Threat Pulse W19 — Telnet Flood Dominates as RCE Campaigns Persist

Executive Summary

Tarpit-lab.xyz recorded 92,572 inbound probes between May 1–4, 2026, a 13.7% decrease from the prior week. Despite lower overall volume, attack diversity remained high: telnet scanning dominated at near-total share, while five critical remote code execution (RCE) campaigns continued operating at identical hit counts, suggesting coordinated or automated tooling. Brute-force credential stuffing against telnet targets featured a familiar IoT default-password list, consistent with Mirai-family activity.

Attack Volume & Trends

Facade breakdown:

The telnet facade continues to absorb an overwhelming share of traffic. The sharp concentration of events on a single facade and a single source IP (see below) partially explains the week-over-week volume decrease — activity appears dominated by one persistent scanning operator rather than broad multi-actor campaigns. SSH and MySQL remain secondary targets with consistent low-level pressure.

Top Threat Actors

Key observations:

• Actor #1 (24 SHELLS) is responsible for approximately 84.9% of all weekly events, an extraordinary concentration. This host is conducting high-velocity telnet scanning and is the primary driver of overall volume. Two separate 24 SHELLS-attributed IPs appear in the top 5, reinforcing this provider's role as an infrastructure source for scanning operations.
• DigitalOcean and Shock Hosting entries are consistent with recurring abuse of cloud VPS providers for opportunistic scanning — a persistent pattern across weekly sensor data.
• Contabo GmbH (FR) at rank 4 represents the only non-US top-5 actor this week, conducting scan traffic at moderate volume.
• All top actors are scan-dominant with no RCE or exploit classification, suggesting the critical campaign hits originate from a broader, lower-volume tail of sources not individually ranked.

Active Campaigns

Five critical-severity campaigns were recorded this week, each registering an identical hit count of 12,047, which strongly indicates automated batch scanning tools cycling through the same payload list in a single pass.

Analysis:

• The uniform hit count across all five campaigns is a strong indicator that a single tool or operator is running a multi-exploit scanner with a fixed payload list — each probe set is dispatched once per target cycle.
• Hikvision ISAPI and PHPUnit eval-stdin are perennial favorites targeting exposed IP cameras and legacy PHP applications respectively — both remain widely unpatched in the wild.
• Exchange ProxyLogon (CVE-2021-26855 and related chain) continues to see active exploitation attempts despite its age, reflecting the long tail of unpatched on-premise Exchange infrastructure.
• GeoServer OGC Filter RCE (CVE-2024-36401) is a relatively recent critical vulnerability; its presence alongside older CVEs confirms attackers are maintaining updated toolkits.
• Apache Path Traversal / RCE likely includes CVE-2021-41773/42013 payloads, which remain effective against misconfigured or unpatched Apache 2.4.x instances.

Notable Paths & Techniques

Unstable / Anomalous Path

• UNSTABLE recorded 11,950 hits — this label likely reflects malformed or protocol-violating connection attempts that the sensor could not parse into a clean path. At this volume, it may indicate a custom or broken scanner, a fuzzing tool, or a non-standard telnet dialect used by IoT botnet implants.

Credential Brute-Force (Telnet / SSH)

The following passwords were observed in active credential-stuffing attempts:

Key observations:

• The presence of xc3511 and vizxv is a definitive indicator of Mirai-family botnet propagation activity. These are hardcoded credentials from the original Mirai source code targeting Hikvision and Dahua DVR/NVR devices.
• The blank password probe (pass=) suggests attackers are also attempting authentication against devices with no password set.
• The overall password list is consistent with IoT-targeted botnet recruitment rather than targeted human-operated intrusion.

Geographic Distribution

Notes:

• The US share (94.7%) is atypically high and almost entirely attributable to the dominant 24 SHELLS actor. Absent that single source, the geographic distribution would likely be far more balanced.
• Bulgaria, Romania, and Netherlands are consistent recurring sources in European VPS-hosted scanning activity.
• Venezuela and Palestine appearing in the top 8 is worth monitoring; both have appeared in prior weeks and may reflect compromised infrastructure or regional VPN/proxy exit nodes rather than origin actors.

Recommendations

1. Block or rate-limit 24 SHELLS ASN traffic at perimeter if telnet exposure is not required. The concentration of 85% of weekly volume from this provider is operationally significant.

1. Patch or isolate Exchange, Apache, and GeoServer instances immediately if public-facing. ProxyLogon and GeoServer OGC RCE have public exploits and are being actively scanned.

1. Disable Telnet entirely on all IoT and network devices. Replace with SSH with key-based authentication. The Mirai credential list (xc3511, vizxv) targets devices that almost certainly support SSH as an alternative.

1. Enforce non-default credentials on all DVR/NVR, IP camera, and embedded systems. The password list observed this week is directly derived from manufacturer defaults.

1. Investigate UNSTABLE traffic at your perimeter: ~12K malformed connection attempts may evade signature-based detection. Ensure your IDS/IPS handles malformed protocol negotiation gracefully.

1. Monitor PHPUnit paths (/vendor/phpunit/) in web application logs. Legacy PHP dependencies are frequently left in production deployments and represent a trivially exploitable RCE surface.

1. Treat uniform campaign hit counts as a single-actor signal: when multiple distinct CVE exploits arrive at exactly equal volumes, this suggests one scanning operator. Blocking the source resolves all campaigns simultaneously.