Threat Pulse W22 — Massive Scan Surge & Critical RCE Campaign Blitz

Executive Summary

The week of 2026-05-20 to 2026-05-25 saw a significant escalation in attack volume across the tarpit-lab.xyz honeypot sensor, with total inbound probes rising 44.5% to 369,533 events. The spike is attributable to two concurrent phenomena: a high-volume automated scan wave originating predominantly from cloud-hosted infrastructure in the US and Brazil, and a synchronized multi-campaign RCE blitz targeting known critical vulnerabilities in Hikvision, Apache, PHPUnit, and GeoServer. Credential-stuffing activity against Telnet-exposed services also intensified, with default IoT credentials dominating brute-force attempts.

Attack Volume & Trends

Facade breakdown:

The fake-telnet facade continues to dominate, consistent with automated IoT botnet recruitment activity. The relatively small share from HTTP/HTTPS facades belies their importance — the web-facing services attracted the most diverse and critical exploit attempts. Database service facades (MySQL, PostgreSQL, Redis, MongoDB) collectively received 5,898 hits, indicating persistent opportunistic probing for exposed backend services.

Top Threat Actors

Key observations:

• The top two sources alone account for ~56% of all weekly traffic (206,770 combined events), suggesting either highly active botnet nodes or large-scale automated reconnaissance tools hosted on cloud infrastructure.
• The Brazilian Oracle Corporation source is the single largest contributor at 122,671 events — a Brazilian-geolocated host on Oracle Cloud infrastructure is consistent with abuse of Oracle's free-tier cloud offering, a pattern seen across multiple threat intelligence feeds.
• Black Mesa Corporation (US) generating 84,099 events warrants close monitoring; this entity is not a well-known hyperscaler and may represent a VPS reseller or bulletproof-adjacent hosting provider.
• Two separate DigitalOcean nodes (US and CA) appear independently in the top five, indicating either multiple compromised droplets or coordinated use of DigitalOcean as a scanning platform. DigitalOcean abuse reports are recommended.
• All top-five actors are dominant in scan behavior, consistent with internet-wide port sweeping rather than targeted intrusion.

Active Campaigns

Synchronized Critical RCE Wave

Four distinct critical-severity RCE campaigns each registered exactly 64,858 hits this week, a near-certain indicator of a coordinated, automated tool or botnet module executing a bundled exploit payload list in lockstep.

Analysis:

• The identical hit count across four critical campaigns (64,858) is statistically near-impossible without coordination. This pattern indicates a single threat actor or botnet campaign deploying a multi-exploit scanner that tests all four vulnerabilities against each discovered target simultaneously.
• Hikvision ISAPI RCE targets IP cameras and NVR devices — exploitation yields persistent network footholds for surveillance or lateral movement.
• PHPUnit eval-stdin RCE (CVE-2017-9841) exploits a years-old but widely unpatched PHP testing framework endpoint; its continued prevalence reflects the long tail of unpatched legacy applications.
• Apache Path Traversal / RCE likely covers CVE-2021-41773 / CVE-2021-42013 or similar Apache HTTP Server vulnerabilities.
• GeoServer OGC Filter RCE (CVE-2024-36401) is a relatively recent critical vulnerability in the widely deployed open-source geospatial server, indicating attackers are rapidly operationalizing new CVEs.
• The HTTP/2 PRI Method Probe (64,864 hits, marginally higher) may serve as a service-discovery or fingerprinting step preceding the RCE attempts.

Notable Paths & Techniques

Anomalous Token: UNSTABLE

The single highest-volume novel path this week is the string UNSTABLE with 36,951 hits. This does not match any known web path or exploit signature. Possible interpretations:

• A botnet C2 beacon or identification string embedded in Telnet session data
• A firmware version string transmitted by compromised IoT devices during automated check-in
• A campaign tag or internal label from a threat actor's scanning tool

This signal warrants further protocol-level analysis. The volume (36,951) suggests it is not noise.

Credential Brute-Force Patterns

The pass= series of notable paths confirms active IoT credential stuffing, specifically targeting Telnet services:

The presence of pass=xc3511 and pass=vizxv confirms Hikvision and Dahua DVR/NVR targeting, corroborating the Hikvision ISAPI RCE campaign data. These credentials are historically associated with Mirai and its variants. The brute-force campaign is consistent with botnet recruitment activity targeting vulnerable IoT devices.

Geographic Distribution

US and Brazil together account for 78% of all observed traffic. The Brazilian concentration is largely attributable to the single top-ranked Oracle Cloud source. Romania, Luxembourg, Netherlands, and Bulgaria are consistent with European VPS/hosting abuse patterns commonly observed in botnet infrastructure. China's relatively modest share (1.5%) may reflect increased efficacy of GFW-related traffic shaping rather than reduced threat actor activity.

Recommendations

Immediate actions:

• Block or rate-limit Telnet (port 23) at the perimeter. With 90.6% of honeypot traffic targeting the Telnet facade, any production exposure of Telnet represents extreme risk. There is no legitimate use case for internet-exposed Telnet in 2026.
• Patch GeoServer immediately if deployed. CVE-2024-36401 is being actively exploited at scale (64,858 attempts this week). Upgrade to GeoServer 2.23.6, 2.24.4, or 2.25.2+.
• Audit Hikvision and Dahua devices on your network. Change default credentials immediately. Apply latest firmware. Isolate camera/DVR networks from corporate LAN segments.
• Remove or restrict PHPUnit from production environments. The eval-stdin.php endpoint (CVE-2017-9841) should never be reachable from the internet.

Detection & monitoring:

• Add detection rules for the UNSTABLE token in Telnet/TCP session captures — this unknown beacon warrants classification.
• Monitor for HTTP/2 PRI method requests (PRI * HTTP/2.0) as a precursor to multi-exploit scanning; block at WAF/load balancer layer.
• Implement geo-based rate limiting for BR and US cloud ASN ranges if legitimate traffic from these sources is not expected.
• Alert on credential attempts using xc3511, vizxv, 888888 — these are IoT botnet fingerprints and their presence indicates active Mirai-family recruitment.

Infrastructure hardening:

• Ensure database services (MySQL, PostgreSQL, Redis, MongoDB) are never directly internet-exposed. Bind to localhost or private network interfaces only.
• Require MFA and key-based authentication for all SSH access; disable password authentication entirely.
• Submit abuse reports to DigitalOcean and GoDaddy for the identified high-volume scanning nodes — both providers have active abuse response teams.