Threat Pulse W18 — Massive Mirai Botnet Surge: 1.6M Telnet Hits in 48 Hours

Executive Summary

Week 18 (2026-04-28 / 2026-05-01) was dominated by an extraordinary Mirai-family botnet surge that overwhelmed all prior activity records. On April 30th and May 1st alone, the tarpit-lab.xyz sensor registered 1,630,000+ inbound Telnet probes — representing the two highest-volume days in sensor history by a factor of 40x over the weekly baseline. Total period volume reached 1,727,000+ events when combined with the preceding days. The attack pattern is unambiguous: coordinated IoT credential stuffing against the fake-telnet facade (port 23) using well-known Mirai botnet password lists (xc3511, vizxv, empty credentials), targeting Xiongmai and Dahua DVR/NVR hardware. The surge began abruptly on April 30th and remained at peak intensity through the time of publication, indicating an active, ongoing campaign. Despite the overwhelming Telnet volume, five critical-severity RCE campaigns maintained consistent pressure with identical hit counts — a structural anomaly suggesting templated or rate-limited tooling operating in parallel to the botnet activity.

Attack Volume & Trends

The dramatic volume drop should be interpreted cautiously. Large-scale scan operators are known to pause, rotate infrastructure, and resume — the underlying threat posture has not meaningfully changed. RCE and bruteforce activity remained structurally consistent with previous periods.

Facade breakdown:

Telnet accounted for 98.7% of all traffic, consistent with ongoing botnet recruitment and IoT targeting activity. Database facades (MySQL, MongoDB, Redis, Postgres) collectively attracted 2,390 probes, indicating persistent interest in exposed database surfaces.

Top Threat Actors

All five top sources were exclusively engaged in scanning activity. The top two sources alone accounted for approximately 45% of total weekly probe volume. The presence of multiple European budget VPS and hosting providers (SpectraIP, Contabo, MEVSPACE, Signet) is consistent with threat actors leasing cheap cloud resources for mass-scanning operations.

• SpectraIP B.V. (NL) and Signet B.V. (NL) together make the Netherlands the single largest source country (106,842 events), likely reflecting VPS abuse rather than domestic threat actors.
• Contabo GmbH (FR/DE infrastructure) is a recurring presence in honeypot telemetry globally; abuse reports to this ASN are frequently filed with limited effect.

Active Campaigns

Five campaigns each recorded 47,059 hits — an identical count that strongly implies these are executed by the same toolset or campaign operator using a templated scanner with a fixed probe budget per target.

Key observations:

• Hikvision ISAPI RCE continues to be a primary vector for IP camera compromise and botnet recruitment (Mirai variants).
• PHPUnit eval-stdin (CVE-2017-9841) remains active nearly a decade after disclosure, underscoring how long legacy vulnerabilities persist in unpatched environments.
• Apache Path Traversal (CVE-2021-41773/42013 family) targets misconfigured Apache servers for directory traversal and code execution.
• GeoServer OGC Filter RCE (CVE-2024-36401) is a more recent addition, confirming threat actors are integrating newly disclosed critical vulnerabilities quickly.
• Exchange ProxyLogon (CVE-2021-26855 family) remains a high-value target for initial access to enterprise mail environments.

The uniform hit count is anomalous and warrants attention — it may indicate rate-limiting in the tooling, a distributed quota system, or an artifact of how the campaign operator structures scan rounds.

Notable Paths & Techniques

UNSTABLE marker (58,868 hits): The UNSTABLE path label represents traffic that could not be classified into a known campaign. At 58,868 hits, this is the single largest category by raw count and warrants further signature development.

Credential stuffing — IoT default passwords:

The following password values were observed in bruteforce attempts against the fake-telnet facade:

• xc3511 and vizxv are well-known Mirai botnet credential pairs targeting Xiongmai and Dahua DVR/NVR hardware.
• The high volume of empty password attempts indicates targeting of devices with no authentication configured.
• The remaining passwords (admin, 123456, password, 888888, default) are universal IoT and router defaults used across dozens of device families.

This pattern is consistent with Mirai-family botnet propagation systematically attempting to recruit vulnerable embedded devices.

Geographic Distribution

European hosting infrastructure (NL + FR + PL + DE) dominates at 79.3% of attributed traffic, reflecting the continued preference for cheap, abuse-tolerant European VPS providers. Indonesia and Vietnam are likely contributing compromised IoT/residential nodes rather than hosted infrastructure, consistent with Mirai botnet geographic patterns.

Recommendations

1. Patch critical RCE vulnerabilities immediately. All five active campaigns target publicly known CVEs with available patches. Prioritize Hikvision ISAPI, GeoServer (CVE-2024-36401), PHPUnit, Apache, and Exchange ProxyLogon mitigations if not already applied.

1. Disable or restrict Telnet universally. Telnet represented 98.7% of attack surface contact. Any internet-facing device or service exposing Telnet should be considered compromised or imminently at risk. Replace with SSH; implement firewall rules to block port 23 at the perimeter.

1. Change all default credentials on embedded/IoT devices. The observed password list maps directly to known factory defaults. Mandatory credential rotation at provisioning is the primary mitigation for Mirai-style recruitment.

1. Block or rate-limit VPS ASNs with no legitimate user base. SpectraIP, MEVSPACE, and similar scan-heavy ASNs have negligible legitimate traffic profiles for most organizations. Perimeter blocks or aggressive rate-limiting are low-risk, high-value controls.

1. Investigate the UNSTABLE category. The 58,868 unclassified hits represent the largest single traffic category. Organizations running their own sensors should prioritize signature analysis of this traffic to identify emerging attack patterns.

1. Monitor for GeoServer exposure. CVE-2024-36401 is a recent critical-severity vulnerability; its inclusion in active automated campaigns confirms it is being weaponized at scale. Audit public-facing GeoServer deployments immediately.

1. Treat the volume drop skeptically. A 75.2% week-over-week decrease does not indicate reduced adversary capability. Scan infrastructure rotation is common; assume scanning resumes at or above prior levels in coming weeks.