Threat Pulse W23 — Mass Scan Surge & Critical RCE Campaign Blitz

Executive Summary

The week of 2026-05-29 to 2026-06-01 saw a sharp 32.7% spike in total inbound probes, reaching 207,040 events. A single GB-attributed source accounted for nearly 59% of all traffic, flooding the fake-telnet facade with automated scan activity. Simultaneously, five distinct critical-severity RCE campaigns ran in parallel against web-facing services, indicating coordinated or tooling-shared offensive operations. Brute-force credential stuffing against Telnet and Postgres services also remained persistently elevated.

Attack Volume & Trends

• Total probes this week: 207,040 (+32.7% vs. prior week)
• The volume spike is primarily attributable to a single high-rate scanning source (see Top Threat Actors).
• Telnet remained the dominant target by a wide margin, absorbing 89.5% of all traffic.

Key trend: The scan-to-bruteforce ratio remains high (≈6.4:1), consistent with an IoT/Telnet mass-enumeration phase preceding targeted credential attacks. RCE event counts, while smaller in absolute terms, represent high-severity exploitation attempts against known critical CVEs.

Top Threat Actors

Actor #1 (GB/DigitalOcean) is responsible for 121,986 events — 58.9% of all weekly traffic — exclusively scan-type, and almost entirely directed at the fake-telnet facade. This is consistent with a large-scale Mirai-variant or custom IoT enumeration tool operating from a rented VPS node. The traffic pattern suggests automated, stateless SYN/banner probing rather than interactive sessions.

DigitalOcean appears in three of the top five sources, accounting for approximately 72% of total traffic across GB, NL, and US-registered nodes. GoDaddy infrastructure contributes two additional high-volume sources. Both providers are commonly abused for short-lived offensive VPS operations due to easy provisioning and abuse-report latency.

Active Campaigns

Five critical-severity campaigns were observed this week, each recording 32,545 hits — an identical count that suggests these are being executed by the same toolset, actor, or coordinated campaign infrastructure running parallel exploit modules.

Analysis: The uniform hit count across all five campaigns is a strong indicator of a scripted mass-exploitation framework — likely a tool such as Nuclei, a custom scanner, or a botnet implant running a fixed template set. Targets span IoT devices (Hikvision), web frameworks (PHPUnit), web servers (Apache), enterprise GIS (GeoServer), and enterprise email (Exchange ProxyLogon/CVE-2021-26855). This breadth suggests opportunistic bulk exploitation rather than a targeted attack.

The Hikvision and PHPUnit vectors are perennial favorites for botnet recruitment and webshell implantation, respectively. ProxyLogon, despite being patched since 2021, continues to yield results against unpatched Exchange deployments.

Notable Paths & Techniques

Credential Brute-Force (Telnet/Postgres)

The following credential values were observed in brute-force attempts, primarily against fake-telnet and fake-postgres:

The presence of xc3511 and vizxv is consistent with Mirai-lineage botnet activity, as these are hardcoded credentials targeted by the original Mirai malware and its descendants. Combined with the Hikvision ISAPI RCE campaign, this week shows clear convergence on IP camera and DVR ecosystem exploitation.

Anomalous Path: UNSTABLE

An unusual path/token UNSTABLE recorded 19,995 hits and does not match any known campaign signature in the current database. This volume is too high to be noise. Possible interpretations:

• A probe token or session marker inserted by a specific scanning tool or implant
• A firmware version string or banner extracted from prior reconnaissance
• A new campaign or tool fingerprint not yet catalogued

This warrants continued monitoring and rule development.

Geographic Distribution

GB's outsized share (59.1%) is an artifact of a single VPS operator, not indicative of UK-origin threat actors. VPS provider attribution (DigitalOcean, GoDaddy) is more operationally meaningful than geolocation in this context.

Recommendations

1. Block or rate-limit DigitalOcean and GoDaddy ASN ranges at perimeter if these providers are not expected sources of legitimate traffic. The top-5 sources this week are exclusively from these two providers.

1. Patch Hikvision/Dahua devices immediately. The combination of ISAPI RCE exploitation and default credential attempts (xc3511, vizxv) indicates active botnet recruitment targeting these devices. Any internet-exposed IP cameras or DVRs should be audited.

1. Remediate PHPUnit eval-stdin exposure. Any production environment with PHPUnit accessible via web paths (particularly /vendor/phpunit/) is at critical risk. This is a trivially exploitable path that should not exist in production deployments.

1. Verify Exchange patching status. ProxyLogon (CVE-2021-26855) exploitation continues. Any on-premises Exchange server not patched to March 2021 or later is actively being targeted.

1. Investigate the UNSTABLE signature. With ~20,000 hits and no current campaign match, this token should be triaged for tooling identification. Correlation with full packet captures or session logs is recommended.

1. Enforce non-default credentials on all IoT and network devices. The brute-force credential list this week is a subset of the standard Mirai dictionary. Devices with any of the observed default passwords remain at high risk of compromise.

1. Monitor Postgres exposure. The database=postgres probe volume (2,323 hits) indicates active enumeration of PostgreSQL services. Ensure Postgres is not exposed to the public internet and authentication requires strong, non-default credentials.