access after a client-requested rekey without authentication, on 25 September.

Applications and identity. WSO2 CVE-2026-5430 accepts JSON Web Tokens signed with algorithms outside those configured, CVSS 10.0. Adobe Commerce CVE-2026-71362 was KEV-listed as its EPSS rose from 0.245 to 0.875. WordPress Core CVE-2026-87902 lets an unauthenticated attacker include a readable local PHP file outside the theme directories; PHP remote include was the decoys’ top-ranked signal this period. SharePoint CVE-2026-65660 permits code injection by an authorised attacker.

Continuing from earlier editions. GitLab CVE-2026-85706 gained a Metasploit file-read module and its EPSS rose from 0.146 to 0.914. Cisco Secure FMC CVE-2026-20079 rose from 0.758 to 0.882, and Cisco ISE CVE-2026-76460 from 0.008 to 0.140.

Behaviour progression

403 sessions this period carried behaviour from two or more distinct stages, the minimum for an ordering.

Ordering	Sessions	Ed. 008	Sources	Busiest source	Evasive
Discovery, then Exploitation	303	280	178	22 (7.26%)	3.04%
Exploitation, then Discovery	100	66	86	4 (4.00%)	18.18%

The busiest source’s share of the forward ordering fell for a fifth edition, from 48.84% through 26.78%, 15.57% and 9.29% to 7.26%, across 178 sources. The reverse ordering rose to 100 sessions from 66 after two editions at 66, and its evasive share fell to 18.18% from 27.27%. A descending ordering is consistent with one tool issuing credential attempts before enumeration as much as with any escalation.

Vulnerability mapping

Identifier	Description	Hits	Ed. 008	Change	Sources	KEV
CWE-312	Cleartext secrets (.env)	22,530	18,540	+21.5%	124	no
CVE-2021-41773	Apache traversal	6,702	5,657	+18.5%	206	yes
CVE-2019-0232	Tomcat CGI	6,682	5,642	+18.4%	201	no
CWE-527	Exposed Git	2,580	1,929	+33.7%	128	no
CVE-2017-9841	PHPUnit eval-stdin	615	348	+76.7%	19	yes
CVE-2022-22963	Spring Cloud Function	326	low double digits	–	22	yes
CVE-2021-44228	Log4Shell	2	0	first seen	1	yes

14 of the mapping’s 17 identifiers were reached, the same as Edition 008, and 7 of the 14 are on the KEV catalogue. Edition 008 published Spring Cloud Function only as a low double-digit count, so no ratio is given. Detection is inference from request path and behavioural tag, never observed exploitation.

Technical checks for the week

• Patch: Citrix NetScaler ADC and Gateway for both 27 September flaws. Remediation is due 30 September.
• Patch: Check Point Management Server and Quantum Gateway, F5 BIG-IP APM with OAuth profiles, Arista VeloCloud on-prem.
• Remove: Terraform state, site archives and every .env variant from any path a web server can serve.
• Restrict: Spring Boot /actuator/* endpoints to internal addresses, and patch Spring Cloud Function.
• Verify: WSO2 token validation accepts only the configured signing algorithms. Patch to the fixed release.
• Prioritise: GitLab CE and EE for CVE-2026-85706. A public file-read module now exists.

Venus records activity reaching Elytra-operated decoy observation infrastructure. Medulus provides public vulnerability and threat-intelligence context. An observed request establishes an attempt, not a successful compromise. Week-on-week comparisons are drawn from the figures published in Edition 008.