Threat Pulse W29 — Massive Scan Surge & Critical RCE Cluster

Executive Summary

The week of 26 June–13 July 2026 recorded 372,467 inbound probes against tarpit-lab.xyz — a +371.9% spike versus the prior week. This is not organic noise growth; the data shows a highly structured offensive pattern: five dominant campaigns each registering near-identical hit counts (~84,886–84,889), suggesting coordinated or scripted campaign delivery from multiple source networks. Simultaneously, brute-force credential stuffing against Telnet and SSH remained elevated, and several new IoT-linked credential patterns appeared in the path data.

Attack Volume & Trends

Facade breakdown:

The fake-telnet facade dominates at 65% of all traffic, consistent with continued IoT botnet recruitment activity. The fake-postgres facade saw an unusually high 12.7% share — corroborated by 22,964 hits containing the database=postgres identifier — indicating active scanning for exposed PostgreSQL instances.

The near-identical hit counts across the top four RCE campaigns (~84,886 each) strongly suggest a single orchestrated multi-payload delivery run, likely a scanner tool configured to fire all payloads per target host.

Top Threat Actors

Key observations:

• Dynu Systems sourced 69,126 events — 18.6% of total weekly volume from a single IP. Dynu provides dynamic DNS services, and abuse of such infrastructure for mass scanning is consistent with prior threat actor tradecraft involving residential or shared-hosting pivot nodes.
• SS-Net (RO) contributed 42,690 events — the Romanian ASN has appeared in prior honeypot datasets as a recurring scan launchpad.
• DigitalOcean and GoDaddy continue to appear as compromised or abused cloud/hosting infrastructure, not necessarily indicating origin of the threat actor.
• Amarutu Technology (NL) is a known bulletproof or permissive hosting provider frequently associated with scanning operations.

All top five actors are classified as scan-dominant, suggesting a reconnaissance-first posture this week ahead of potential follow-on exploitation.

Active Campaigns

🔴 Critical RCE Cluster (~84,886 hits each)

Four critical-severity campaigns each registered virtually identical hit counts, indicating coordinated or toolchain-driven delivery:

1. Hikvision ISAPI RCE (Critical)

• Targets exposed Hikvision IP cameras and NVRs via unauthenticated ISAPI endpoints.
• CVE-2021-36260 remains broadly unpatched across consumer and SMB deployments.
• High hit volume against HTTP/HTTPS facades.

2. PHPUnit eval-stdin RCE (Critical)

• Exploits CVE-2017-9841, a years-old but persistently effective vulnerability in PHPUnit dev dependencies left exposed in production environments.
• Attackers POST to /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php for arbitrary PHP execution.

3. Apache Path Traversal / RCE (Critical)

• Covers Apache HTTP Server path traversal variants (including CVE-2021-41773 / CVE-2021-42013 family).
• Used to read sensitive files or execute commands on misconfigured servers.

4. GeoServer OGC Filter RCE (Critical)

• CVE-2024-36401: unauthenticated RCE via OGC filter evaluation in GeoServer.
• This is a 2024 vulnerability still actively weaponized at scale, indicating widespread unpatched GeoServer deployments remain in attacker target lists.

🟡 Low Severity

5. HTTP/2 PRI Method Probe (Low — 84,889 hits)

• Sends HTTP/2 connection preface (PRI * HTTP/2.0) to HTTP/1.1 servers to fingerprint upgrade support and identify h2c misconfigurations.
• Primarily a reconnaissance/fingerprinting technique.

Notable Paths & Techniques

Analysis:

• The UNSTABLE and IZ1H9 strings are associated with specific Mirai botnet variant families. Their presence alongside busybox shell injection attempts confirms active IoT botnet recruitment targeting embedded Linux devices.
• pass=xc3511 and pass=vizxv are well-documented default credentials for Xiongmai and Dahua IP camera firmware respectively — pointing to continued targeting of the vast installed base of cheap DVR/NVR/camera hardware.
• The set command against the fake-redis facade (4,041 hits total) is consistent with Redis exploitation attempts — typically used to write SSH keys or cron jobs for persistence on misconfigured Redis instances.
• 22,964 database=postgres hits indicate automated tooling targeting PostgreSQL with login enumeration, likely seeking pg_exec or COPY TO/FROM PROGRAM abuse paths for RCE.

Geographic Distribution

The US share (51.8%) reflects the concentration of abused cloud and hosting infrastructure rather than indicating US-origin threat actors. Romanian and Dutch ASNs continue to punch above their weight as permissive hosting environments. Chinese sources at 7.4% are consistent with background scan infrastructure observed globally.

Recommendations

1. Patch GeoServer immediately. CVE-2024-36401 is being weaponized at massive scale (~85K attempts this week alone). Any internet-exposed GeoServer instance should be patched or isolated.

1. Audit PHPUnit in production environments. CVE-2017-9841 is nearly a decade old but still yielding results for attackers. Remove dev dependencies (/vendor/) from production deployments and verify with a web-accessible path scan.

1. Replace or segment Hikvision/Dahua/Xiongmai devices. Default credentials (xc3511, vizxv) and known ISAPI RCEs are being actively exploited. Devices that cannot be patched should be placed on isolated VLANs with no direct internet access.

1. Disable unauthenticated Redis access. Bind Redis to localhost or require authentication. The set command probes indicate continued opportunistic targeting.

1. Block or rate-limit Telnet exposure. 65% of all probe volume hit the Telnet facade. Any production Telnet service should be treated as critically exposed.

1. Monitor ASNs associated with top actors. Dynu Systems, SS-Net, and Amarutu Technology should be reviewed in egress/ingress firewall policies. Consider geo-blocking or ASN-level rate limiting for non-essential traffic sources.

1. Treat the RCE hit-count symmetry as an indicator. The near-identical ~84,886 count across four separate campaigns is a signature of a single automated scanner tool. Detection rules should flag hosts sending this multi-payload pattern in a single session.