TI-2026-095E — The Config Vultures: A Google-Cloud Fleet Wears the Wayback Machine to Strip Every Secret

Classification: HIGH · Forensic threat intelligence · Web-threats vector · Series: Below the Noise Floor

A request arrives claiming to be the Internet Archive's Wayback crawler — the polite robot that mirrors the web for posterity, the one many admins wave straight through. Then it asks, in the same twelve seconds, for your AWS credentials, your GCP service account, your SSH private key, your Terraform state, your CI/CD deploy tokens, your Spring heap dump, and your database backup — two hundred and seventy-one secret files, one after another, all 404. It is not the Wayback Machine. It is a Google-Cloud burst fleet wearing the Wayback Machine's name, and it is reading the entire estate for anything left unlocked. This is the anatomy of a secret harvest disguised as an archive.

1. Two Disguises at Once

The previous entry in this series hid by age — a nine-year-old CVE nobody watches. This one hides by identity and by silence, two disguises stacked.

The identity: every node presents the ia_archiver user-agent, the string used by the Internet Archive's Wayback crawler. That is a name with a reputation for good behaviour, and a name that security-conscious operators sometimes allow-list so their sites get properly archived. Borrowing it buys the fleet reduced scrutiny — a request from "the Internet Archive" earns less suspicion than one from a nameless scanner. The web-threats pipeline is not fooled: it classes the identity spoofed and clusters the nodes as the Fake-ia_archiver Fleet AS396982. But an operator is betting that a busy admin, glancing at an access log, reads "archive.org" and moves on.

The silence: every single one of the 271 requests returns 404. A wall of not-found reads, to a tired eye, as harmless enumeration — a scanner poking at files that aren't there, achieving nothing, worth ignoring. That is the second cover. The 404s are not failure from the attacker's side; they are the expected output of a fishing sweep. Ninety-nine hosts out of a hundred return 404 to /.aws/credentials. The campaign is built to be run against everyone, cheaply, for the one host in a hundred that returns 200.

Below the noise floor, again — this time beneath a benign name and beneath a curtain of 404s.

2. The Sweep — 271 Paths in Twelve Seconds

Pivot into any node's full behaviour and the archive disguise falls apart instantly. Representative node 34.32.47.181 (Google Cloud, AS396982) issued 271 requests in about twelve seconds — 2026-06-10 14:19:15 to 14:19:27, a rate near 81,000 paths per hour — every request a distinct secret-or-config path, every one a 404, all against a single host (www.shuffle-on.com).

The Wayback Machine mirrors public pages. It does not ask for your private key. This does nothing else.

The 271 paths are not random. They are a curated, current map of the modern DevOps secret surface — the files that, if a web root is mis-deployed, leak the keys to everything:

Cloud credentials. /.aws/credentials, /.aws/config, /.gcloud/credentials.json, /.config/gcloud/credentials.db, /gcp-credentials.json, /google-credentials.json, /firebase-adminsdk.json, /firebase-credentials.json, /service-account.json, /serviceaccount.json, /.azure/credentials, /aws-credentials.json, /api_keys.json.

Private keys and auth. /id_rsa, /.ssh/id_rsa, /.ssh/authorized_keys, /private.key, /private_key.pem, /server.key, /server.pem, /secret.json, /secrets.env, /.netrc, /.npmrc, /.pypirc, /.htpasswd.

Infrastructure-as-code. /terraform.tfvars, /terraform.tfstate, /.terraform/terraform.tfstate, a dozen docker-compose*.yml variants, /kubernetes.yaml, /k8s.yml, /helm/values.yaml, /helm/values-production.yaml, /Dockerfile.

CI/CD pipelines. /jenkins/Jenkinsfile, /Jenkinsfile, /.github/workflows/deploy.yml (and main.yml, production.yml), /.circleci/config.yml, /azure-pipelines.yml, /bitbucket-pipelines.yml, /.buildkite/pipeline.yml, /.travis.yml.

Spring Boot actuator. /actuator/env, /actuator/heapdump, /actuator/configprops, /actuator/threaddump, /actuator/httptrace, /actuator/auditevents, /actuator/sessions, /actuator/logfile — each also tried under /api/, /v1/, /v2/, /server/, /app/, /backend/, /internal/ prefixes.

