Threat Pulse W16 — Scan Dominance & Multi-Campaign RCE Pressure

Executive Summary

The tarpit-lab.xyz honeypot recorded 125,604 inbound probes during the week of April 6–13, 2026, a modest decline of 5.8% from the prior week. Despite the volume dip, attack quality remained high: four campaigns rated high or critical severity generated over 42,000 combined hits, with PHPUnit eval-stdin RCE and .env file harvesting leading the charge. A single Bulgarian IP source accounted for roughly 35% of all weekly events, indicating a concentrated, automated scanning operation. Database service facades (MySQL, PostgreSQL, Redis, MongoDB) collectively absorbed over 50,000 probes, underscoring continued adversary interest in exposed data-layer services.

Attack Volume & Trends

Scan traffic continues to dominate, comprising over 91% of all inbound events. The slight overall volume decrease does not reflect reduced adversary activity — rather, the top Bulgarian source alone drove 44,173 events, meaning removal of that single actor would make underlying distributed activity appear significantly quieter.

Facade breakdown:

MySQL, SSH, and Telnet together account for 89.3% of all probes. The continued pressure on Telnet is consistent with IoT botnet recruitment activity. The fake-modbus facade, while low in absolute numbers, represents persistent adversary interest in industrial control system (ICS) protocols.

Top Threat Actors

Actor highlights:

• BG / ColocaTel Inc. — The week's dominant source, generating 44,173 events. The volume and behavioral profile are consistent with a rented VPS or compromised host running an automated internet-wide scanner (e.g., Masscan or Zmap derivative). The concentration on a single IP warrants monitoring for infrastructure reuse across future weeks.
• VN / VNPT — 15,212 events from Vietnam's national telecom provider. Vietnam-origin scanning at this scale often originates from compromised consumer or SMB endpoints rather than direct threat actor infrastructure.
• RO / Unmanaged Ltd — 10,263 events. The provider name and Romanian hosting environment are consistent with bulletproof or permissive hosting commonly leveraged by automated scanning operations.
• GB / UAB Host Baltic — Lithuanian-registered ASN resolving to a GB-geolocated IP, a pattern typical of VPN exit nodes or proxy infrastructure.
• PE / Red Científica Peruana — A research network address generating over 2,200 events. Could represent legitimate security research scanning or a compromised academic host.

Active Campaigns

Campaign analysis:

• PHPUnit eval-stdin RCE (Critical) — Exploitation of CVE-2017-9841, a nearly decade-old vulnerability in PHPUnit's eval-stdin.php endpoint. Its continued prevalence confirms that many production PHP environments remain unpatched or retain legacy test artifacts in web roots. Successful exploitation yields direct remote code execution.

• .env File Harvesting (High) — Automated retrieval of .env configuration files exposed at web root. These files routinely contain database credentials, API keys, and application secrets. The 11,116 hits this week suggest broad, opportunistic credential harvesting campaigns.

• Git Config Exposure (Medium) — Probing for exposed .git/config files, which can reveal repository URLs, branch structures, and sometimes embedded credentials. Often a precursor to source code exfiltration.

• FreePBX VoIP Scanner (High) — Active scanning for vulnerable FreePBX/Asterisk installations. Successful compromise enables toll fraud, eavesdropping, and lateral movement into internal networks. The 10,236 hits indicate a sustained, targeted campaign.

• Spring Boot Actuator Exposure (High) — Probing for unauthenticated Spring Boot Actuator endpoints (/actuator, /env, /heapdump, etc.). Exposure can lead to environment variable disclosure, heap dump extraction containing secrets, or RCE via /actuator/gateway in certain configurations.

Notable Paths & Techniques

Several probes were observed that do not map to known tracked campaigns but warrant attention:

Key observations:

• The LZRD and UNSTABLE strings are unusual and may represent custom tooling or an emerging campaign. Their high hit counts (2,268 and 633 respectively) suggest automated, repeated transmission rather than manual probing. These warrant continued tracking.
• The Mirai credential 7ujMko0admin confirms active IoT botnet recruitment attempts, consistent with the high Telnet facade traffic.
• The ; command injection delimiter appearing 179 times across facades indicates scanners probing for shell injection vulnerabilities in web applications and embedded device interfaces.

Geographic Distribution

Bulgaria's outsized share is attributable to a single actor. Excluding that source, Vietnam and Romania would lead, both reflecting a pattern of scanning originating from either compromised endpoints or permissive hosting environments. US-origin traffic at 10,406 events reflects the distributed nature of US-hosted cloud and VPS infrastructure commonly leveraged by threat actors globally.

Recommendations

1. Block or rate-limit the top scanning IPs at perimeter — The Bulgarian ColocaTel IP accounted for 35% of weekly volume. Organizations should ensure automated threat feeds propagate this type of high-volume single-source traffic to firewall blocklists promptly.

1. Remediate PHPUnit test artifacts immediately — The presence of eval-stdin.php in production is entirely avoidable. Audit web roots for test framework files and remove them. This critical-severity campaign has been active for years and continues to find victims.

1. Protect .env and .git directories at the web server level — Explicitly deny access to .env, .git/, .htpasswd, and similar sensitive paths via web server configuration. These files should never be web-accessible.

1. Restrict Spring Boot Actuator endpoints — If Actuator endpoints are required, enforce authentication and restrict access to management networks only. Disable endpoints that expose environment variables or allow heap dumps in production.

1. Audit FreePBX/VoIP installations — Apply all current security patches to FreePBX and Asterisk deployments. Restrict management interfaces to trusted IP ranges and disable unused modules.

1. Investigate LZRD and UNSTABLE strings — If these strings appear in production logs, treat them as indicators of compromise or active scanning. Cross-reference against threat intelligence feeds; their origin remains unclear and warrants further analysis.

1. Change all default IoT credentials — The presence of Mirai-associated credentials (7ujMko0admin) in probe traffic confirms ongoing IoT botnet recruitment. Ensure all network-connected devices have unique, non-default passwords and that Telnet is disabled where not required.

1. Monitor Modbus/ICS exposure — Despite low absolute numbers (378 hits), Modbus probing against internet-facing sensors is a significant indicator. Ensure ICS/SCADA systems are not directly reachable from the public internet.