A Russian operator's DDoS-amplification lab, with an AI co-pilot

On 84.32.34.6, a host at UAB Cherry Servers, an exposed directory showed a pattern we are seeing more of: a legitimate-looking application used as cover, an offensive tool beside it, a persistence worker to keep things running, and an AI assistant woven through the operator's workflow. Russian-language throughout.

Key findings

Timeline

Figure 1. Observed window and the operator's build-to-operate sequence (from shell history).

How we found it

The directory scored malicious on harvested secrets and an offensive scanner sitting next to the application code. We recovered and classified the contents automatically; sensors place the host on 2026-09-30. Alongside a Rust game backend (plausibly cover, or simply the box's day job) sat the interesting material.

How reflection amplification works, and what this tool prepares

Figure 2. The scanner measures reflectors today; the dashed path is the reflected flood it sets up.

A multi-protocol amplification scanner

The centrepiece is ampscanner.py, a multi-protocol amplification scanner that measures the bandwidth amplification factor (BAF) of reflectors across DNS and other UDP services by sending a small query and measuring the response. A Russian comment states it is "read-only, no spoofing, just measuring BAF from a real IP", which is exactly the reconnaissance step before a reflection/amplification DDoS: find the reflectors that turn a small spoofed packet into a large one aimed at a victim. Measuring BAF is the homework; the attack is the exam.

A worker that refuses to die

Persistence is handled by watchdog.sh, which checks whether an ssh_daemon.py worker is running and, if not, relaunches it inside a detached screen session, logging as it goes. Pairing a long-running worker with a watchdog keeps an operation alive across crashes and restarts without a full C2 framework.

The AI co-pilot, again

As on other operator boxes we have mapped recently, the tell-tale files are there: a claude.md project brief and a persona.md defining an assistant's role. The operator runs their offensive work with an AI model in the loop; it is becoming a default, not an exception. Tellingly, the agent config carries a dangerously-skip-permissions flag, the operator has switched off the rail that would otherwise prompt before destructive actions. That is exactly the kind of artifact that survives a model-backend swap: it describes how the operator runs the agent, not which provider they happen to rent this week, which is why our detection keys on it rather than on any one provider's API domains. We also found harvested secrets in the open directory, a GitHub token, a private key and several key-value credentials, exactly the material an exposed working directory should never contain.

Attribution

Comments and operator notes are in Russian, placing a Russian-speaking operator behind the box. Language is a lead, not a named-group attribution. The combination, cover application, offensive scanner, self-healing worker and an AI co-pilot, is the recurring shape of the mid-tier operator in 2026.

MITRE ATT&CK

Indicators

Defending against it

• Do not be a reflector: close or rate-limit internet-exposed UDP services (open DNS resolvers, NTP monlist, memcached, SSDP); these scans exist to find yours.
• Rotate anything you have ever committed or exposed: tokens and keys in a working directory are stolen the moment the directory is indexed.
• Deception catches the recon: an amplification scanner touching a decoy is unambiguous, hostile, early signal.

Browse live finds or start free and hunt your own.