The Secret Harvest: Cloud-Hosted Credential Scanning at the Web Edge

TI-2026-059A · Series: The Front Door · Classification: HIGH · Confidence: HIGH

The first dossier drawn from our third observation surface. For years the honeypot watched the back door — SSH, port 22, the brute-forcers. This series watches the front door: everything that hits web infrastructure through Traefik, CrowdSec, MikroTik and the Authelia forward-auth proxy. The front door turns out to be busier, quieter, and far more modern than the back.

Executive Summary

Between 3 June and 5 July 2026, the web edge logged 925 unique IP addresses and 23,298 requests that our classifier tagged credential_harvest. It is the largest single web-threat intent class we observe — bigger than scanner fingerprinting, CMS detection and shell upload combined.

But the name is almost a misdirection. This traffic is not trying to log in. It never touches a password field. It is looking for files — the .env a developer forgot to exclude from the web root, the .git/config left readable after a git clone deploy, the .aws/credentials mounted one directory too high. One lucky HTTP 200 on any of those returns a live cloud key with no cracking, no brute force, no waiting. The credential is simply lying there.

Three facts define the campaign:

The origin is the cloud itself. Amazon (AS16509), Google Cloud (AS396982) and Microsoft (AS8075) are the top sources — not as victims, but as launch pads. Reputable, ephemeral, disposable.
The model is serverless. On 15 June, 33 Google Cloud VMs each fired ~90 distinct secret-file paths in about two seconds, then disappeared. Spin up, scan, tear down.
The target list has grown teeth for 2026. Alongside .aws/credentials we now see /.anthropic/config.json and /.cursor/mcp.json — someone is harvesting AI API keys.

The Numbers

Web-threat intent	Unique IPs	Total hits	Window
credential_harvest	925	23,298	06-03 → 07-05
cms_detect	446	2,741	06-03 → 07-05
shell_upload	338	2,859	06-04 → 07-05
scanner_fingerprint	271	—	06-04 → 07-04

credential_harvest is an order of magnitude larger than the next intent class. Whatever else the internet's scanners are doing to us, four out of five of them are hunting exposed secrets.

Case File 1 — The Two-Second Burst (Campaign 157)

Our temporal-burst detector flagged Campaign 157: "Burst 2026-06-15 AS396982 (credential_harvest)" — 33 Google Cloud IP addresses, all first seen inside a single ten-hour window on 15 June, 1,394 requests, average 404 rate 0.31.

The per-node telemetry is the story:

Node (Google Cloud)	Requests	Distinct paths	Window	Paths/hour
34.48.135.162	98	98	09:22:34 → :36	184,620
35.192.60.23	89	89	07:17:25 → :27	192,430
34.92.209.152	91	91	04:14:16 → :18	154,872
34.162.56.248	97	97	03:17:46 → :48	100,944

Every node requested as many distinct paths as it made requests — no repeats, no retries — and completed the entire sweep in roughly two seconds. Zero auth failures. Zero auth successes. These machines never tried to authenticate to anything. They asked ~90 questions of the form "is this secret file exposed?", recorded the answers, and were gone before a human analyst could open the log.

This is what "serverless attack" looks like in practice: the origin IP is a rental that existed for the length of one HTTP burst. By the time it appears on a blocklist, Google has already recycled it — possibly to a legitimate customer.

Case File 2 — The AI-Secret Harvester (208.84.101.25)

One IP on AS22295 (Advin Services LLC, US) — abuse score 100/100 — is worth reading path by path, because its target list is a snapshot of what is currently monetisable on the credential black market:

/.aws/credentials
/.config/gcloud/application_default_credentials.json
/.docker/config.json
/.anthropic/config.json          ← Anthropic API key
/.cursor/mcp.json                ← AI-IDE / MCP server config
/.env  /.env.local  /.env.backup  /.env.bak  /.env.copy
/.env.development  /.env.orig  /.env.swp

The classic cloud keys (AWS, GCP, Docker) are still there. But /.anthropic/config.json and /.cursor/mcp.json are new. Someone updated the wordlist for the AI era. This is not speculation — it matches The DFIR Report's April 2026 analysis of the "Bissa" scanner, which found tens of thousands of .env files yielding credentials "across AI, cloud, payments, messaging, and databases." The harvest path list evolves in lockstep with what developers are careless with, and in 2026 developers are careless with LLM keys.

Case File 3 — The Bulletproof Base (AS197170 TechTies)

Where the hyperscaler nodes are transient, one operator provides the durable layer. 91.92.42.120 and its /24 siblings (.63, .182, .86, .30) ran a steady, twenty-day credential_harvest operation until MikroTik banned the range.

Run the mandatory institutional-anchor pass on their ASN and the picture is unambiguous:

Attribute	Value
ASN	AS197170 (TECHTIES-AS, TechTies Inc.)
Registered	Seychelles (SC) via RIPE NCC
Allocated	2026-05-29 — days before the attacks began
Spamhaus	Listed — ASN-DROP (Do not Route Or Peer)
Bulletproof flag	true — local risk 84.4 / 100
Prefixes announced	~10 IPv4, 0 IPv6
PeeringDB site	none
Legitimate customers	none visible

A brand-new, offshore-registered autonomous system, on the Spamhaus DROP list, with no website and no visible legitimate traffic, that goes straight to credential harvesting. The institutional anchor you cannot find is the finding: TechTies exists to route abuse and nothing else.

