Threat Pulse W20 — Sharp Volume Drop with Persistent RCE Campaign Pressure

Executive Summary

Week 20 (2026-05-05 to 2026-05-11) recorded 54,368 inbound probes against tarpit-lab.xyz sensors — a sharp 57.5% decline from the prior week. The drop is attributable almost entirely to reduced scan traffic, not a reduction in targeted exploitation activity. Five critical RCE campaigns continued operating at sustained intensity, and telnet-facing probes remained the dominant attack surface, accounting for 77.6% of all inbound events. Credential-stuffing patterns consistent with Mirai-family botnets were prominent across telnet and redis facades.

Attack Volume & Trends

Facade breakdown:

The telnet facade's dominance (77.6%) is disproportionate and consistent with automated botnet propagation sweeps. The scan-type classification of the top source IPs, combined with the high telnet share, strongly suggests mass TCP port 23 sweeps executed by a small number of coordinated source nodes. SSH and MySQL continued to receive sustained bruteforce pressure. HTTP/HTTPS attack volume was comparatively low this week, though the active RCE campaigns targeting web services indicate purposeful, low-noise exploitation rather than broad scanning.

Top Threat Actors

Key observations:

• Axarnet (ES) generated 22.7% of all weekly events from a single source IP, a highly anomalous contribution consistent with either a compromised host running an aggressive scanning tool or deliberate mass-probe infrastructure. Axarnet is a Spanish shared hosting and VPS provider; abuse of hosted infrastructure for scanning is a known pattern.
• GoDaddy (US) appears twice in the top five via two distinct source addresses, together contributing ~20% of total traffic. GoDaddy's shared cloud infrastructure is a recurring source of abusive traffic in honeypot telemetry across the industry, typically indicating compromised customer VMs.
• TELUS (CA) at rank 3 with 6,649 events from a single IP is similarly indicative of a compromised residential or small-business endpoint, given TELUS's primarily ISP role.
• Feo Prest SRL (TW) — the ASN-country combination (Romanian-registered ASN, Taiwanese geolocation) warrants attention as a possible VPN exit node or proxy infrastructure used to obscure origin.

Active Campaigns

Five critical-severity campaigns were detected this week, each recording 11,263 hits — an identical count that strongly suggests these campaigns share a common delivery infrastructure or were executed by a single coordinated threat actor running a multi-exploit toolkit against the same target pool.

Analysis:

The uniform hit count across all five campaigns is statistically improbable under independent operation and indicates a single automated toolchain cycling through a curated exploit list against a common set of target IPs. This pattern is characteristic of opportunistic mass-exploitation frameworks (e.g., tools modeled after nuclei or similar vulnerability scanners configured with a critical-CVE template pack).

• Hikvision ISAPI RCE targets network-attached cameras and DVRs — a primary recruitment vector for IoT botnets.
• PHPUnit eval-stdin (CVE-2017-9841) remains a persistent fixture in attack toolkits despite its age, owing to the large number of unpatched PHP development installations still reachable on the internet.
• Apache Path Traversal / RCE (referencing the CVE-2021-41773/42013 family) continues to see active exploitation years after disclosure.
• GeoServer OGC Filter RCE (CVE-2024-36401) is a more recent addition and its presence alongside legacy CVEs confirms the toolkit spans multiple CVE generations.
• Exchange ProxyLogon (CVE-2021-26855 et al.) remains a high-value target due to the continued existence of unpatched Exchange deployments.

Notable Paths & Techniques

Telnet Credential Stuffing

The pass= path family dominated novel probe activity, consistent with Mirai-variant botnet propagation:

The presence of xc3511 (Hikvision) and vizxv (Dahua) confirms targeting of IP camera and DVR ecosystems, consistent with Mirai and its descendants (e.g., Moobot, Satori). These devices are sought for DDoS botnet expansion.

Command Injection

• ;sh\n/bin/busybox (438 hits): Classic post-auth command injection payload used to confirm busybox availability on embedded Linux devices, a prerequisite step for Mirai-style dropper delivery.
• set (265 hits): Redis SET command probes on non-Redis facades, indicating scanners misconfiguring target selection, or deliberate cross-protocol probing.

Unknown / Protocol Noise

• UNSTABLE (4,273 hits): The highest-volume novel path. This string does not correspond to any known standard protocol command. Possible interpretations include: a non-standard botnet C2 beacon, a malformed telnet negotiation artifact, or a custom scanner identifier. The volume warrants continued monitoring for pattern development.
• / (415 hits): Bare root path HTTP GET requests; likely generic web crawlers or HTTP-over-telnet misroutes.

Geographic Distribution

Notes:

• The US, ES, and CA top three collectively account for 64.7% of all traffic, an unusually high concentration driven by the top-ranked individual source IPs. Remove those three sources and the distribution would likely normalize significantly.
• Romania (2,393 events) is notable in the context of Feo Prest SRL (Romanian ASN, Taiwanese geolocation). Romanian-registered network infrastructure has been observed in prior weeks as intermediary routing for Eastern European and Asian threat actors.
• China and Hong Kong combined (3,990 events, 7.3%) represent a reduction from typical baseline levels, possibly correlated with the overall volume drop.

Recommendations

1. Investigate UNSTABLE string origin: Deploy protocol-level capture on telnet facades to record full session context for the 4,273 UNSTABLE probes. If this is a botnet beacon or C2 keepalive, early characterization is valuable.

1. Harden Hikvision and Dahua device deployments: The combined pass=xc3511 / pass=vizxv / Hikvision ISAPI RCE campaign activity confirms active targeting of these device families. Operators should enforce firmware updates, disable UPnP, and isolate camera networks behind VLANs with no direct internet exposure.

1. Patch PHPUnit and legacy Apache installations: CVE-2017-9841 and CVE-2021-41773 continue to be exploited at scale. Any development or staging environment with internet-facing PHP should audit for vendor-supplied phpunit directories. Apache servers should be confirmed on 2.4.51 or later.

1. Apply GeoServer patches immediately: CVE-2024-36401 is a recent high-severity vulnerability appearing in a mature exploit toolkit, indicating rapid weaponization. GeoServer instances should be updated to 2.23.6 / 2.24.4 or later.

1. Flag GoDaddy and shared-hosting ASN traffic for enhanced scrutiny: Repeated appearance of major hosting provider ASNs in top attacker lists reflects infrastructure abuse. Network defenders may consider applying temporary rate-limiting or enhanced logging for inbound connections from high-volume shared hosting ranges during active campaign periods.

1. Monitor the coordinated five-campaign toolchain: The identical 11,263-hit count across all five RCE campaigns strongly implies a single actor or infrastructure. If new campaigns appear next week with the same hit count, this confirms a persistent automated operator warranting deeper tracking.