TI-2026-047B โ The Repeat Offenders
๐ The Short Version
- The web-threats data is a confirmation engine, not a discovery engine: 217 web-probe IPs map onto investigations we already published.
- 73 IPs are flagged by four independent systems at once โ firewall (L3), CrowdSec (L7), the SSH honeypot, and the web classifier.
- The cohort is dominated by Microsoft Azure and M247.
- Two Azure nodes hunt webshells with a shared toolkit signature (
this_is_a_new_hello_world.php). - M247 โ the Macquarie-owned, 5,000-prefix VPN backbone we dissected in 16 prior dossiers โ is back, now on the web surface.
- A Hong-Kong-registered, Netherlands-routed pair runs a coordinated
xmlrpc.phpamplification sweep.
047A asked who was knocking. 047B opens the door and finds faces we have already photographed.
๐งฑ The Four-Layer Wall
A single sensor can be fooled. Four sensors with independent logic, agreeing on the same address, cannot.
73 IPs are multi_layer_blocked โ caught simultaneously by every layer of the estate:
What were they after on the web? The intents skew hard toward CMS takeover:
And the networks behind them are not obscure bulletproof corners โ they are the biggest names in cloud, led by Microsoft Azure (AS8075) and M247 (AS9009).
๐ป The Azure Empty-UA Webshell Botnet
Two Microsoft Azure nodes show what "shell_upload" and "cms_detect" actually look like up close.
20.9.17.155 โ the backdoor checker
- 544 requests ยท empty user-agent ยท CrowdSec
watchdog-http-probing - Member of both the "Empty-UA Botnet AS8075" and the 62-IP Shared-Exploit Cluster
These are not exploit attempts โ they are presence checks. The bot is asking: is a webshell already installed here?
172.161.73.175 โ the admin-panel sweeper (MikroTik-banned)
- 646 requests across 159 paths ยท empty UA ยท CrowdSec
http-admin-interface-probing - Banned at the router; targets
/wp-content/admin.php,/wp-admin/network/plugins.php, upload dirs
Both nodes request this_is_a_new_hello_world.php. One filename, two unrelated IPs โ the fingerprint of a single toolkit sprayed across a botnet.
๐๏ธ M247 โ The Backbone Returns
Some repeat offenders are small. This one is an empire.
M247 Europe SRL (AS9009) โ what 16 prior LSN investigations have established:
- Owned by Macquarie Group (ASX: MQG), the Australian financial conglomerate
- 5,000 IPv4 prefixes across 60 internet exchanges (PeeringDB "M247 Global")
- Routes NordVPN, Mullvad and Proton โ privacy infrastructure and attack infrastructure on the same ASN
- Subsidiary Servers Factory LLC runs the "attack arm": 19 US IPs at 100% abuse
- 10 national subsidiaries โ M247-Ltd-Cuba, -Iran, -Venezuela, -Shenzenโฆ all physically in Romania
On the web surface it reappears as 146.70.194.252, 82.102.18.188 and 139.28.219.68 โ multi-surface and four-layer-blocked, intent cms_detect. 146.70.194.252 even carries the signature M247 contradiction: prefix-origin Romania, registrant Netherlands.
๐ The XML-RPC Pair
62.164.177.222 and its sibling .223 (Data Campus Limited, AS215929 โ registered in Hong Kong, routed from the Netherlands) run a single coordinated move:
The same file, hunted across ten path prefixes. xmlrpc.php is WordPress's classic brute-force-amplification and pingback-DDoS lever. Both IPs are MikroTik-banned via CrowdSec.
๐บ๏ธ The Repeat Map
Where do the 217 web probes land when matched against prior investigations? Overwhelmingly, on the work already done:
| Prior investigation | Matches | Example (intent ยท requests) |
|---|---|---|
| TI-2026-046A โ The .env Harvesters | 69 | 34.176.151.233 ยท credential_harvest ยท 149 |
| TI-2026-046E โ Cloud Mercenaries | 45 | 69.63.189.36 ยท cms_detect |
| TI-2026-046B โ WordPress Ghosts | 37 | 20.9.17.155 ยท shell_upload ยท 544 |
| TI-2026-046C โ Recon Industrial Complex | 33 | 185.191.171.15 ยท scanner_fingerprint |
| TI-2026-046D โ Multi-Vector Operators | 19 | 172.161.73.175 ยท cms_detect ยท 485 |
| TI-2026-031J โ Chinese Ecosystem | 11 | 43.128.69.143 ยท Tencent ยท cms_detect |
| Tor-exit HASSH campaign | 2 | 192.42.116.107 ยท Tor exit |
๐ฐ Reputable Money, Anonymous Operators
Run the mandatory institutional-anchor pass on the repeat offenders and a pattern appears:
- The rails are blue-chip โ Microsoft (MSFT), M247 owned by Macquarie (MQG), Google (Alphabet). All listed corporations, all RIR members.
