Threat Pulse W28 — Massive Scan Surge & Critical RCE Campaign Blitz

Executive Summary

The week of 2026-06-26 to 2026-07-06 recorded 211,219 inbound probes — a 167.6% surge over the prior week. The volume spike is attributable to two converging forces: a high-volume scan campaign dominated by a single US-hosted actor, and a synchronized wave of critical-severity exploit attempts across four distinct RCE campaigns, each registering ~50,249 hits. Telnet remained the most targeted facade by a wide margin, consistent with ongoing Mirai-variant botnet recruitment activity. Credential stuffing indicators in the notable paths data suggest active IoT device compromise operations running in parallel.

Attack Volume & Trends

Facade breakdown:

The telnet facade absorbed nearly two-thirds of all traffic, a proportion consistent with automated botnet scanning. The fake-postgres facade's 13.3% share is notable — the database=postgres path indicator (13,679 hits) suggests targeted enumeration of exposed PostgreSQL instances, potentially for credential harvesting or data exfiltration staging.

Top Threat Actors

Key observations:

• Dynu Systems (US): The single most active source this week, responsible for 32.7% of all sensor events (69,069 hits). Dynu provides dynamic DNS services — this infrastructure is frequently abused by threat actors to rotate callback domains and host scanning tools. The volume is anomalous and may indicate a compromised VPS or a deliberate large-scale reconnaissance sweep.
• SS-Net (RO): The Romanian AS contributed 25,256 events, accounting for nearly the entirety of Romania's country-level share. SS-Net has appeared in prior honeypot datasets as a source of aggressive scanning.
• GoDaddy (three distinct IPs): Three separate GoDaddy-hosted IPs collectively contributed ~20,828 scan events. Shared hosting and VPS infrastructure at major providers continues to be leveraged as a scan-launching platform, likely via compromised or rented instances.

Active Campaigns

🔴 Hikvision ISAPI RCE — Critical (50,249 hits)

Targets the unauthenticated command injection vulnerability in Hikvision IP cameras via the ISAPI endpoint. Exploitation leads to remote code execution on the device, commonly used for botnet recruitment. The near-identical hit count shared with three other campaigns (see below) strongly implies coordinated, tool-driven delivery from a common threat actor or campaign framework.

🔴 PHPUnit eval-stdin RCE — Critical (50,249 hits)

Abuses a known remote code execution flaw in PHPUnit's eval-stdin.php utility file left exposed on production web servers. Targets PHP-based web applications where development dependencies were not removed. Widely exploited by automated scanners and webshell deployment tools.

🔴 Apache Path Traversal / RCE — Critical (50,249 hits)

Probes for Apache HTTP Server path traversal vulnerabilities (including CVE-2021-41773/42013 family). Successful exploitation enables directory traversal and, under certain configurations, arbitrary code execution. Still heavily scanned despite being patched in 2021, indicating a large population of unpatched targets remains.

🔴 GeoServer OGC Filter RCE — Critical (50,249 hits)

Exploits CVE-2024-36401, a critical unauthenticated RCE vulnerability in GeoServer's OGC filter evaluation. This vulnerability was publicly disclosed in mid-2024 and has been rapidly absorbed into mass-exploitation toolkits. Its presence at 50,249 hits this week confirms it remains an actively weaponized CVE.

🟡 HTTP/2 PRI Method Probe — Low (50,252 hits)

The highest single-campaign hit count this week. HTTP/2 connection preface (PRI * HTTP/2.0) probes are used to fingerprint services supporting HTTP/2, map infrastructure, and identify misconfigured reverse proxies. Low severity individually, but at this volume indicates systematic internet-wide reconnaissance.

The synchronization of four critical RCE campaigns each hitting exactly 50,249 times is a strong indicator of a scripted, multi-exploit scanner deploying all four payloads per target host.

Notable Paths & Techniques

Analysis:

• The IZ1H9 string is a well-documented Mirai variant marker. Its appearance alongside ;sh /bin/busybox, pass=xc3511 (Xiongmai devices), and pass=vizxv (Dahua devices) paints a clear picture: an active Mirai-family botnet recruitment campaign is targeting exposed IP cameras and DVRs via default credentials and telnet injection.
• The UNSTABLE keyword appears in telnet session exchanges as a terminal-type or banner probe — another known Mirai/derivative fingerprinting technique to identify exploitable devices.
• database=postgres at nearly 14,000 hits against the fake-postgres facade suggests automated tooling is attempting to connect with default database names, likely probing for unauthenticated or weakly authenticated PostgreSQL instances.

Geographic Distribution

The US's 50.9% share reflects infrastructure abuse rather than US-origin threat actors — dynamic DNS providers, shared hosting, and VPS platforms are routinely leveraged by actors globally. Romania's elevated share is concentrated and warrants ongoing monitoring. The Netherlands, Singapore, and Germany contributions follow typical patterns for bulletproof or lightly-moderated hosting environments.

Recommendations

1. Patch or isolate GeoServer instances immediately. CVE-2024-36401 is being mass-exploited at scale. Any internet-facing GeoServer deployment not patched to 2.23.6+ / 2.24.4+ is at high risk of active compromise.

1. Audit for PHPUnit residue in production. Scan web roots for vendor/phpunit directories or eval-stdin.php files. These should never be present on production servers.

1. Disable Telnet on all IoT/embedded devices. The Mirai campaign data is unambiguous. Devices with factory-default credentials (xc3511, vizxv, admin) and exposed Telnet ports should be treated as already compromised.

1. Restrict PostgreSQL exposure. Databases should not be internet-accessible. Enforce network-level controls (firewall rules, VPC segmentation) to ensure PostgreSQL (5432/tcp) is never directly reachable from the internet.

1. Monitor for Dynu Systems and SS-Net traffic. Both ASNs generated anomalous scan volumes this week. Consider rate-limiting or early-drop rules for these source ranges if they appear in production logs.

1. Validate Apache HTTP Server versions. Path traversal CVEs from 2021 are still being mass-scanned, confirming vulnerable instances remain operational. Ensure Apache is patched to 2.4.51+.

1. Treat synchronized multi-exploit hits as a single threat. The four critical RCE campaigns with identical hit counts indicate a single scanning framework. Detection of any one of these payloads should trigger alerting for the others.