Threat Pulse W25 — Massive Scan Surge & Critical RCE Campaign Flood

Executive Summary

The week of 2026-05-29 to 2026-06-15 saw tarpit-lab.xyz record 564,734 inbound probes, a 262% increase over the previous week. The spike is attributable to a concentrated mass-scan operation originating primarily from cloud-hosted infrastructure in GB, RO, and US, combined with a coordinated wave of critical-severity RCE campaign probes that each registered virtually identical hit counts (~118,799), suggesting automated, templated tooling. Database credential brute-forcing and IoT default-password attacks also escalated across fake-postgres, fake-mysql, fake-redis, and fake-mongodb facades.

Attack Volume & Trends

Facade breakdown:

The fake-telnet facade absorbed over 70% of all traffic — a disproportionate concentration consistent with IoT-focused mass scanning (Mirai-lineage and derivatives). The near-uniform 118,799 hit count across four distinct critical RCE campaigns is a strong indicator of a single coordinated toolchain or botnet spray rather than independent threat actors.

Top Threat Actors

Key observations:

• DigitalOcean infrastructure accounts for two of the top five sources (GB and DE nodes), totalling ~145,000 events. Abuse reports to DigitalOcean are warranted.
• Romania contributes two distinct sources in the top five, collectively exceeding 44,000 events — consistent with the country's elevated appearance in broader geographic distribution data.
• GoDaddy-hosted infrastructure appearing at rank 5 suggests either a compromised customer VPS or deliberate abuse of shared hosting egress. This is atypical for GoDaddy and worth monitoring.
• All top-five actors are flagged as scan-dominant, suggesting they serve as initial reconnaissance nodes feeding downstream exploitation infrastructure.

Active Campaigns

Critical-Severity RCE Cluster

Four campaigns each registered ~118,799 hits this week — a statistical anomaly suggesting a single orchestration layer dispatching multi-exploit payloads simultaneously:

• Hikvision ISAPI RCE: Targets unpatched IP cameras and NVRs. Exploitation enables remote code execution without authentication. Widely exploited by botnets for DDoS recruitment.
• PHPUnit eval-stdin RCE (CVE-2017-9841): A legacy vulnerability still yielding results against misconfigured development environments with vendor dependencies left in production.
• Apache Path Traversal / RCE: Encompasses CVE-2021-41773/42013 and related Apache HTTP Server traversal chains. Still actively exploited despite patches being available since 2021.
• GeoServer OGC Filter RCE (CVE-2024-36401): A more recent critical flaw in GeoServer's OGC API evaluation. Its presence here indicates threat actors have fully operationalized this CVE into automated scan-and-exploit pipelines.

HTTP/2 PRI Method Probe

This probe sends the HTTP/2 connection preface (PRI * HTTP/2.0) to identify servers supporting HTTP/2, serving as a fingerprinting step ahead of protocol-specific exploitation. Its hit count aligns closely with the RCE cluster, reinforcing the coordinated-toolchain hypothesis.

Notable Paths & Techniques

Anomalous Signal: UNSTABLE

The path/token UNSTABLE appeared 32,454 times — far exceeding any other novel path and matching no known campaign signature. Possible interpretations:

• A botnet command-and-control heartbeat or probe identifier
• A fuzzer state label leaking into packet payloads
• A custom scanner tag used for internal tracking by the threat actor

This warrants elevated monitoring. If UNSTABLE recurs next week, correlation with source IPs and timing may reveal a distinct campaign or tool fingerprint.

Database Credential Attacks

Notable patterns:

• database=postgres probes against fake-postgres confirm targeted enumeration of exposed PostgreSQL instances, likely seeking to exploit default postgres superuser credentials.
• pass=xc3511 and pass=vizxv are factory-default credentials for Hikvision and Dahua devices respectively — directly corroborating the Hikvision ISAPI RCE campaign and IoT telnet scan volume.
• The credential list (admin, blank, password, 123456, 888888) represents a classic Mirai-lineage dictionary consistent with mass IoT compromise operations.

Geographic Distribution

The geographic spread is consistent with botnet-distributed scanning rather than nation-state-attributed operations. US, GB, NL, DE, and SG are predominantly cloud/hosting providers, indicating VPS abuse as the primary delivery mechanism. Indonesia's presence at rank 8 is characteristic of compromised consumer IoT devices being recruited into scan botnets.

Recommendations

1. Patch critical RCE vulnerabilities immediately — CVE-2024-36401 (GeoServer), CVE-2021-41773/42013 (Apache), CVE-2017-9841 (PHPUnit), and Hikvision ISAPI flaws are all actively exploited in the wild this week. Any exposed instances should be treated as potentially compromised.

1. Isolate or firewall IoT/camera devices — The volume of Hikvision-specific credentials (xc3511, vizxv) combined with ISAPI RCE probes indicates active targeting of camera and DVR infrastructure. Place these devices behind strict network segmentation with no direct internet exposure.

1. Harden PostgreSQL and MySQL externals — The database=postgres probe volume (13,273 hits) against port 5432 is substantial. Ensure database services are not internet-facing; enforce pg_hba.conf restrictions and disable default superuser remote login.

1. Block or rate-limit DigitalOcean CIDR ranges at perimeter if no legitimate traffic is expected from those networks. Two of the top five attacking nodes originate from DigitalOcean ASN across GB and DE regions.

1. Investigate the UNSTABLE token — Security teams running their own honeypots or network taps should log and tag any connections containing this string for correlation analysis. Its origin and purpose remain uncharacterized.

1. Disable HTTP/2 on externally-exposed services that do not require it, reducing the fingerprinting surface used in the HTTP/2 PRI probe campaign.

1. Submit abuse reports to DigitalOcean, GoDaddy, SS-Net, and Unmanaged Ltd for the top-volume source addresses. Cloud providers often act on abuse submissions, disrupting scan infrastructure operability.

1. Monitor for 262% volume spikes as a leading indicator — Such dramatic week-over-week increases often precede coordinated exploitation waves as scanning identifies targets ahead of follow-on attack phases.