Threat Pulse W26 — Massive Surge: Telnet Storm & Critical RCE Blitz

Executive Summary

The tarpit-lab.xyz sensor recorded 841,504 inbound probes between May 29 and June 22, 2026 — a staggering +439.5% increase versus the prior week. The surge is driven by two converging forces: a high-volume telnet scanning campaign originating primarily from cloud-hosted infrastructure, and a synchronized wave of critical-severity RCE probes hitting four distinct vulnerability classes simultaneously. The volume and timing uniformity across RCE campaigns strongly suggests coordinated botnet or scanning-as-a-service infrastructure. IoT default credential patterns (Mirai-family strings) are prominent in credential probe data, indicating active device recruitment activity.

Attack Volume & Trends

Facade breakdown:

The fake-telnet facade accounts for nearly three-quarters of all traffic, an extraordinary concentration. This is not organic — it reflects deliberate, high-throughput scanning likely associated with IoT botnet propagation. The SSH facade at 15.5% continues its baseline role as the primary credential-brute target. Database facades (PostgreSQL, MySQL, Redis, MongoDB) collectively received ~7.5% of hits, reflecting persistent opportunistic database exposure hunting.

RCE-category probes at 21,039 events represent a disproportionately dangerous slice: while small in volume relative to scans, each represents an active exploitation attempt against known critical vulnerabilities.

Top Threat Actors

Key observations:

• DigitalOcean appears twice in the top five (GB and DE nodes), contributing a combined ~145,000 events — nearly 17% of total weekly volume from a single cloud provider's infrastructure. This is a well-documented pattern of threat actors abusing low-cost VPS provisioning for scanning operations.
• Romanian sources appear twice (SS-Net and Unmanaged Ltd), together generating over 58,000 events. Romania has been a recurring origin in prior weeks and likely reflects standing scanning infrastructure, not ad-hoc activity.
• GoDaddy (US) presence at ~17,700 events suggests compromised or abused shared hosting infrastructure rather than dedicated attack nodes.
• All top-five actors are classified as scan-dominant, consistent with the overall traffic profile of this week.

Active Campaigns

Synchronized RCE Wave (~175,785 hits each)

Four critical-severity campaigns each recorded exactly 175,785 hits this week — a statistical near-impossibility under organic conditions. This uniformity is a strong indicator of automated, coordinated scanning infrastructure executing a bundled vulnerability checklist in a single pass.

Campaign profiles:

• Hikvision ISAPI RCE: Targets a well-known unauthenticated RCE in Hikvision IP cameras via the ISAPI interface. Active exploitation of this class leads to camera hijacking and botnet enrollment. Aligns with the heavy telnet/IoT scanning theme of this week.
• PHPUnit eval-stdin RCE (CVE-2017-9841): A 2017-era vulnerability in PHPUnit's development endpoint. Its continued heavy exploitation reflects the longevity of unpatched legacy PHP applications in production environments.
• Apache Path Traversal / RCE: Covers the Apache HTTP Server path traversal family (including CVE-2021-41773/42013). Targets misconfigured Apache instances for directory traversal leading to code execution.
• GeoServer OGC Filter RCE (CVE-2024-36401): A more recent critical vulnerability in GeoServer's OGC filter evaluation. Its inclusion alongside older CVEs confirms attackers are maintaining up-to-date exploit inventories.
• HTTP/2 PRI Method Probe: A protocol-level scanner fingerprinting HTTP/2 support. Low severity on its own but serves as a reconnaissance prerequisite for targeted HTTP/2-specific attacks.

Notable Paths & Techniques

IoT Botnet Credential Patterns

The notable new paths data reveals a clear Mirai-family botnet propagation signature:

IZ1H9 and UNSTABLE are documented Mirai botnet variant identifiers used in payload headers and self-identification strings. Their appearance at 40k+ and 33k+ hits respectively confirms active Mirai-descendant propagation against IoT devices this week.

pass=xc3511 and pass=vizxv are hardcoded credentials associated with Xiongmai-based DVRs and Dahua-branded cameras — device classes known to have been compromised en masse since the original Mirai outbreak in 2016. Continued probing of these credentials indicates exploitation of still-unpatched or factory-reset devices.

database=postgres at ~21k hits reflects automated PostgreSQL reconnaissance attempting to enumerate accessible databases, consistent with the elevated fake-postgres facade traffic.

Geographic Distribution

The US, UK, NL, DE, and SG sources are overwhelmingly cloud/VPS-hosted, not residential. This underlines that geographic attribution to these countries reflects cloud provider abuse, not necessarily threat actor location. Romania is the notable exception, where dedicated scanning ASNs (SS-Net, Unmanaged Ltd) suggest purpose-built scanning infrastructure.

China at ~53k events maintains a consistent background level without dominating this particular week's spike, which is atypical — the surge is primarily Western cloud-hosted infrastructure.

Recommendations

1. Block or rate-limit inbound Telnet (port 23) at the perimeter. The 72.9% telnet facade dominance confirms this attack surface is actively targeted. Legitimate telnet usage is negligible in modern environments; any exposure should be replaced with SSH.

1. Prioritize patching for the four critical RCE campaigns. In order of recommended urgency:

- GeoServer CVE-2024-36401 — most recent, likely least patched in the wild - Hikvision ISAPI RCE — IoT devices often lack patch workflows; replace end-of-life units - Apache Path Traversal (CVE-2021-41773/42013) — upgrade Apache HTTP Server to current release - PHPUnit eval-stdin (CVE-2017-9841) — remove /vendor directories from web-accessible paths in production

1. Audit internet-facing database services. PostgreSQL, MySQL, Redis, and MongoDB probes totaled ~63k hits. None of these services should be directly internet-accessible; enforce firewall rules restricting database ports to application-tier sources only.

1. Change all default credentials on IoT and network devices. The presence of xc3511, vizxv, enable, system, and blank passwords in probe data confirms active hunting for factory-default devices. Credential hardening and network segmentation of IoT devices remains critical.

1. Implement cloud provider abuse reporting. DigitalOcean nodes account for ~17% of this week's total volume. Reporting abusive source identifiers to provider abuse desks (DO, GoDaddy, etc.) contributes to ecosystem-level mitigation.

1. Monitor for Mirai-variant activity on internal networks. The IZ1H9 and UNSTABLE identifiers indicate active botnet variants. Verify that internal IoT/OT devices are not beaconing outbound or participating in scanning infrastructure.