Threat Pulse W21 — Massive Telnet Surge & Critical RCE Campaign Blitz

Executive Summary

The week of 2026-05-11 to 2026-05-18 produced the highest probe volume recorded by tarpit-lab.xyz to date: 296,633 inbound events, a 407% increase over the prior week. The surge was overwhelmingly concentrated on the fake-Telnet facade, accounting for 77.6% of all traffic. Simultaneously, five distinct critical-severity RCE campaigns were active in parallel, targeting Hikvision, PHPUnit, Apache, GeoServer, and Microsoft Exchange — suggesting coordinated multi-vector exploitation activity rather than opportunistic noise. IoT-focused credential patterns consistent with Mirai botnet variants were prominent across multiple facades.

Attack Volume & Trends

Facade breakdown:

The Telnet facade's dominance (+77.6% of traffic) is the defining characteristic of this week. This level of Telnet pressure is consistent with large-scale IoT device discovery sweeps, likely the reconnaissance phase of botnet recruitment. SSH bruteforce remained elevated as a secondary channel, and database facades (MySQL, Redis, Postgres, MongoDB) collectively absorbed ~5.2% of probes, indicating persistent interest in exposed data services.

Top Threat Actors

Key observations:

• The top three sources alone account for ~43% of all weekly traffic (127,687 events), indicating a small number of high-volume actors driving the spike.
• All top-5 sources are classified as scan-dominant, consistent with automated sweep tooling rather than targeted manual exploitation.
• Cloud and hosting infrastructure (Hetzner, Oracle Cloud, Thg Hosting) continues to be heavily abused as launch infrastructure — these IPs should be treated as compromised or rented scan nodes.
• The Romanian source via Unmanaged Ltd is notable; this ASN has appeared in prior Eastern European abuse clusters. Activity warrants monitoring for escalation beyond scanning.

Active Campaigns

Five critical-severity campaigns were simultaneously active this week, each recording 55,991 hits — an unusually uniform count suggesting these may be delivered by the same toolchain or coordinated actor infrastructure.

Analysis:

• The identical hit count across all five campaigns is a strong indicator that a single scanner or botnet is executing a bundled vulnerability probe list, cycling through all five CVE families per target rather than specializing.
• Hikvision ISAPI RCE targets Internet-exposed IP cameras and DVRs — a primary IoT botnet recruitment vector that aligns with the Telnet surge.
• PHPUnit eval-stdin (CVE-2017-9841) remains widely exploited despite being a 9-year-old vulnerability, reflecting the long tail of unpatched PHP deployments.
• Apache Path Traversal (likely CVE-2021-41773/42013) continues to be a reliable target for attackers seeking low-effort shell access.
• GeoServer OGC Filter RCE (CVE-2024-36401) is a relatively recent critical vulnerability; its presence confirms actors are integrating newer CVEs alongside legacy ones.
• Exchange ProxyLogon (CVE-2021-26855) targeting persists, indicating continued presence of unpatched on-premise Exchange servers in the wild.

Notable Paths & Techniques

Emerging / Uncategorized Paths

Technique highlights:

• The UNSTABLE token (28,050 hits) is the most anomalous entry. Its high volume and undefined classification suggest either a novel botnet beacon string, a fuzzing framework identifier, or a misconfigured probe. It warrants further investigation and signature development.
• Credentials xc3511 and vizxv are well-documented Mirai hardcoded passwords targeting Xiongmai and Dahua IP camera firmware. Their presence alongside the Telnet surge strongly confirms an active Mirai or Mirai-derivative botnet recruitment campaign.
• The ;sh\n/bin/busybox pattern is a classic IoT command injection payload used to fingerprint BusyBox-based embedded Linux systems and establish a foothold. Combined with the Hikvision RCE campaign, this indicates a multi-stage IoT compromise workflow: scan → probe credentials → inject shell command → recruit into botnet.
• The boat token may be a custom Mirai fork identifier; similar tokens have appeared in variants such as Satori and Moobot.

Geographic Distribution

Geographic notes:

• Germany, UK, and Australia together represent nearly 47% of traffic, driven almost entirely by three cloud-hosted scan nodes. This reflects infrastructure abuse rather than genuine geographic threat origin — the actual operators may be located anywhere.
• Bulgaria (11,011 events) is disproportionately high relative to typical baseline and warrants attention. Bulgarian-sourced traffic has historically been associated with Eastern European cybercrime clusters.
• China (11,276 events) contributes distributed scan and bruteforce activity across multiple ASNs, consistent with baseline patterns.
• The geographic spread across Western cloud providers (DE, US, GB, AU) underscores the challenge of geoblocking as a defensive measure — attackers deliberately route through reputable infrastructure.

Recommendations

Immediate actions:

1. Telnet / Port 23: If Telnet is exposed anywhere in your environment, disable it immediately. There is no legitimate reason to expose Telnet to the internet in 2026. This week's data confirms mass sweeping at unprecedented scale.

1. Patch Hikvision firmware: CVE-2021-36260 (ISAPI RCE) and related Hikvision vulnerabilities are actively being exploited. All internet-facing Hikvision devices should be patched or network-isolated behind strict ingress controls.

1. Validate PHPUnit removal: Ensure vendor/phpunit directories are not accessible via web root in any PHP application. The eval-stdin endpoint (CVE-2017-9841) should not exist in production deployments.

1. Audit Apache and GeoServer versions: Upgrade Apache HTTP Server beyond affected 2.4.49–2.4.50 versions. GeoServer deployments should be patched to remediate CVE-2024-36401.

1. Exchange on-premises: Organizations still running on-premises Exchange must ensure ProxyLogon patches (March 2021 CUs) are applied. Unpatched Exchange servers remain high-value targets.

Detection & monitoring:

• Add detection rules for the UNSTABLE token and boat strings in Telnet/protocol banners — these may indicate novel botnet C2 handshake patterns.
• Implement threshold-based alerting on Xiongmai (xc3511) and Dahua (vizxv) credential patterns across all network ingress points.
• Block or tarpan traffic from the top-5 source ASNs at perimeter if no legitimate business relationship exists with Hetzner, Thg Hosting, or Oracle Cloud egress ranges.
• Monitor for ;sh and busybox command injection strings in any protocol that accepts text input, including HTTP parameters, MQTT, and Telnet.

Strategic posture:

• The simultaneous multi-CVE campaign pattern (five critical campaigns, identical hit counts) suggests adversaries are using bundled exploitation frameworks. Defenders should assume that a single scanner may be testing for dozens of vulnerabilities simultaneously — patch breadth matters as much as patch speed.
• The Mirai-pattern IoT recruitment activity indicates a botnet build-up phase may be underway. Organizations with IoT/OT device inventories should audit default credentials and ensure management interfaces are not internet-exposed.