Russian-Speaking Operator Used an AI Copilot in a DDoS-Amplification Lab

Summary

A Huntback threat-intelligence investigation examined an exposed directory on host 84.32.34.6, hosted by UAB Cherry Servers in the Netherlands, and found a Russian-language operator environment that combined a plausible Rust game backend with offensive tooling. The central tool, ampscanner.py, probes DNS and other UDP services to measure the bandwidth amplification factor of potential reflectors. Its stated mode is read-only and uses a real source IP, but the measurements represent reconnaissance for a reflection-amplification DDoS: identifying services that can turn a small spoofed request into a larger response directed at a victim. A watchdog.sh script checks for ssh_daemon.py and relaunches it in a detached screen session when it stops, providing lightweight persistence across crashes and restarts. The directory also contained claude.md and persona.md files that describe an AI assistant's role in the operator's workflow. The agent configuration included a dangerously-skip-permissions flag, indicating that approval safeguards had been disabled for potentially destructive actions; the report says this kind of workflow artifact can persist even when the model provider changes. A GitHub token, private key, and other key-value credentials were also exposed. Russian comments and notes support a Russian-speaking-operator assessment, but the investigation does not attribute the activity to a named group. Sensors placed the host in the observed set on September 30, 2026. The report maps the activity to network-service discovery, reflection amplification, obtaining capabilities, and unsecured credentials in files, and recommends closing or rate-limiting exposed UDP services, rotating exposed secrets, and using decoys to detect hostile amplification reconnaissance.