- The operators are unattributed โ empty-UA botnets, shared toolkits, sibling sweeps. No single name.
- The opacity lives in the middle โ the reseller and shell-subsidiary layer.
This is not novel. A DOJ indictment of six GRU officers records that the conspirators "leased infrastructure from resellers rather than ... directly from hosting companies" โ opacity by reseller is a documented tradecraft, and M247 monetises exactly that structure through its LIR/reseller model and national-subsidiary shells.
At the top of the stack: a stock ticker. At the bottom: a webshell. The distance between them is the product.
๐ Two Phases of One Kill Chain
047A and 047B are not separate stories. They are two phases of the same operation, run by an overlapping actor set on overlapping infrastructure:
- 047A โ harvest the secret. Enumerate
.envfiles and database dumps to steal credentials. - 047B โ plant and use the shell. Hunt webshells, CMS admin panels and
xmlrpc.phpto take and keep control.
Both sit on the same persistent baseline โ CVE-2017-9841 alone draws 80,000+ exploit attempts every 30 days (VulnCheck), run by the same Androxgh0st/Kinsing families.
โ The Questions
Who is this?
Networks we already named โ Azure's empty-UA botnet, M247's backbone, a HK/NL shell โ re-confirmed at four layers.
Why did it attack?
To take over content-management systems: webshell upload, admin-panel hunting, xmlrpc amplification.
Who does it claim to be?
Mostly nobody โ empty user-agents. The Data Campus pair wears a browser costume; the Azure botnet does not bother.
Whom is it related to?
The whole prior corpus. 217 probes resolve onto published investigations; the shared filename this_is_a_new_hello_world.php binds otherwise-unrelated nodes to one toolkit.
Where is the money?
At the top โ Macquarie owns the M247 backbone; Microsoft and Google bill the compute. Operators pay cents; owners book revenue.
What is the official anchor? [INST]
Fully resolved at the top (listed corporations, RIR members), deliberately opaque in the middle (resellers, shell subsidiaries, virtual national locations).
What if it is more than it appears?
The virtual M247-Ltd-Cuba / -Iran subsidiaries, physically in Romania, leave a live sanctions-exposure question that no abuse desk has answered.
โ๏ธ Verdict
The web-threats surface earns its keep not by discovering new adversaries but by re-convicting known ones with independent evidence. 217 probes resolve onto prior dossiers; 73 of the worst are confirmed at four layers simultaneously.
The faces are familiar โ Azure's webshell botnet, M247's financialised backbone, a HK/NL amplification pair โ and the institutional anchors run all the way up to stock tickers, while the operators stay hidden in the reseller layer.
A second camera does not catch new criminals. It removes the defence lawyer's last objection about the first one.
๐ Related
- TI-2026-047A โ The Login Page That Watched Back (Letter A โ phase one of the kill chain)
- TI-2026-046B โ The WordPress Ghosts ยท 046D โ The Multi-Vector Operators
- TI-2026-023B โ The Backbone (M247) ยท TI-2026-036B โ The M247 Empire
Series: ๐ช The Glass Cage ยท Letter: B ยท Classification: TLP:WHITE
Data sources: LSN web-threats database (Traefik) ยท CrowdSec L7 ยท MikroTik L3 ยท SSH honeypot ยท Qdrant entity crosslinks (multi_layer_blocked / web_probe_matches_investigation) ยท prior dossiers TI-2026-023B / 036B / 027 / 044L / 046A-E. External: DOJ GRU/Sandworm indictment (reseller opacity); VulnCheck (CVE-2017-9841).
Investigation: TI-2026-047B ยท 7 actors ยท 10 evidence ยท 7 findings ยท 10 connections ยท 10 infrastructure records