Threat Pulse W18 — RCE Surge & Credential Harvesting Dominate

Executive Summary

Week 18 (2026-04-20 to 2026-04-27) recorded 86,947 inbound probes, a 7.7% increase over the prior week. The threat landscape was dominated by four critical-to-high severity campaigns combining remote code execution attempts against PHP-based applications and VoIP infrastructure with aggressive cloud credential harvesting via path traversal. SSH and Telnet facades continued to absorb the majority of raw probe volume, while the HTTP/HTTPS surface attracted the most dangerous exploitation attempts. Two Bulgarian and Romanian source IPs alone accounted for over 23% of total weekly traffic, suggesting coordinated or botnet-driven scanning infrastructure.

Attack Volume & Trends

Facade breakdown:

The scan category remains overwhelmingly dominant at 81.9% of all events, consistent with mass internet-scanning operations ahead of targeted exploitation. RCE at 9.3% and brute force at 7.9% reflect deliberate follow-on activity after initial host discovery.

Top Threat Actors

Key observations:

• The Bulgarian (ColocaTel Inc.) and Romanian (Unmanaged Ltd) sources together generated ~23.2% of all weekly traffic. ColocaTel Inc. is a known provider with repeated appearances in honeypot telemetry, suggesting either persistent abuse or deliberate hosting of scanning infrastructure.
• The Polish source (ISAEV Igor) is a named individual ASN — a pattern often associated with single-operator scanning tools or resold VPS abuse.
• The US Comcast source is unusual; consumer ISP addresses at this probe volume often indicate compromised residential hosts participating in a botnet.
• MX (Total Play) volume likely reflects an infected end-user device rather than intentional hosting given the residential/SMB ISP profile.

Active Campaigns

🔴 CRITICAL — AWS Credential File Harvesting

• Type: Path Traversal
• Hits: 15,761
• Target: /.aws/credentials, related cloud configuration files
• Attackers systematically probe HTTP/HTTPS facades for exposed AWS credential files, often left accessible via misconfigured web roots or Docker volume mounts. Successful exfiltration grants full programmatic AWS access. Volume at this level indicates automated tooling across wide IPv4 ranges.

🔴 CRITICAL — PHPUnit eval-stdin RCE

• Type: RCE
• Hits: 16,058
• CVE Reference: CVE-2017-9841
• A long-known but persistently exploited vulnerability in PHPUnit's development test endpoint (/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php). Attackers POST arbitrary PHP code for server-side execution. Despite being a 2017 CVE, continued high hit counts confirm many deployments remain unpatched or developers leave test dependencies in production builds.

🔴 HIGH — .env File Harvesting

• Type: Path Traversal
• Hits: 16,506 (highest campaign volume this week)
• Probing for exposed .env files across HTTP/HTTPS surfaces, targeting Laravel, Symfony, Node.js, and similar framework deployments. These files commonly contain database credentials, API keys, and application secrets. The campaign volume suggests widespread automated tooling.

🔴 HIGH — FreePBX VoIP Scanner

• Type: RCE
• Hits: 15,887
• Targets FreePBX/Asterisk management interfaces for unauthenticated remote code execution. Compromised VoIP systems are typically monetized via toll fraud or used as lateral movement pivot points. The sustained hit count places this among the week's most active campaigns.

🔴 HIGH — ThinkPHP invokefunction MD5 Probe

• Type: RCE
• Hits: 15,758
• Exploits ThinkPHP's invokefunction controller method to execute arbitrary PHP functions. The "MD5 probe" pattern refers to attackers injecting a known string and comparing the MD5-hashed response to confirm code execution — a blind RCE verification technique. Primarily targets Chinese-language web ecosystems where ThinkPHP is widely deployed.

Notable Paths & Techniques

Several probe patterns appeared at significant volume this week outside of the named campaigns:

Analyst notes:

• The UNSTABLE, boat, and IZ1H9 strings are strongly associated with Mirai botnet variants, specifically targeting Telnet-exposed IoT devices. IZ1H9 has been linked to a specific Mirai fork documented in prior threat intelligence, suggesting coordinated IoT recruitment activity.
• pass=admin and pass=default confirm ongoing default credential sweeps across MySQL and Telnet facades.
• database=postgres combined with elevated fake-postgres traffic suggests targeted enumeration of PostgreSQL instances, possibly looking for trust-authenticated or default-credential deployments.
• The backup1 path likely represents attempts to discover exposed database dumps or backup archives accessible via HTTP.

Geographic Distribution

The US leading in raw volume with Comcast (consumer ISP) as the top domestic source strongly suggests compromised end-user devices rather than deliberate offensive infrastructure. BG and RO concentration in single ASNs is more consistent with deliberate scanning infrastructure or tolerated abuse hosting. CN volume correlates with the ThinkPHP campaign targeting Chinese-language application deployments.

Recommendations

1. Patch PHPUnit dependencies immediately. CVE-2017-9841 remains one of the most actively exploited vulnerabilities on this sensor. Audit all production deployments for residual /vendor/phpunit paths and remove development dependencies from production builds.

1. Audit HTTP-accessible sensitive files. Implement web server rules to deny access to .env, .aws/credentials, wp-config.php, and similar files at the server configuration layer (Nginx/Apache deny directives or equivalent). Do not rely solely on application-layer protection.

1. Restrict FreePBX/Asterisk management interfaces. These should never be internet-exposed. Place behind VPN or firewall with allowlist-only access. Apply all current patches.

1. Block or rate-limit the top scanning ASNs. ColocaTel Inc. (BG) and Unmanaged Ltd (RO) are generating nearly a quarter of all sensor traffic. Organizations with internet-facing assets should consider adding these ASNs to threat intelligence blocklists or implementing aggressive rate limiting.

1. Monitor for Mirai IoT recruitment. The presence of IZ1H9, boat, and UNSTABLE tokens on Telnet facades indicates active IoT botnet recruitment operations. Any Telnet-exposed devices on organizational networks should be immediately firewalled or decommissioned.

1. Protect Redis and PostgreSQL from internet exposure. Default-configuration Redis (no authentication) and PostgreSQL (trust auth) remain trivially exploitable. These services should bind only to localhost or internal interfaces and never be directly internet-accessible.

1. Review cloud credential management. The AWS Credential Harvesting campaign volume (15,761 hits) is critical-severity. Ensure IAM credentials are not stored in web-accessible directories and rotate any credentials that may have been exposed. Consider using IAM roles instead of static keys where possible.