Framework config and databases. /application.yml, /application.properties, /wp-config.php (and .bak, .old), /appsettings.json, /web.config, /settings.py; and /dump.sql, /pg_dump.sql, /mysqldump.sql, /database.sql, /backup.sql.gz, /backup.tar.bz2.

Read the list as a whole and its intent is unambiguous. This is not a vulnerability scan; it is an exfiltration checklist. Every path is a file whose contents unlock something else — a cloud account, a server, a CI system, a database. The campaign is the reconnaissance-and-theft half of "find a leaky deployment and empty it."

3. Why the CVE Tag Understates It

The web-threats engine files this campaign under CVE-2018-1273 (Spring Boot Actuator exposure), because the 271-path sweep includes the actuator endpoints, and the actuator paths carry a known CVE signature. That correlation is correct but partial. The actuator paths are perhaps two dozen of the 271; the other ~247 are cloud credentials, private keys, Terraform state, CI/CD secrets and database dumps that no single CVE covers.

This matters for defence. An operator who keys only on "the Spring actuator CVE" sees a Java-framework probe and shrugs — no Spring here, move on. But the campaign never cared whether you run Spring. It is checking for /.aws/credentials and /service-account.json on the same breath, and those have nothing to do with Java. The CVE is a lens that happens to catch one facet; the campaign is the whole 271-path grab. Read the behaviour, not just the tag.

4. The Fleet — 143 Nodes, All Google Cloud

The per-CVE actor view returns 143 distinct source IPs and 69,831 hits, and every one is a Google Cloud address in AS396982 (ARIN-registered, US). As with the DigitalOcean Struts2 fleet of the previous dossier, there is no bulletproof hosting and no residential scatter — one mainstream, high-reputation cloud, rented by the minute.

That single-provider concentration is the same double-edged fact it was for the DigitalOcean fleet. It makes the campaign cheap to reconstitute (burn a flagged instance, spin another) but also maximally attributable and takedown-tractable: one abuse desk (Google Cloud) covers the whole fleet, and every node is already MikroTik-banned and CrowdSec-listed on the LSN side. Renting from Google buys clean IP reputation and elastic scale; it costs attributability. The operator took that trade.

And the cadence tells you it is automated and disposable: each node fires its full 271-path sweep as a single burst — first_seen and last_seen seconds apart — then goes quiet. There is no interactive operator here, no adaptation; there is a script, a target, and a rented box that exists for exactly one twelve-second sweep.

5. One Node per Host — a Pattern Now Seen Twice

Here is the detail that connects this campaign to the last one and elevates both. Line the 143 nodes against the hosts they hit, and it is a clean one-to-one map across the estate: www and mail.shuffle-on.com, auth.sonatural.life, tautulii, lsn-ai-k3s, lsn-jupyter, lsn-webmail.sonatural.life, lsn-git, lsn-registry, lsn-karaoke, lsn-cert, lsn-auth-manager, lsn-webtop, openwebui, lsn-plasma-chat, lsn-storage, lsn-docling, lsn-ai-staging, lsn-pma, lsn-vault, lsn-llm-factory, peertube, lsn-grafs, lsn-maps, lsn-nas2 — the whole published surface, one node per subdomain.

This is exactly the assignment pattern documented for the DigitalOcean Struts2 fleet in TI-2026-095D. And that is the point worth sitting with: these are two completely independent campaigns — different provider (Google Cloud vs DigitalOcean), different objective (secret harvest vs Struts RCE), different disguise (spoofed Wayback bot vs spoofed LeakIX) — and they use the same one-node-per-host partition of the same estate. When two unrelated operators independently arrive at the identical structure, it is not coincidence; it is convergent tradecraft. Renting a cloud fleet and assigning one disposable node per target subdomain has become a standard way to run a distributed sweep: it spreads the request load, dilutes per-IP rate signals, and lets each node be burned independently.

For a defender that convergence is a gift. It means the one-node-per-host partition is a provider- and exploit-agnostic detection primitive: whenever your telemetry shows your subdomains cleanly partitioned across distinct rented-cloud IPs — whatever they're throwing — you are looking at a coordinated campaign, and you knew it before you read a single payload.

