Threat Pulse W14 — Massive Scan Surge & Multi-Vector Exploitation

Executive Summary

The tarpit-lab.xyz honeypot recorded 103,679 inbound probes between April 1–6, 2026 — a 140.6% increase versus the prior week. The spike is attributable to a small cluster of high-volume scanning sources, with the top five IPs collectively responsible for approximately 65% of all events. Attack activity spanned all monitored facades, with legacy protocol services (Telnet, SSH, MySQL) bearing the heaviest load. Five active campaigns generated over 61,000 combined hits, spanning credential harvesting, remote code execution, and sensitive file exposure techniques.

Attack Volume & Trends

Scans constituted 88.3% of all traffic, indicating mass automated reconnaissance rather than targeted exploitation as the primary driver of the volume surge. Bruteforce activity (8.9%) was concentrated on SSH and MySQL facades. RCE and path traversal attempts, while smaller in absolute count, are disproportionately high-value due to their exploitation intent.

Facade Breakdown

The Telnet facade's dominance strongly suggests botnet recruitment campaigns targeting embedded devices and legacy networking equipment. The near-parity between SSH and MySQL volumes is unusual and warrants attention.

Top Threat Actors

Key observations:

• The top source (BG/ColocaTel) generated 25.8% of all weekly events alone — highly anomalous and consistent with a coordinated scanning operation or compromised infrastructure being leveraged as a launch platform.
• Two Bulgarian sources combined for 32,357 events (31.2%), pointing to Bulgaria-hosted infrastructure as a significant operational hub this week.
• The DigitalOcean India source represents cloud-hosted scanning infrastructure — a common pattern where threat actors abuse elastic compute resources for reconnaissance.
• Unmanaged Ltd (RO) is a well-known bulletproof or permissive hosting provider frequently observed in threat actor infrastructure.

Active Campaigns

1. .env File Harvesting — 🔴 HIGH

• Type: Path Traversal | Hits: 12,613
• Automated probing for exposed .env configuration files commonly containing API keys, database credentials, and cloud service tokens. Targets Laravel, Symfony, and other framework deployments.

2. PHPUnit eval-stdin RCE — 🔴 CRITICAL

• Type: RCE | Hits: 12,532
• Exploitation of CVE-2017-9841, a known PHPUnit vulnerability allowing arbitrary PHP code execution via crafted POST requests to /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php. Despite being nearly a decade old, this exploit remains widely effective against unpatched development environments.

3. Git Config Exposure — 🟡 MEDIUM

• Type: Path Traversal | Hits: 12,329
• Probing for publicly accessible .git/config files that can expose repository metadata, remote URLs, and occasionally embedded credentials. Often used in reconnaissance chains.

4. FreePBX VoIP Scanner — 🔴 HIGH

• Type: RCE | Hits: 12,269
• Targeting FreePBX/Asterisk deployments for unauthenticated remote code execution. Successful exploitation can lead to toll fraud, eavesdropping, or full system compromise.

5. config.json Sensitive File Exposure Scan — 🟡 MEDIUM

• Type: Scan | Hits: 12,190
• Broad scanning for exposed config.json files across web roots, targeting application configuration data including credentials and connection strings.

All five campaigns are running at near-identical hit counts (~12,200–12,600), which is a statistical anomaly suggesting these may be driven by the same orchestrated toolset or botnet running parallel modules.

Notable Paths & Techniques

Several probe patterns were observed that do not map to known tracked campaigns:

Analyst notes:

• The ECCHI and UNSTABLE strings are anomalous and may represent custom scanner fingerprints or obfuscated command sequences. These warrant further behavioral analysis.
• The database=postgres pattern combined with elevated fake-postgres facade traffic (6,474 hits) indicates a coordinated PostgreSQL enumeration effort this week.
• The pass= credential series on Telnet/SSH facades follows classic IoT botnet recruitment patterns (Mirai variants and derivatives).
• The set command pattern targeting Redis aligns with known unauthenticated Redis exploitation techniques for persistence and lateral movement.

Geographic Distribution

Bulgaria and India together represent 60.8% of all traffic this week. This concentration is atypical and likely reflects specific infrastructure choices by the operators responsible for the scan surge rather than a broad geographic threat distribution.

Recommendations

1. Block or rate-limit traffic from AS ranges associated with ColocaTel Inc. (BG) and Tamatiya EOOD (BG) at perimeter. Both exhibited sustained high-volume scanning with no legitimate service justification.

1. Immediately audit for PHPUnit (CVE-2017-9841) exposure. Scan all web-facing servers for the presence of /vendor/phpunit/ paths. Remove dev dependencies from production deployments. This vulnerability should not exist in any production environment in 2026.

1. Restrict or block public access to .env, .git/config, and config.json paths via web server rules (deny directives in Nginx/Apache configs, WAF rules). These files should never be web-accessible.

1. Audit FreePBX/Asterisk deployments for available security patches and ensure admin interfaces are not internet-exposed without VPN or IP allowlisting.

1. Disable unauthenticated Redis access. Bind Redis to localhost or require requirepass authentication. Exposure to internet-facing interfaces enables trivial compromise.

1. Investigate ECCHI and UNSTABLE probe strings against full packet captures if available. These unrecognized patterns may indicate novel tooling or early-stage campaign reconnaissance that does not yet match published signatures.

1. Monitor PostgreSQL exposure. The spike in database=postgres probing combined with increased fake-postgres facade hits suggests active enumeration. Ensure PostgreSQL instances are not internet-exposed and use strong, non-default credentials.

1. Review Telnet exposure broadly. The facade's dominant share (37,358 hits) reflects continued mass targeting of Telnet-enabled devices. Any device with Telnet enabled and internet-facing should be treated as compromised or imminently at risk.