Who They Ask For

THE WILD SIGNALS / EDITION 005

The web probing stopped entirely. What was left was login attempts, and the accounts they asked for were oddly specific.

SECTION 01

What the signals mean

Most weeks the Venus decoys record a mixture: people rattling web pages, hunting for exposed files, and trying to log in. This week only the third of those happened. Every web-facing category went to zero, from 13,901 events the previous week to none at all, and what remained was 18,019 login attempts against the decoy shell service. Total activity halved. The number of separate visitors halved with it, and the number of active campaigns fell from seventeen to three.

A halving is easy to misread. Collection was near enough complete, with one feed present in 334 of the period’s 335 batches, so the platform withheld its own week-on-week percentages for the surviving signals rather than publish a ratio that might be measuring itself. What can be said without a ratio is that the remaining activity changed character. In every prior edition the sessions that progressed were mostly fully automated. This week, on the biggest signal, fully automated sessions accounted for 11.87% and semi-automated ones for 52.82%, with a further 24.04% showing enough irregularity to be classed as operator-associated. Fewer visitors, and the ones who stayed behaved a good deal less like unattended scripts.

The wordlist gives the game away

Login attempts are usually treated as background noise, and mostly they are. But a subset of this week’s attempts used a curated list of account names rather than a generic one, and the names on it describe the targets precisely: Solana validators, Ethereum nodes, DevOps service accounts and database service accounts. That is 1,358 attempts from 229 separate sources. Nobody guesses those names by accident.

The two cases call for different responses. Blocking noise is a volume problem, solved with rate limits and patience. Being named on somebody’s list is a different problem: it means the account types you run have been chosen in advance, and the attempts will keep arriving from fresh addresses. Of the sources trying the curated list this week, 123 were new to the platform and 106 had been seen before.

A flaw where the username is the attack

In the same week, Medulus flagged a vulnerability in ProFTPD that turns a login attempt into something worse. Where the software logs usernames into a database, a crafted username can cause the server to run the attacker’s code. The credential is not being guessed at all; the field itself is the delivery mechanism. A login form is not only a lock to be picked. It is an input, and inputs get processed.

Alongside it, a much older item resurfaced: a 2008 flaw in the SSH protocol’s error handling, which qualified this week because publicly available scanning tooling for it changed. Nobody rewrites an eighteen-year-old scanner unless someone is still running it.

What both groups have in common is that they grant access to other systems. A gateway appliance decides who reaches the internal network. A build server can push code to production. A backup manager holds a copy of everything. None of them is where the valuable data sits, and all of them are a shorter route to it than the front door the login attempts were knocking on.

What organisations should ask this week

Five editions in, the volumes have swung by half in both directions and told us very little on their own. The quieter weeks show who is still there once the noise stops.

18,019 External events. 1,258 Distinct sources. −50.5% Event volume. −47.1% Distinct sources. 3 Active campaigns.

Against Edition 004’s published figures, events fell 50.5% from 36,380 and distinct sources 47.1% from 2,377; 813 of this period’s 1,258 sources, 64.6%, were first observed here. Active campaigns fell from 17 to 3, all three flagged recurring, none first observed and none reactivated, against 14 recorded status transitions. By enterprise surface, Shell fell 16.5% to 18,019 while Web, Database, API, Portal, Auth and VPN each recorded zero against last week’s 13,901, 711, 59, 59, 13 and 66. By behaviour category, credential stuffing fell 18.8% to 16,848 and scanner and recon 74.7% to 1,171; webshell upload, path traversal and RCE attempts each recorded zero.

Ranked population: three signals, all Shell

Three of eleven categories recorded activity. Change factors are withheld for all three: the Shell feed was declared in 334 of the period’s 335 batches, 99.70%, so a ratio across the two periods would partly measure collection. The change is unavailable, not zero and not small, and the three are ranked on their remaining factors with weights renormalised across them. Potential consequence is 0.0000 for all three because the mapping carries no rule for credential-attack categories.

Signals that recorded nothing

Seven categories active in Edition 004 recorded no events at all: Webshell / RCE Script Probing (6,999 last week), Sensitive File & Secret Exposure (2,882), Admin Console Discovery (780), MySQL Credential Attack (543), Automated Scanner / Recon Tooling (399), Directory / Path Traversal (35) and PHP Injection / Remote Include (34). No path family recorded activity, and no catalogued identifier was reached by any of the period’s external events, against 13 identifiers observed last week. The taxonomy covered 100.00% of external events, against 88.65% last week, because the surviving population is entirely one well-mapped surface.

