Threat Pulse W31 — Volume Drop Masks Persistent RCE Campaign Pressure

Executive Summary

Week 31 (2026-07-20 to 2026-07-27) recorded 101,340 inbound probes against tarpit-lab.xyz, a 25.7% reduction from the prior week. Despite the volume decrease, the attack surface remained broadly consistent: five critical-severity RCE campaigns each logged identical hit counts, suggesting coordinated or scripted multi-vector tooling rather than opportunistic noise. Credential-guessing activity against database facades (PostgreSQL, MySQL, Redis, MongoDB) intensified in relative terms, and shell-injection payloads appeared prominently in the notable-paths data.

Attack Volume & Trends

• Scans account for 73.6% of all events — mass-scanning infrastructure remains the primary driver of honeypot traffic.
• Bruteforce at 14.5% reflects persistent credential-stuffing efforts, particularly against Telnet and SSH facades.
• RCE attempts (6.9%) are disproportionately impactful given their critical severity classification.

Facade Breakdown

Telnet and SSH together absorb 77.8% of all traffic. The PostgreSQL facade's 12.7% share — nearly 4× larger than all remaining services combined — is notable and aligns with the database=postgres probe string appearing 6,091 times in the notable-paths data.

Top Threat Actors

• The Romanian SS-Net source generated 12,016 events — 11.9% of weekly volume from a single origin — and is the week's most prolific individual actor.
• Alibaba-hosted infrastructure in China continues to appear as a high-volume scan origin; this is consistent with prior weeks and likely reflects compromised or rented VPS inventory.
• GoDaddy and DigitalOcean nodes appearing in the top five underscores the ongoing abuse of commodity hosting for scan operations; abuse reports to these providers are actionable.
• All top-five actors are scan-dominant, suggesting infrastructure reconnaissance rather than targeted exploitation at the individual-source level.

Active Campaigns

All five tracked campaigns registered 26,773 hits each — a statistically improbable uniformity that strongly suggests a single automated toolkit cycling through multiple exploit modules in sequence, or a logging/aggregation artifact where a multi-stage attack chain is being counted once per session across all modules.

Key observations:

• Hikvision ISAPI RCE targets internet-exposed IP cameras and NVRs — a common initial-access vector for botnet recruitment.
• PHPUnit eval-stdin (CVE-2017-9841) is a years-old vulnerability that continues to yield results against unpatched legacy PHP deployments.
• Apache Path Traversal campaigns (likely targeting CVE-2021-41773/42013) remain active against unpatched Apache 2.4.49/2.4.50 instances.
• GeoServer OGC Filter RCE (CVE-2024-36401) is a more recent critical, indicating threat actors are incorporating 2024-era CVEs into automated frameworks.
• Exchange ProxyLogon (CVE-2021-26855 et al.) continues to be exploited, confirming many Exchange deployments remain unpatched years after public disclosure.

Notable Paths & Techniques

Analysis:

• The sh\n/bin/busybox and ;sh\n/bin/busybox patterns are characteristic of Mirai-family and derivative IoT botnet propagation scripts targeting embedded Linux devices (routers, cameras, NAS). The newline-separated format is designed to exploit command injection in web interfaces or Telnet banners.
• The Redis set probe confirms unauthenticated Redis instances are actively targeted for data manipulation or malware drop via the SLAVEOF/CONFIG SET dir technique.
• database=postgres at 6,091 hits points to automated PostgreSQL scanners testing for open or weakly-authenticated instances — likely prelude to COPY TO/FROM PROGRAM RCE attempts.
• The pass=admin, pass=1234, and pass= entries are consistent with low-sophistication mass credential stuffing, likely targeting custom web apps or IoT management interfaces.

Geographic Distribution

• US and CN together account for nearly 39% of all source traffic. Both are consistent with prior weeks; US-sourced traffic heavily reflects cloud/hosting provider abuse.
• Romania's 14% share is elevated relative to historical baselines and is almost entirely attributable to the single SS-Net source in the top actors list.
• Netherlands at 6.8% is consistent with its role as a European hosting hub frequently abused for anonymized scanning operations.
• Indonesia and Pakistan appearing in the top eight is worth monitoring; both have featured in IoT botnet recruitment campaigns.

Recommendations

1. Patch immediately — GeoServer CVE-2024-36401: This 2024 critical RCE is now confirmed in active scanning campaigns. Any public-facing GeoServer instance should be patched to 2.23.6+ or 2.24.4+ without delay.

1. Audit and retire PHPUnit in production environments: CVE-2017-9841 (eval-stdin.php) should not exist in any production web root. Automated scans are finding instances at scale; remove the PHPUnit vendor directory from all web-accessible paths.

1. Restrict PostgreSQL and Redis to authenticated, non-public interfaces: The volume of database=postgres probes and Redis SET attempts confirms these services are being mass-scanned. Bind to localhost or VPN-only interfaces; enforce authentication.

1. Block or null-route SS-Net (RO) and known Alibaba scan ranges at the perimeter: The top two actors alone represent ~21% of weekly volume. IP reputation feeds or ASN-level blocks for scan-only sources reduce noise and free resources for higher-fidelity analysis.

1. Monitor for BusyBox shell injection: The sh\n/bin/busybox patterns indicate IoT botnet propagation activity. Ensure all embedded devices on network perimeters are running current firmware, have changed default credentials, and are not directly internet-exposed on Telnet (port 23).

1. Treat the uniform RCE campaign hit counts as a tooling signature: The identical 26,773-hit count across five disparate campaigns suggests a single automated framework. Defenders should build detection rules that fire on the co-occurrence of Hikvision ISAPI, PHPUnit, Apache traversal, GeoServer, and ProxyLogon probes from the same source IP within a short time window.

1. Continue monitoring Pakistan and Indonesia source growth: Neither country appears in the top-five actor list but both show meaningful volume. If this trend continues into W32, further ASN-level analysis is warranted to identify emerging scan infrastructure.