Threat Pulse W17 — Sharp Volume Drop, RCE & Credential Harvesting Persist

Executive Summary

Week 17 (2026-04-13 to 2026-04-20) recorded 74,024 inbound probes — a significant 41.2% decline from the prior week. Despite reduced raw volume, the threat landscape remained qualitatively aggressive: five distinct campaigns generated over 9,000 hits each, spanning credential harvesting, remote code execution, and configuration exposure. The drop in volume likely reflects a shift in attacker infrastructure rather than reduced intent, as campaign hit counts remain disproportionately high relative to total probe volume.

Attack Volume & Trends

Facade breakdown:

SSH remains the single largest attack surface, absorbing nearly 49% of all probes. MySQL and Telnet together account for an additional 39%, indicating continued focus on credential-based access to database and legacy remote-management services. OT/ICS exposure via fake-modbus remains low but persistent.

The volume decline should be interpreted cautiously. The top five campaigns each individually exceeded 9,200 hits, suggesting that a smaller number of focused actors drove the week's activity rather than a broad reduction in threat actor participation.

Top Threat Actors

• ColocaTel Inc. (BG) was the single most active source, responsible for 15.3% of all weekly probes. Its activity was scan-dominant with no significant bruteforce or RCE component observed — consistent with reconnaissance or resale of scan data.
• Unmanaged Ltd (RO) followed closely, accounting for 12.7% of total volume. This pairing of Bulgarian and Romanian hosts forming a near-coordinated scanning bloc has been observed in prior weeks.
• ISAEV Igor (US-hosted infrastructure) operated across at least three IPs within the same subnet, collectively generating 6,377 events. The use of multiple IPs within a tight address range is consistent with distributed scan tool deployment or rate-limit evasion. All three IPs flagged scan as the dominant behavior.

No attribution beyond infrastructure hosting is implied for any of these actors.

Active Campaigns

1. .env File Harvesting — HIGH | 9,905 hits

Attempts to retrieve .env files containing application secrets, API keys, database credentials, and service tokens. Targets Laravel, Django, Node.js, and similar framework deployments. Consistently one of the most volume-heavy campaigns on this sensor.

2. PHPUnit eval-stdin RCE — CRITICAL | 9,633 hits

Exploitation of CVE-2017-9841, a well-known but still widely attempted vulnerability in PHPUnit's eval-stdin.php endpoint. Successful exploitation yields arbitrary PHP code execution. Despite the vulnerability's age, it remains effective against unpatched or legacy PHP environments.

3. FreePBX VoIP Scanner — HIGH | 9,344 hits

Targeted probing of FreePBX/Asterisk management interfaces. Attackers seek unauthorized access to PBX systems for toll fraud, call interception, or pivoting into internal networks. Activity levels suggest an ongoing, organized campaign rather than opportunistic scanning.

4. Git Config Exposure — MEDIUM | 9,312 hits

Probing for exposed .git/config and related repository metadata files. Successful retrieval can leak source code, internal hostnames, credentials embedded in commit history, and CI/CD pipeline details.

5. AI/LLM API Endpoint Enumeration — MEDIUM | 9,217 hits

Continued probing for AI and large language model API endpoints (e.g., OpenAI-compatible routes, locally hosted inference servers, Ollama, LM Studio). Attackers seek unauthenticated or weakly authenticated inference endpoints to abuse for free compute or data exfiltration.

Notable Paths & Techniques

Several paths with no existing campaign attribution were observed at meaningful hit counts this week:

Key observations:

• The set token at 656 hits aligns with Redis or key-value store exploitation attempts, consistent with the fake-redis facade receiving 1,626 hits this week.
• database=postgres probes against the fake-postgres facade suggest targeted service enumeration rather than generic scanning.
• The strings IZ1H9 and UNSTABLE are consistent with Mirai botnet variant identifiers or build tags embedded in exploit payloads — this warrants monitoring for escalation.
• The trio of high-entropy strings (leFEyidi, 5wx95LYh, 9KgWU9qQ) are likely auto-generated tokens used in credential stuffing, session fuzzing, or C2 check-in attempts.

Geographic Distribution

The US, BG, and RO top-three reflects concentrated hosting infrastructure rather than necessarily implying actor nationality. The prominence of Bulgaria and Romania is unusual and warrants continued tracking — this BG/RO cluster has now appeared prominently in multiple consecutive weeks.

Recommendations

1. Patch PHPUnit immediately. CVE-2017-9841 is nearly a decade old yet ranked second in this week's campaign activity. Any environment running an unpatched PHPUnit version is at critical risk of full code execution.

1. Restrict .env and .git file accessibility at the web server layer. Implement explicit deny rules for .env, .git/, .gitignore, and related dotfiles in Nginx/Apache configurations. These files must never be web-accessible.

1. Audit FreePBX/Asterisk deployments. Ensure management interfaces are not internet-exposed; enforce strong authentication and apply all available security updates. Consider IP allowlisting for admin panels.

1. Harden Redis and PostgreSQL service exposure. The set command and database=postgres probe patterns indicate active targeting of these services. Bind both to loopback or internal interfaces only; enforce authentication even on internal-facing instances.

1. Monitor for Mirai-family activity. The IZ1H9 and UNSTABLE identifiers are consistent with botnet variant tags. Operators of IoT or embedded Linux devices should ensure default credentials are changed and telnet/SSH access is restricted.

1. Block or rate-limit the BG/RO scanning infrastructure. The ColocaTel (BG) and Unmanaged Ltd (RO) ASNs accounted for over 28% of weekly probe volume combined. Organizations with no legitimate business from these ASNs may consider preemptive rate limiting or blocking at the perimeter.

1. Secure AI/LLM inference endpoints. Any locally hosted inference server (Ollama, LM Studio, vLLM, etc.) should be bound to localhost or protected by authentication middleware. Do not expose inference APIs directly to the internet.