The Path List Reads Like a Confession

The full harvest wordlist is not a blind dictionary. It encodes the attacker's model of how secrets leak in the real world:

The primary file — /.env, /config.json, /appsettings.json, /config/parameters.yml
The version-control leak — /.git/config, /.git/logs/HEAD, /.git/refs/heads/master
The editor's fingerprints — /.env.swp (a vim swap file), /.env.save, /.env.orig
The lazy backup — /.env.bak, /.env.backup, /.env.copy, /app/.env

Blocking /.env alone accomplishes nothing. The attacker already assumes you protected the obvious file and moved on to the six ways it survives anyway — the swap file your editor wrote during the incident, the .bak your deploy script made, the copy in /app/.

Read Between the Lines

Q: If these are "just scanners," why does it matter which cloud they run on? Because the choice of cloud is the tradecraft. Running from AWS/GCP/Azure buys three things a bulletproof host cannot: trust (many WAFs allowlist hyperscaler ranges), disposability (a new IP every few seconds), and deniability (the address is shared with millions of legitimate tenants, so you cannot blocklist it without collateral damage). The attacker is renting reputation, not just compute.

Q: Why harvest files instead of brute-forcing logins, which is what the honeypot has always seen? Economics. A brute-force campaign spends thousands of requests and CPU-hours to maybe guess one weak password. A secret-file sweep spends 90 requests over two seconds and, if it wins, walks away with a root cloud credential — often more privileged than any single login. The harvest is cheaper, quieter, and the payoff is larger. The back-door brute-forcers never left; the smart money simply moved to the front door.

Q: 925 IPs — is this one actor or many? Both, and that is the uncomfortable answer. The .env wordlist has been commoditised (EmeraldWhale, Bissa, dozens of GitHub tools), so much of the 925 is independent operators running the same open-source scanner. But the coordinated clusters — Campaign 157's synchronized GCP burst, the TechTies /24, the 30-IP shared-exploit cluster around 208.84.101.25 — are single hands. The noise is a crowd; the signal is a few professionals hiding inside it.

The Alternative Interpretation

Steelman the benign case: much of this could be legitimate security research — Shadowserver, academic internet-wide scanners, bug-bounty recon, or SaaS "attack surface management" vendors who probe .env exposure as a service to their customers.

That explanation survives for part of the long tail and dies on the specifics:

Legitimate scanners identify themselves in the User-Agent and publish reverse-DNS (researchscan.example.edu). Our harvesters rotate through forged consumer-browser strings (Mozilla/5.0 … Chrome) or send empty User-Agents.
Researchers request one representative path to measure exposure. Our nodes request the full backup/swap/copy family — behaviour that only makes sense if you intend to retrieve and use the secret, not merely count it.
Shadowserver does not launch from Spamhaus-DROP Seychelles shells. TechTies AS197170 has no research anchor, no institution, no published methodology. It has an offshore registration and a Spamhaus block.

The benign hypothesis explains the tail. It cannot explain the coordinated clusters, the forged UAs, or the bulletproof base. The evidence wins.

Verdict

The defining web threat of mid-2026 is not the login brute-forcer that has haunted honeypots for a decade. It is the secret harvester: a cloud-hosted, ephemeral, tool-driven sweep for exposed credential files, operating on a serverless economy that makes IP reputation structurally useless, with a durable bulletproof shell (TechTies AS197170) underneath the disposable hyperscaler noise. Its target list has already absorbed the AI era. Confidence: HIGH on the behaviour and infrastructure; MEDIUM on single-operator attribution of the coordinated clusters.

Defensive Response

Serve nothing secret. Every .env, .git, .aws, .config and backup/swap variant must return 403/404 at the edge — verified, not assumed.
Behaviour over reputation. The CrowdSec scenario web-threats/autoban: credential_harvest already bans on path-pattern + velocity rather than IP history; that is the correct model and it caught the TechTies range.
Assume leak, rotate anyway. Any credential that could have been in a web-served file during the window should be rotated. A 200 you did not log is indistinguishable from one you did.
Treat AI keys as crown jewels. /.anthropic/config.json, /.cursor/mcp.json, OpenAI keys — same handling as root cloud credentials. They are already on the wordlist.

Sources

LSN web-threats platform — credential_harvest pattern export, Campaign 157, IP dossiers for 208.84.101.25 and 91.92.42.120, ASN profile AS197170 (Traefik access logs + CrowdSec decisions + MikroTik address-lists + Authelia intercept decode).
Sysdig Threat Research — EmeraldWhale: 15k Cloud credentials stolen from exposed Git config files — https://www.sysdig.com/blog/emeraldwhale
The DFIR Report — Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting (2026-04-22) — https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/
Trend Micro Research — Inside the LiteLLM Supply Chain Compromise (.env desensitisation) — https://www.trendmicro.com/en_us/research/26/c/inside-litellm-supply-chain-compromise.html

Investigation TI-2026-059A · The Front Door series · Sources: web-threats platform (925 IPs / 23,298 hits), CrowdSec, MikroTik, Authelia forward-auth intercept · Cross-referenced with EmeraldWhale (Sysdig) and Bissa (DFIR Report) · Confidence: HIGH.