Curated-wordlist targeting

SSH Campaign Targeting matches usernames against a curated list covering Solana validators, Ethereum nodes, DevOps accounts and database service accounts. 1,358 events from 229 sources across 292 sessions, 123 sources new and 106 returning, first observed 24 August 00:00 IST and last 30 August 23:31 IST. Its cadence is the most hands-on of the three: 1.84% automated, 53.00% semi-automated, 31.80% operator-associated and 13.36% evasive over 217 classified sessions. No attacker-submitted username is reproduced, counted by value or characterised, here or in the source report.

Cadence, by signal

Automation falls and operator association rises as the targeting narrows. One caveat on these shares: 1,492 of the period’s 1,832 sessions, 81.44%, are unclassified, which is the classifier’s insufficient-data return for fewer than three events rather than an observed style, and five sessions exceeded the 200-event classification cap so their published cadence describes a prefix only.

Behaviour progression

121 of the period’s 1,832 sessions carried behaviour from two or more distinct stages, against 276 of 3,900 in Edition 004. 86 sessions ordered discovery before exploitation, and 35 ran the ordering in reverse.

The forward ordering is not broadly distributed this week. A single source produced 42 of its 86 sessions, 48.84%, across only 25 distinct sources in total, against 110 sources and an 18.01% concentration in Edition 004. On this evidence the forward ordering is better read as one tool’s fixed request order repeated many times than as many independent operators escalating. The reverse ordering shows the opposite shape, 35 sessions from 34 sources with no source contributing more than two, which is consistent with a tool that simply issues its credential attempts before its enumeration, or with unrelated activity merged by address reuse inside a session gap.

Source profiles and vulnerability mapping

All 1,258 external addresses active in the period carry a score; none was excluded from the ranking. No session in the period carried a tool signature, 0 of 1,832, which is expected rather than missing for this surface. The vulnerability mapping reaches 17 identifiers and matched none of the period’s external events, against 13 matched in Edition 004. Detection remains inference from request path and behavioural tag, never observed exploitation.

Medulus correlation

119 vulnerabilities qualified as more important during the period. Four of them bear on what the decoys observed.

The username as payload. ProFTPD CVE-2026-42167 allows remote code execution through a crafted username where mod_sql logs USER requests with an expansion such as %U and the SQL backend is reached without adequate escaping. The decoy estate’s entire week was username submission against an authentication service; this flaw is what happens when that submission is processed rather than merely rejected.

Tooling refreshed against an old SSH flaw. CVE-2008-5161, an error-handling weakness in the SSH protocol affecting SSH Tectia and related products, qualified because its Metasploit auxiliary scanner module changed during the period. It carries no KEV listing and no ExploitDB entries; the qualification is movement in tooling, not in exploitation.

Access-granting infrastructure. Authentication bypass and gateway flaws qualified in Palo Alto Networks PAN-OS (CVE-2026-0265, bypass where Cloud Authentication Service is configured), Check Point SmartConsole (CVE-2026-16232, unauthenticated token issuance leading to full administrative access), Citrix NetScaler ADC and Gateway (CVE-2026-8452, gateway memory overflow) and Cisco Secure Firewall ASA and FTD (CVE-2025-20333, VPN web server, KEV-listed).

Build, repository and backup systems. JetBrains TeamCity CVE-2026-63077 permits unauthenticated remote code execution via the agent polling protocol; Gitea CVE-2026-60004 permits remote code execution via the diffpatch API through Git hook installation; Veeam Backup Enterprise Manager CVE-2024-29849 allows an unauthenticated user to log in as any user. JFrog Artifactory CVE-2026-66384 and Oracle WebLogic Server Proxy Plug-in CVE-2026-21962 qualified in the same period.

Technical checks for the week

Venus records activity reaching Elytra-operated decoy observation infrastructure. Medulus provides public vulnerability and threat-intelligence context. An observed request establishes an attempt, not a successful compromise. Week-on-week comparisons are drawn from the figures published in Edition 004. Session-keyed figures are not external-only; every event-keyed figure is. The ranking constants remain provisional pending a complete uninterrupted baseline week.