🛡️ **BREAKING: Internal Lateral Port Scan — nova-core Under Active Reconnaissance**
Published Saturday, October 03, 2026 at 03:03 PM PT BLUF: IPS detected rapid multi-port scan from 192.168.1.9 to 192.168.1.138 (nova-core) — 10 connection attempts in 60 seconds. Signature: lateral movement, internal origin. Pattern matches prior incidents on nova-core; investigation and source isolation required immediately. This is reconnaissance or active exploitation prep. DETAILS Detection: IPS alert triggered 2026-10-03; lateral_movement threat class, internal direction, action=detected. Attack vector: Host 192.168.1.9 initiated rapid sequential port connections to nova-core (192.168.1.138) — 10 distinct ports within 60-second window. Velocity and breadth consistent with active reconnaissance or service enumeration. Prior incidents: Nova memory records similar lateral scans on nova-core from 192.168.1.86 targeting 192.168.1.138; pattern repeats with different source IP. Open IPS Alert and Suspicious DNS warnings already flagged on nova-core as of 2026-10-02 (unacknowledged). Source status: 192.168.1.9 identity and ownership unconfirmed at this stage; internal-network origin means either compromised workstation or rogue VM/container. IMPACT ...