This case-focused release accompanies the technical report . It covers 35 Apache-parent shell events: A01–A03 from 15.204.59.70 and B01–B32 from 162.35.99.94 . T1–T3 are stable aliases for the three targets. The original sealed segments and packet captures are retained privately.
Each episode-a/Axx/ or episode-b/Bxx/ folder has:
index.json locates the cases. SHA256SUMS hashes every released file except itself. Check it with shasum -a 256 -c SHA256SUMS on macOS or sha256sum -c SHA256SUMS on Linux. A selected .log file may be empty.
Selection and changes
For each case, the capture contains the named source's target-side HTTP/80 packets from 15 seconds before its preceding disclosure record to 65 seconds after the shell start. Adjacent cases can overlap; do not sum their packet or log counts as unique traffic. The web records are selected by source address and time; PHP/Apache errors are selected by time; Tetragon descendants are selected by PID lineage. This release does not include unrelated sources, HTTPS traffic, or later operational changes. All confirmed execution-stage requests used HTTP/80, so there is no corresponding Finch case flow.
The only value substitutions are:
Honeypot addresses: target addresses in packet headers and literal target addresses in HTTP or log text use stable TEST-NET aliases. T1–T3 have packet-target aliases 192.0.2.11 – 192.0.2.13 and application-address aliases 198.51.100.11 , 198.51.100.1 , and 198.51.100.12 , respectively. An IP-encoded target hostname is changed consistently. Tetragon's base64 exec_id and parent_exec_id values encode a private host address; only that decoded host prefix is substituted before re-encoding, preserving the unique suffix and parent-child joins. Source addresses are unchanged.
Memory disclosure: oversized PHPSESSID values are masked in packet captures. In web.jsonl , that one field becomes PHPSESSID=[REDACTED_MEMORY_DISCLOSURE] plus its original attributes, with original encoded length, decoded length and decoded SHA-256 in setCookieRedaction . Other cookie values and HTTP headers are retained.
Current page identity: HTML generated by the target's index page is replaced with a neutral, valid HTML page of the same byte length. PHP warnings before the HTML are retained. This prevents the historical page title and markup from identifying a still-served page; the replacement is synthetic evidence content, not a claim what the target originally displayed.
The PCAPs are per-case derivatives of the original PCAPNG rotations. Packet selection and conversion to classic Ethernet PCAP remove PCAPNG interface/options metadata. Target-address edits change IP/TCP checksums; all payload substitutions preserve TCP byte lengths and sequence space. The original capture hashes in case.json are provenance references, not hashes of the released PCAPs . The original request-body hashes can differ where a literal honeypot address was substituted.
Release validation checked 254,784 packets and all 35 Apache-parent shell records. Reassembled request streams were compared with the original captures after only the declared honeypot-address substitutions; response streams were compared outside the disclosed cookie values and substituted page HTML.
Other response headers, PHP error bodies, request bodies, Apache fields, Tetragon fields and signal fields are not normalized or masked. Original node/run/container identifiers and source IPs remain in the selected logs. The oversized cookie bytes and original HTML are not available in this public copy, so it supports independent review of the request-to-process execution chain but not byte-for-byte reconstruction of the disclosed heap.
Start with case.json to identify the execution source port, then follow that TCP stream in traffic.pcap.gz and compare its timing with tetragon.jsonl . The execution-stage access record can be absent when the worker crashes. Error files may include neighboring activity because their windows overlap.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
