Threat Pulse W30 — Sharp Volume Drop with Persistent RCE Campaign Activity

Executive Summary

Week 30 (2026-07-17 to 2026-07-20) recorded 44,865 inbound probes — a sharp 72.9% decline from the prior week. The drop is largely attributable to reduced high-volume scanning activity, though one GoDaddy-hosted source alone accounted for over 34% of all events. Despite the lower overall volume, five critical RCE campaigns maintained identical hit counts across the observation window, suggesting coordinated or templated multi-exploit tooling rather than opportunistic scanning.

Attack Volume & Trends

Facade breakdown:

Telnet and SSH remain the dominant attack surfaces, together accounting for 83.8% of all probes. The elevated fake-postgres hits (4,338) are notable — the database=postgres path appearing 2,106 times suggests automated database credential stuffing tooling is actively targeting PostgreSQL endpoints.

The volume decline is significant but should not be interpreted as reduced threat activity — the RCE campaign uniformity and persistence of bruteforce patterns indicate ongoing, structured operations.

Top Threat Actors

• The GoDaddy-hosted source generated 15,359 events — 34.2% of all weekly traffic — almost exclusively scan activity. Hosting provider abuse for large-scale scanning is a common evasion tactic, leveraging reputable ASN reputation to reduce block-list effectiveness.
• SS-Net (RO) contributed 4,070 events, consistent with Romanian-origin bulk scanning infrastructure that has appeared in prior reporting periods.
• Three of the top five sources are US-hosted, underscoring continued abuse of US commercial hosting and VPS providers.
• PT. NAP Info Lintas Nusa (ID) aligns with the broader Indonesian source country presence (2,427 total), likely reflecting compromised host activity within that AS.

Active Campaigns

All five tracked critical campaigns recorded identical hit counts of 9,261 this week. This statistical uniformity strongly indicates a single automated framework or toolkit executing all five exploit attempts in a fixed sequence per target, rather than independent campaigns.

Key observations:

• Hikvision ISAPI RCE targets IP cameras and DVR systems — common in IoT botnets. Successful exploitation typically leads to Mirai-variant deployment.
• PHPUnit eval-stdin (CVE-2017-9841) is an aged but persistently exploited vulnerability in development dependencies left in production environments.
• Apache Path Traversal / RCE likely targets CVE-2021-41773 / CVE-2021-42013, still yielding results against unpatched Apache 2.4.49/2.4.50 instances.
• GeoServer OGC Filter RCE (CVE-2024-36401) is a more recent addition to standard exploit toolkits, indicating campaign tooling is being updated with current CVEs.
• Exchange ProxyLogon (CVE-2021-26855 et al.) remains a staple of opportunistic exploitation against unpatched on-premises Exchange deployments.

The identical hit distribution across all five campaigns is a strong indicator of multi-exploit scanner tooling — a single scanning host testing all five vectors against each discovered target.

Notable Paths & Techniques

Analysis:

• The UNSTABLE probe (1,428 hits) is characteristic of telnet handshake negotiation or state-checking in automated scanning frameworks targeting embedded devices.
• BusyBox injection payloads (;sh\n/bin/busybox and sh\n/bin/busybox, combined 495 hits) confirm active Mirai-family botnet recruitment attempts against telnet-exposed IoT devices.
• pass=vizxv and pass=xc3511 are hardcoded factory credentials for Dahua and Xiongmai/HiSilicon-based IP cameras and DVRs respectively — canonical Mirai credential targets still yielding infections over a decade after the botnet's emergence.
• The set command (215 hits) against fake-redis indicates Redis exploitation probes, consistent with unauthenticated Redis instance reconnaissance.
• database=postgres volume (2,106 hits) against the fake-postgres facade confirms automated PostgreSQL targeting, likely seeking open instances with default or weak credentials for data exfiltration or cryptominer deployment.

Geographic Distribution

• US sources (49.6% of traffic) are predominantly hosting provider abuse — scanning operations running on VPS/dedicated infrastructure rather than compromised end-user devices.
• Pakistan (1,120 events) appears as a notable source this week; elevated traffic from PK ASNs has historically correlated with compromised host clusters or commercially operated scanning services.
• China (3,737) maintains consistent broad-spectrum scanning activity across all facades.

Recommendations

1. Block or rate-limit GoDaddy ASN traffic to management interfaces and non-customer-facing services. Single-source concentration of 34% warrants automated throttling regardless of ASN reputation.

1. Patch Hikvision, Apache, Exchange, and GeoServer immediately if not already done. The uniform campaign hit counts indicate active, ongoing exploitation attempts against these CVEs — all have available vendor patches.

1. Audit PostgreSQL exposure. The high volume of database=postgres probes against port 5432 indicates active targeting. Ensure PostgreSQL is not exposed to the internet and enforces strong authentication with pg_hba.conf restrictions.

1. Change or disable default credentials on IoT/embedded devices. Credentials vizxv, xc3511, and empty passwords are still being actively sprayed. Devices using these defaults should be treated as compromised.

1. Disable Redis public exposure. The set command probes confirm continued scanning for unauthenticated Redis instances. Redis should be bound to localhost or protected networks only, with requirepass enforced.

1. Monitor for PHPUnit vendor/ directories in production. CVE-2017-9841 exploits PHPUnit test files deployed alongside production code. Run dependency audits to confirm phpunit/phpunit is not present in production web roots.

1. Treat the volume drop with caution. A 72.9% week-over-week reduction may reflect weekend timing (data covers 4 days), source rotation, or campaign pause before re-escalation. Maintain current alerting thresholds.