MITRE ATT&CK & campaign report

Key findings

• Discovery is the dominant tactic: 94% of hostile detections, from 400 source IPs.
• 44 source IPs attacked on more than one day (persistent campaigns); the longest ran 3 days.
• Attack timing is statistically non-uniform (p = 0.0e+00); the busiest hour is 06:00 UTC.
• Attackers switch between tactics often (multi-stage probing): the average self-transition probability is 0.38.
• The largest shared-opener cluster has 107 IPs starting with /wp-admin/install.php?step=1.
• 25 /24 networks sent attacks from 2+ addresses; the most addresses came from 66.132.195.0/24 (AS398324 Censys, Inc.): 15 IPs, 30 detections.
• 4 groups of attackers probed near-identical path sets (Jaccard ≥ 0.5); the largest has 15 IPs.
• Top source network: AS396982 Google LLC (1,542 detections from 41 IPs).

Overview

MITRE ATT&CK tactic distribution

Technique breakdown

Top attacking IPs (edge layer)

Persistent attackers (active on 2+ days)

Two-layer coverage

The Apache layer's detections are not yet stored separately in the database, so a layer-by-layer comparison is not shown. It appears here once they are (run with --apache-source).

Temporal pattern

Chi-square test of hour-of-day uniformity: χ² = 5,625.3, df = 23, p = 0.00e+00 → non-uniform (structured, campaign-like timing).

Day-of-week test needs a window of at least 14 days.

Attack sequences (Markov chain)

Each cell is the probability that an attacker's next request uses the column tactic, given the row tactic. A strong diagonal means attackers stay with one tactic (automated tooling).

Botnet fingerprinting (shared opening request)

Source IPs that opened with the exact same request are likely running the same tool or belong to the same botnet.

Subnet clusters (several attacking IPs in one /24)

Multiple addresses from the same /24 network usually belong to one operator rotating addresses to avoid per-IP bans.

Attack-sequence similarity

Similarity 1.0 means two IPs requested exactly the same set of paths. Groups use a threshold of 0.5; they reveal shared tooling even when the opening request differs.

Threat-actor profiles

Generated each run from the shared-opener clusters with 3+ IPs. Rating: HIGH for 10+ IPs or tactics beyond reconnaissance/discovery, MEDIUM for 5+ IPs.

Where attacks come from