Threat Pulse W13 — First Week: tarpit-lab.xyz Baseline

Executive Summary

During the week of 2026-03-25 to 2026-04-01, tarpit-lab.xyz recorded 37,396 inbound probes across six emulated service facades. This is the sensor's first reporting period, so week-over-week trend comparisons are not yet available. The overwhelming majority of activity (98.6%) is classified as reconnaissance scanning, but targeted exploitation attempts — particularly PHPUnit eval-stdin RCE and Hikvision ISAPI RCE — indicate that opportunistic attackers are actively probing for vulnerable production services. Two source IPs alone account for over 35% of total probe volume, suggesting coordinated or automated sweep operations originating from Eastern European hosting infrastructure.

Attack Volume & Trends

Facade breakdown:

SSH and MySQL facades collectively absorbed 83.5% of all traffic, consistent with internet-wide automated scanning patterns that prioritize credential exposure on high-value remote access and database services. The fake-redis facade received a modest but notable 277 hits — Redis instances exposed to the internet remain a persistent target for unauthorized data access and in-memory payload injection. Telnet probe volume is low but non-zero, indicating legacy IoT-targeting tooling remains active.

Top Threat Actors

Key observations:

• The top two sources together account for 13,557 events (36.2%) of total weekly volume, a concentration level suggesting scripted, automated sweep tools rather than manual activity.
• The GB-attributed source resolves to UAB Host Baltic, a Lithuanian hosting reseller frequently associated with anonymizing infrastructure. Geographic attribution to GB is likely a billing artifact rather than true origin.
• The SC (Seychelles) source via FASTNET DATA INC is consistent with offshore VPS providers used to launder scan traffic.
• All top five sources show exclusively scan-dominant behavior, suggesting a separate layer of exploitation tools that may follow initial reconnaissance from different infrastructure.

Active Campaigns

PHPUnit eval-stdin RCE leads campaign hit counts this week. This vulnerability (CVE-2017-9841) is nearly a decade old, yet remains heavily exploited because unpatched or forgotten PHPUnit test dependencies persist in production web roots. The eval-stdin.php endpoint executes arbitrary PHP when reached — any exposure is an immediate full compromise.

Git Config Exposure ranks second. Automated tools scan for publicly accessible .git/config files to harvest repository URLs, credentials embedded in remotes, and branch metadata. This is low-effort, high-yield reconnaissance.

Spring Boot Actuator Exposure targets misconfigured Java applications that expose management endpoints (/actuator, /env, /heapdump, etc.) without authentication. These endpoints can leak environment variables, credentials, and enable RCE via logback or h2 console abuse.

Kubernetes serviceaccount secret harvesting attempts path traversal to reach /var/run/secrets/kubernetes.io/serviceaccount/token and related files. This indicates attackers are opportunistically probing containerized environments alongside traditional hosts.

Hikvision ISAPI RCE (CVE-2021-36260) targets network-attached IP cameras and NVRs. With millions of Hikvision devices globally, this campaign is consistent with ongoing IoT botnet recruitment activity.

Notable Paths & Techniques

The following paths generated significant hits outside of formally tracked campaigns and warrant attention:

Highlighted technique — Apache CGI path traversal (/cgi-bin/.%2e/...): This URL-encoded traversal pattern targets unpatched Apache 2.4.49/2.4.50 instances (CVE-2021-41773, CVE-2021-42013). With 27 hits this week as an untracked path, this should be elevated to a tracked campaign next reporting cycle if volume persists.

Redis command injection (set): The 123 hits against the fake-redis facade using the raw SET command confirm automated tooling is probing for unauthenticated Redis instances to write data — a common precursor to cron-based persistence or SSRF chaining.

Geographic Distribution

Bulgaria and Romania together represent 40.7% of total probe volume. This is disproportionate relative to internet population size and strongly suggests these countries' hosting environments host scanning infrastructure-for-hire or compromised servers used as scan relays.

Recommendations

1. Patch PHPUnit dependencies immediately. Any web application with phpunit in its vendor/ directory accessible from the web root is critically exposed. Remove test dependencies from production environments or block access to /vendor/ entirely at the web server level.

1. Audit Spring Boot Actuator exposure. Ensure actuator endpoints are either disabled in production or protected behind network-level controls and strong authentication. Environment and heap-dump endpoints are particularly dangerous.

1. Inventory internet-facing Hikvision devices. Apply firmware updates addressing CVE-2021-36260 and isolate camera networks from general-purpose infrastructure via VLAN segmentation.

1. Block unauthenticated Redis exposure. Redis instances must never be directly internet-accessible. Enforce requirepass configuration and bind only to loopback or trusted internal interfaces.

1. Protect .env and .git paths at the web server layer. Add explicit deny rules for /.env, /.git/, and related sensitive paths in Nginx/Apache configuration, regardless of application-layer protections.

1. Monitor for Apache CGI path traversal attempts. The /cgi-bin/.%2e/ pattern (CVE-2021-41773/42013) observed this week should trigger alerts in WAF and IDS rulesets. Ensure Apache is patched to 2.4.51 or later.

1. Consider threat-blocking Bulgarian and Romanian hosting ASNs at the perimeter if these sources do not represent legitimate user traffic. The concentration of scan volume from ColocaTel Inc. and Unmanaged Ltd warrants review for proactive blocking.