TI-2026-065E — The .env Playbook

Series: The Return · Part E · Classification: HIGH · Confidence: HIGH

Part A showed 43.134.219.52 sweeping ten variants of .env in a single burst and called it credential harvesting. That was the what. This part is the how — and the how is not a secret. Every probe the AS132203 cohort fired can be found, by name, in the same OSINT library we use to hunt it. The attack is not a technique. It is a download.

Executive Summary

The AS132203 secret-harvest is not bespoke tradecraft. It is a commodity, multi-stage kill chain assembled entirely from public tooling — and we can match it probe-for-probe to the wordlists, scanners and modules sitting in our reference library.

• The wordlist is public. The observed /.env.production, /.env.dev, /.env.prod, /.env.tmp are lines in SecLists' fuzz-Bo0oM.txt, alongside .aws/credentials, .git/, .bash_history.
• The scanners are shipped. /.git/config probing is a one-line Nuclei template and a Metasploit module (git_scanner). Harvesting the keys once found is another Metasploit module (aws_keys).
• The escalation is written down. HackTricks documents turning a .env/env-var read into full cloud-IAM takeover; the validation step (TruffleHog → AWS STS) even has its own Sigma detection rule.

The finding cuts two ways and we state both. The barrier to entry is a pip install — which is why hundreds of disposable instances can run it and why it is internet-wide, not Tencent-specific. And the barrier to detection is equally low — because every stage is published, the whole chain is signaturable, which is exactly why CrowdSec caught and banned it. Commodity offense, meet commodity defense.

I. The Kill Chain, Reconstructed

Laying the observed AS132203 traffic beside the library turns a scatter of 404s into a coherent, six-stage script:

Nothing in the middle column is exotic. It is the standard-issue kit of every bug-bounty hunter, red-teamer and commodity criminal on the internet. The AS132203 cohort did not invent a way in. It ran the manual.

II. Stage 2 in Detail — The Wordlist Is the Attack

The single most telling match is the .env sweep. In Part A, 43.134.219.52 requested ten .env variants in one burst. Those variants are not creative; they are consecutive lines in a shipped wordlist. SecLists' Fuzzing/fuzz-Bo0oM.txt enumerates .env, .env.bak, .aws/credentials, .bak, .backup, .bash_history, .git/, .htpasswd — the exact family we observed, plus its siblings the cohort would have tried against a differently-configured target.

This is why the raw HTTP status is meaningless (Part A's methodology): the server answers 404 to each, the wordlist marches on, and a status-code-only tool sees nothing. The attack is the wordlist, executed at machine speed. Detecting it means recognizing the shape of the enumeration, not judging any single response.

III. Stage 6 in Detail — What a Hit Is Worth

The sweep is cheap because the payoff is enormous. HackTricks spells out the escalation that a single readable .env (or an env-var read via SSRF/LFI) unlocks:

# discovery primitive
cat /proc/self/environ | tr '\0' '\n'
# in a cloud pod, env vars point at the credential endpoint:
AWS_CONTAINER_CREDENTIALS_FULL_URI=http://169.254.170.23/v1/credentials
AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE=/var/run/secrets/.../eks-pod-identity-token

A leaked .env is rarely just a database password. In a modern cloud deployment it is the thread that unspools into the pod's IAM role, and from there into the account. For Rails targets the library lists the equivalents — config/master.key, credentials.yml.enc, database.yml — any one of which is game over. The .env request that returns 404 a thousand times only has to return 200 once.

IV. The Seven Questions

Who is this? The AS132203 web cohort (065A/B), here as the observed operator of a universal script. Why did it attack? To find the one server in a million that left .env in the web root. Who does it claim to be? An iPhone (the forged UA of 065B). Who is it really? A commodity harvester — indistinguishable, at the tooling level, from any other. Whom is it related to? Every operator running the same kit; the playbook has no owner. Where is the money? In the one exposed key: cloud compute to mine, databases to ransom, payment secrets to drain. What is the official anchor? None needed — the tooling is openly published, much of it on GitHub, some of it (per Part D) even studied by the CIA.

V. What If / Steelman — "This is just noise"

The strongest dismissal: these are meaningless 404s; every website on earth gets scanned for .env; there is no story in a wordlist.

Half right — and the correction is the point. Yes, this is background radiation; yes, it hits everyone. But "common" is not "harmless," and "automated" is not "unattributable." The commodity nature is precisely what makes it (a) high-volume enough to matter — hundreds of instances, industrial scale — and (b) perfectly detectable, because a published wordlist produces a stable, recognizable enumeration signature. The dismissal treats commoditization as a reason to look away. We treat it as the reason the defense works. The .env sweep is boring, universal, and exactly the thing a login-page 200 mask is designed to hide (Part A) — which is why documenting it, boring as it is, is the job.

VI. Read Between the Lines

• The gap between attacker effort and defender effort has collapsed to nearly zero on both sides. The attacker runs a wordlist; the defender runs a matching rule. The contest is decided upstream, by whoever leaves an .env in a web root.
• A published offense is a solved defense. Everything in Section I has a signature. The unsolved problem is never the scan — it is the leaked secret waiting for it.

VII. The Human Layer

The whole chain turns on one human moment: a developer, late, copies .env.example to .env.production, fills in the real Stripe key and database password, and — just once — commits it, or drops it in a public web root. The attacker's side of that moment costs nothing: a wordlist that has sat unchanged on GitHub for years, fired by a rented instance that will be recycled next week (Part B). The asymmetry is total and it runs the wrong way: years of a team's work against one line of a text file, retrieved by a script anyone can run. The defense is not clever detection. It is echo '.env' >> .gitignore — and remembering to.

VIII. Verdict

The AS132203 secret-harvest is a commodity, fully-documented, six-stage kill chain — fingerprint, sweep, repo-expose, auth-probe, harvest, validate-and-escalate — assembled from public wordlists, scanners and modules, every one of which is named in the OSINT library. Confidence: HIGH (direct probe-to-tool mapping). It is dangerous because it is commoditized and internet-wide, and defensible for the same reason. AS132203 is the instance; the playbook is everyone's.

IX. Defensive Response

Live and automatic: CrowdSec's watchdog-http-probing / web-threats/autoban: credential_harvest scenarios fingerprint the enumeration shape and ban on sight (Part A), propagating to the MikroTik crowdsec-blacklist. The published playbook is a signatured playbook.

Crosslinks

• ← TI-2026-065A — The Second Front — the observed .env burst this part decodes.
• ← TI-2026-065B — Two Doors, One Landlord — the disposable instances that run the script.
• TI-2026-065D — The Glass House — where the same library's Metasploit/CVE tooling framed the target; here it frames the method.
• → TI-2026-065F — The Mirror That Masks — the /?rd= open-redirect probe seen here, examined on its own.

Sources: LSN web-threats requests (AS132203) mapped to OSINT library — SecLists, Nuclei-Templates, Metasploit (git_scanner, aws_keys), PayloadsAllTheThings, HackTricks, Sigma-Rules; CrowdSec detection. Method: observed probe → named public tool, one to one. TLP:WHITE.