6. What It Took — and the Checklist It Left Behind

Every one of the 271 paths returned 404. The LSN hosts are Traefik-fronted and Authelia-guarded, and none of them serves a credential file, a Terraform state, or an exposed actuator. The vultures found carrion-free ground; the sweep harvested nothing here.

But the capture is still valuable, and the value is the dictionary. Those 271 paths are a live, curated, current inventory of exactly what a mis-deployed modern web application leaks — assembled by an adversary who runs it against the whole internet and keeps it up to date. Turned around, it is the cleanest hardening checklist a defender could ask for: every path in it is a file that must never be reachable from the web, and the presence of any of them at a 200 is an incident. The vultures published the list by flying it at us; we can read it as a map of our own worst mistakes-not-yet-made.

7. The Counter-Narrative

Steelman: "This is nothing. It's the Internet Archive, or at worst a commodity .env scanner, hitting a bunch of paths and getting 404s. Every website on earth sees /.env and /.git/config probes hourly. You found a scanner. Congratulations."

Each clause has a grain of truth, and the finding survives:

• "It's the Internet Archive." It is not, and we can prove it: the real ia_archiver comes from the Internet Archive's own ranges and mirrors public pages — it does not burst from Google Cloud requesting 271 secret files in twelve seconds. web-threats classes the identity spoofed for exactly these reasons. The Wayback name is the disguise, and unmasking it is half the point.
• "Just a commodity .env scanner." The scale and specificity say otherwise. A 271-path dictionary spanning AWS/GCP/Azure creds, Terraform state, Helm values, GitHub Actions, Jenkins, and Spring heap dumps is a curated, modern, cloud-native target list — not the tired /.env + /wp-login.php of a commodity bot. And it is delivered by a 143-node single-provider fleet on a one-per-host partition. That is a campaign, not a stray scanner.
• "Just 404s." Yes — stated plainly (§6). The claim is the coordinated, disguised attempt and its precise dictionary, not a breach. A fishing sweep that catches nothing on a hardened target is still a fishing sweep, and its net is intelligence.

What is not claimed: attribution to a named operator (single-provider, spoofed identity — the anchor is Google Cloud's abuse desk); any affiliation with the real Internet Archive (the UA is borrowed); that any secret was exposed (all 404); or that CVE-2018-1273 is the campaign's actual objective (it is one correlated facet of a broader secret harvest).

Confidence: HIGH that a 143-node Google-Cloud fleet ran a coordinated, ia_archiver-spoofing, one-node-per-host 271-path secret-harvesting sweep of the LSN estate in June 2026; MEDIUM on operator identity and on impact (attempts, not compromise).

8. Defence Response

• Verify crawlers by source, never by name. The whole disguise rests on user-agent trust. Allow-list a crawler only against its verified source ranges (the Internet Archive's own space, Googlebot's published ranges), never by the UA string — which is free to forge. A benign UA from AS396982 bursting secret paths is a spoof, full stop.
• Use the dictionary as a hardening checklist. Every path in §2 is a file that must return 404-or-403 from the web on every host, always. Audit for exposed /.aws/credentials, /service-account.json, /terraform.tfstate, /.git/config, /actuator/*, /wp-config.php.bak, and database dumps — the campaign already told you what to look for.
• Report the fleet — one abuse desk. All 143 nodes are Google Cloud (AS396982); abuse reporting covers the whole campaign, and the nodes are already MikroTik-banned and CrowdSec-listed. Single-provider origin is the defender's leverage.
• Detect the partition and the burst. The one-node-per-host partition (a coordinated-campaign tell, §5) and the 200-plus-paths-in-seconds burst are both high-signal, payload-independent detections. Alert on either; you catch this class before you parse a single secret path.

9. A Note on Method

Like the previous dossier, this was built entirely through the web-threats MCP layer, with no direct database access — the per-CVE actors endpoint (wt_cve_actors / GET /api/web-threats/cves/{cve}) for the fleet roster, and dossier_web_threats_intel for each node's full 271-path behaviour, identity classification and campaign clustering. The honeypot and entity-graph CVE tools see none of this: it is a pure web (L7) campaign, and its home is the web-threats vector.

10. Investigation Metadata

Cristian Lișneanu · shuffle-on.com · Threat Intelligence