Threat Pulse W24 — Massive Scan Surge & Critical RCE Campaign Blitz

Executive Summary

The week of 2026-05-29 to 2026-06-08 recorded 391,261 inbound probes against tarpit-lab.xyz — a 150.8% increase over the prior week. The surge is attributable to two concurrent threat patterns: a high-volume Telnet scanning operation originating predominantly from a single DigitalOcean-hosted source, and a tightly synchronized burst of critical-severity RCE campaigns targeting known CVEs across HTTP-exposed services. Brute-force credential stuffing against Telnet and database facades also remained active, with default credentials dominating the password spray lists.

Attack Volume & Trends

Facade breakdown:

The fake-telnet facade absorbed nearly three-quarters of all traffic, an extraordinary concentration driven by what appears to be a systematic, large-scale port scanner operating out of DigitalOcean infrastructure. Fake-SSH maintained its expected bruteforce baseline. The HTTP/HTTPS facades, while lower in absolute volume, carried the highest-severity attack payloads.

Top Threat Actors

• The top source alone accounts for 123,150 events (31.5% of all weekly traffic), an extreme concentration indicating either a dedicated scanning tool or a compromised/rented VPS running automated mass-scan operations.
• DigitalOcean appears in three of the top five positions across three geographic regions (GB, NL, US), consistent with the well-documented pattern of threat actors renting low-cost cloud VPS instances for scanning infrastructure.
• The Romanian SS-Net source stands out as a non-major-cloud actor generating near-equivalent volume to top cloud sources, suggesting a dedicated or compromised host.
• GoDaddy-hosted infrastructure in position 5 may indicate a compromised customer hosting account rather than a purpose-built attack platform.

Active Campaigns

A striking feature this week is that four distinct critical-severity RCE campaigns each registered almost exactly 77,186 hits, and the HTTP/2 PRI probe registered 77,189 — a near-perfect volume alignment strongly suggesting coordinated or scripted campaign delivery from a shared toolset or botnet.

HTTP/2 PRI Method Probe [LOW]

• 77,189 hits | Type: Scan
• Probes for HTTP/2 upgrade support by sending the PRI * HTTP/2.0 preface to HTTP/HTTPS listeners.
• Primarily a service fingerprinting and enumeration step preceding higher-severity exploitation.

Hikvision ISAPI RCE [CRITICAL]

• 77,186 hits | Type: RCE
• Targets the well-documented Hikvision IP camera ISAPI authentication bypass and remote code execution vulnerability.
• Exploitation of this CVE enables unauthenticated command execution on exposed camera management interfaces, commonly used to recruit devices into IoT botnets.

PHPUnit eval-stdin RCE [CRITICAL]

• 77,186 hits | Type: RCE
• Exploits the legacy PHPUnit eval-stdin.php remote code execution flaw (CVE-2017-9841), which remains widely targeted due to the continued presence of exposed vendor/ directories in production web applications.

Apache Path Traversal / RCE [CRITICAL]

• 77,186 hits | Type: Path Traversal / RCE
• Targets Apache HTTP Server path traversal vulnerabilities, including the CVE-2021-41773/42013 family. Successful exploitation allows directory traversal and, where mod_cgi is enabled, remote code execution.

GeoServer OGC Filter RCE [CRITICAL]

• 77,186 hits | Type: RCE
• Exploits CVE-2024-36401, an unauthenticated RCE vulnerability in GeoServer's OGC filter evaluation. This is a recently disclosed and actively weaponized CVE that has seen sustained exploitation globally.

> Analyst note: The synchronized hit counts across four distinct critical campaigns strongly suggest these are being delivered by a single automated framework or botnet performing multi-payload sweeps against every discovered HTTP/HTTPS listener.

Notable Paths & Techniques

Unstable/Malformed Protocol Traffic

• UNSTABLE marker — 26,921 hits: A significant volume of connections produced protocol-level anomalies or incomplete handshakes. This is consistent with high-speed mass scanners that initiate connections without completing protocol negotiation, or with evasion techniques testing for non-standard service responses.

PostgreSQL Targeting

• database=postgres — 9,752 hits: Direct targeting of the default PostgreSQL database name, consistent with automated tools attempting to enumerate or authenticate against exposed Postgres instances.

Default Credential Brute-Force (Telnet/IoT)

A dense cluster of default and weak credentials was observed in credential spray activity:

• The presence of xc3511 (Hikvision) and vizxv / 888888 (Dahua) passwords directly correlates with the Hikvision ISAPI RCE campaign, confirming that attackers are combining credential spraying with CVE exploitation in a layered IoT device compromise strategy.
• This password list is consistent with Mirai botnet variants and derivatives, which have historically used these exact credentials to propagate across exposed IoT devices.

Geographic Distribution

• GB and US together represent 56% of observed probe traffic, though the GB concentration is almost entirely attributable to a single cloud-hosted IP, not broad national origin.
• Singapore's elevated volume is consistent with its role as a regional cloud hub in Southeast Asia, frequently used for attack staging.
• Indonesia's presence at this volume is characteristic of compromised endpoint devices (routers, DVRs, IoT) rather than deliberate cloud-based attack infrastructure.

Recommendations

1. Patch or isolate Hikvision and Dahua devices immediately. The convergence of CVE-targeting RCE campaigns and matching default credentials confirms active, automated exploitation attempts. Any internet-exposed CCTV/DVR management interfaces should be placed behind VPN or firewall controls.

1. Remove or restrict access to PHPUnit vendor directories in production. CVE-2017-9841 exploitation continues at scale. Audit web application deployments to ensure vendor/phpunit or similar paths are not publicly accessible.

1. Apply Apache HTTP Server patches for CVE-2021-41773/42013. These vulnerabilities remain heavily scanned; ensure running Apache versions are current and mod_cgi is disabled where not required.

1. Assess GeoServer exposure. CVE-2024-36401 is recently disclosed and seeing sustained exploitation. GeoServer instances should be updated to a patched release and access restricted to authorized networks.

1. Enforce non-default credentials on all Telnet/IoT/database services. The observed password spray list maps precisely to factory defaults. There is no operational justification for retaining these credentials on internet-facing systems.

1. Monitor for DigitalOcean-originated scanning traffic. Three of the top five sources this week used DigitalOcean infrastructure. Consider implementing temporary rate-limiting or tarpit rules for high-frequency connections from this ASN when not operationally required.

1. Disable Telnet entirely where not required. With 74% of probe volume targeting Telnet, the attack surface reduction from disabling this service is substantial. SSH with key-based authentication should replace Telnet in all cases.

1. Restrict PostgreSQL, MySQL, MongoDB, and Redis to localhost or VPN. Default-database probing activity confirms these services are being scanned at scale for unauthenticated or default-credential access.