Threat Pulse W27 — Telnet Flood & Mass RCE Campaign Surge

Executive Summary

The tarpit-lab.xyz honeypot recorded 94,222 inbound probes between 2026-06-26 and 2026-06-29, a +19.4% increase over the prior week. A single source IP (US/Dynu Systems) accounted for over 69% of all traffic, almost exclusively targeting the fake-Telnet facade via mass scanning. Concurrently, five distinct critical-severity RCE campaigns each logged identical hit counts, strongly indicating a unified automated exploitation framework cycling through multiple vulnerability classes in parallel.

Attack Volume & Trends

Facade breakdown:

The Telnet facade absorbed an extraordinary share of traffic this week — driven almost entirely by a single scanning actor. Stripping that source out, the underlying distribution across SSH, Postgres, and web services reflects typical background noise levels. Bruteforce activity (13,165 events) remains elevated across SSH and database facades, with credential stuffing clearly automated given the volume and credential diversity.

Top Threat Actors

Key observations:

• Source #1 (Dynu Systems, US) is the dominant actor this week by an extreme margin — 65,414 events representing 69.4% of all weekly traffic. Dynu is a dynamic DNS provider; this source is likely an abused or compromised host using the provider's infrastructure. The near-exclusive focus on Telnet (port 23) is consistent with IoT botnet recruitment scanning.
• Source #2 (SS-Net, Romania) contributed 5,664 events, consistent with broad-spectrum reconnaissance rather than a targeted campaign.
• Sources #3–#5 originate from cloud infrastructure (DigitalOcean, Alibaba, Eonix), a recurring pattern of VPS-hosted scanners used for disposable probing operations.

Active Campaigns

Five critical campaigns each registered 15,975 hits — an identical count that is statistically implausible under independent operation. This uniformity strongly suggests a single automated exploitation framework (e.g., a mass-scanning bot or commercial exploitation suite) cycling through vulnerability modules in sequence or parallel.

Analysis:

• Hikvision ISAPI RCE targets network-attached cameras and DVRs — a staple of IoT botnet recruitment (Mirai variants and successors).
• PHPUnit eval-stdin RCE exploits a years-old but widely unpatched vulnerability in development dependencies left exposed in production environments.
• Apache Path Traversal / RCE (likely CVE-2021-41773/42013 family) continues to find vulnerable hosts across the internet.
• GeoServer OGC Filter RCE (CVE-2024-36401) is a relatively recent critical vulnerability; its inclusion confirms threat actors are integrating newly disclosed CVEs rapidly.
• Exchange ProxyLogon (CVE-2021-26855 family) remains operationally relevant despite age, indicating a persistent pool of unpatched Exchange deployments.

The uniform hit count across all five campaigns warrants investigation into whether a single threat actor or botnet operator is responsible for all campaign traffic this week.

Notable Paths & Techniques

Credential Stuffing — IoT & Default Passwords

The bruteforce data reveals a clear IoT-focused credential list:

The presence of xc3511 and vizxv alongside Hikvision ISAPI RCE in the campaigns section is significant — these credentials are specifically associated with Hikvision and Dahua IP cameras, forming a coherent IoT targeting pattern consistent with Mirai-family botnet recruitment.

Anomalous Patterns

• UNSTABLE (8,560 hits): A high-frequency unknown pattern. The label may correspond to a malformed or non-standard protocol handshake, a botnet C2 probe string, or a novel tool signature. Warrants deeper packet inspection and fingerprinting.
• database=postgres (2,882 hits): Connection attempts targeting the fake-Postgres facade with explicit database parameter, suggesting automated PostgreSQL credential scanners or exploitation tooling.
• IZ1H9 (486 hits): A known Mirai variant identifier observed in botnet recruitment payloads. Its appearance here corroborates the IoT botnet recruitment hypothesis.

Geographic Distribution

US dominance is an artifact of the top scanner using US-based infrastructure. Vietnam and Indonesia traffic patterns are consistent with compromised consumer IoT devices participating in botnet activity. Germany, Netherlands, and Singapore sources predominantly reflect VPS-hosted scanning operations.

Recommendations

1. Block or sinkholes Dynu Systems dynamic DNS ranges at perimeter if Telnet exposure is not operationally required. A single source generating 69% of probe volume is an easy win for noise reduction.

1. Patch or isolate Hikvision and Dahua devices immediately. The convergence of ISAPI RCE exploitation, IoT-specific default credentials (xc3511, vizxv), and the IZ1H9 Mirai variant string indicates an active, coordinated IoT recruitment campaign. Any internet-facing camera or DVR from these vendors is a high-priority target.

1. Audit for GeoServer deployments (CVE-2024-36401). Its inclusion in this week's campaign sweep alongside older CVEs confirms active exploitation in the wild. Patch to GeoServer ≥2.23.6 / ≥2.24.4.

1. Remove PHPUnit from production environments. The eval-stdin.php attack vector requires only that the package be present. Development dependencies must not be deployed to production systems.

1. Investigate the UNSTABLE pattern (8,560 hits). This unknown high-frequency signature should be captured for full payload analysis to determine whether it represents a novel tool, protocol, or campaign not yet in threat intelligence feeds.

1. Enforce non-default credentials and disable Telnet on all IoT and embedded devices. The credential list observed this week is short, well-known, and trivially automatable — any device using these passwords on an internet-accessible interface should be considered compromised.

1. Monitor cloud provider abuse. DigitalOcean, Alibaba, and Eonix-hosted sources appearing in the top-five reinforces the need for egress monitoring and abuse reporting to cloud providers when scanning originates from their infrastructure.