Threat Pulse W32 — Massive Scan Surge & Critical RCE Campaign Blitz

Executive Summary

The week of 2026-07-27 to 2026-08-03 saw tarpit-lab.xyz record 210,549 inbound probes, more than double the previous week's volume (+107.8%). The surge is attributable to a small cluster of high-volume scanners — predominantly hosted on GoDaddy and Storm Industries infrastructure — combined with a broad, simultaneous RCE campaign targeting five critical vulnerabilities across widely deployed enterprise and consumer software. Telnet remained the dominant attack surface, accounting for 74% of all probe traffic.

Attack Volume & Trends

By facade:

The telnet facade spike is the primary driver of this week's volume anomaly. The pattern is consistent with automated IoT botnet recruitment activity — large-scale sweeps probing for default and weak credentials on embedded devices. The SSH facade remains persistently targeted, indicating sustained credential-stuffing operations running in parallel. The database facades (PostgreSQL, MySQL, Redis, MongoDB) collectively received over 17,700 probes, suggesting reconnaissance and access attempts against exposed data services.

Top Threat Actors

Key observations:

• Three of the top five sources resolve to GoDaddy-hosted infrastructure, collectively generating ~73,441 events (~35% of total weekly volume). This strongly suggests abuse of commodity shared hosting or VPS resources, a common pattern for rented scanning infrastructure.
• The Storm Industries LLC (NL) source contributed nearly 30,000 events. Storm Industries is a frequently observed transit or hosting provider for malicious actors leveraging permissive or bulletproof-adjacent networks.
• The Alibaba-hosted Chinese source adds to the picture of geographically distributed but likely coordinated scanning operations.
• All top actors show scan-dominant behavior, consistent with reconnaissance ahead of targeted exploitation.

Active Campaigns

Five critical campaigns were detected this week, each registering an identical 39,177 hits — an unusual signature that may indicate a single coordinated tool or botnet dispatching multi-exploit payloads in lockstep.

Analysis:

• The identical hit counts across all five campaigns is a strong indicator of a single automated attack framework executing a bundled exploit chain — each target URL or payload is dispatched as part of the same scanning pass.
• Hikvision ISAPI RCE targets IP cameras and NVRs with known unauthenticated command injection flaws — a staple of IoT botnet recruitment.
• PHPUnit eval-stdin (CVE-2017-9841) remains heavily exploited despite its age, indicating large numbers of unpatched or forgotten PHP development environments remain internet-exposed.
• Apache Path Traversal / RCE likely targets CVE-2021-41773 / CVE-2021-42013 on Apache HTTP Server — still widely unpatched across legacy deployments.
• GeoServer OGC Filter RCE (CVE-2024-36401) is a more recent critical flaw, demonstrating that threat actors are rapidly integrating newly disclosed vulnerabilities into their toolchains.
• Exchange ProxyLogon (CVE-2021-26855 and related) continues to be actively exploited, reflecting the persistent attack surface of on-premises Exchange deployments.

Notable Paths & Techniques

Several anomalous probe patterns were observed outside of known campaigns:

Key observations:

• ECCHI and UNSTABLE are well-documented Mirai botnet telnet handshake tokens used to identify and communicate with already-infected bots or to fingerprint vulnerable devices. Their high hit counts confirm active Mirai-family botnet operation against this sensor.
• The pass=xc3511 and pass=vizxv credentials are specific to Xiongmai and Dahua IP camera firmware defaults respectively — confirming targeted IoT device recruitment consistent with surveillance camera botnet building.
• sh\n/bin/busybox injections indicate attackers attempting to confirm shell access and stage Mirai or similar malware on compromised embedded Linux devices.
• The database=postgres pattern suggests automated PostgreSQL reconnaissance, likely probing for unauthenticated or default-credential access to exposed database instances — corroborated by the elevated fake-postgres facade traffic this week.

Geographic Distribution

Notes:

• The US dominance (46.7%) is largely explained by the three high-volume GoDaddy-hosted sources and reflects infrastructure abuse rather than necessarily US-origin threat actors.
• Netherlands volume is driven primarily by the Storm Industries source — a frequently abused hosting environment.
• China (33,174 events) spans a broader set of sources and is consistent with ongoing PRC-adjacent scanning infrastructure activity.
• Romania (13,206) is a notable contributor without a single dominant IP, suggesting a distributed or botnet-origin cluster.
• Remaining countries (Vietnam, Pakistan, India, Germany) contribute modest but consistent volumes consistent with globally distributed botnet nodes.

Recommendations

1. Block or rate-limit GoDaddy and Storm Industries ASNs at perimeter if these providers are not needed for legitimate traffic. The volume of abuse from these ASNs this week is severe and unlikely to be coincidental.

1. Immediately patch or isolate any internet-exposed instances of:

- Hikvision/Dahua/Xiongmai IP cameras (apply firmware updates, disable ISAPI if unused) - Apache HTTP Server < 2.4.51 (CVE-2021-41773 / 42013) - PHPUnit in production environments (remove entirely) - GeoServer instances (patch CVE-2024-36401 urgently) - Microsoft Exchange on-premises (apply all ProxyLogon / ProxyShell patches)

1. Disable Telnet on all network-connected devices. The 156,175 telnet probes confirm this protocol remains a primary IoT attack vector. Replace with SSH where remote access is required.

1. Audit exposed database services. PostgreSQL, MySQL, Redis, and MongoDB instances should never be directly internet-facing. Enforce firewall rules, require strong authentication, and audit access logs for the database=postgres enumeration pattern.

1. Monitor for Mirai IOCs — specifically the ECCHI, UNSTABLE, and busybox shell injection patterns in network logs. These indicate active botnet recruitment operations targeting your network segment.

1. Review hosting-provider abuse reporting pipelines. The concentration of attack traffic from major commercial hosters (GoDaddy) suggests that abuse reports filed with these providers may yield faster source takedowns than traditional threat-intel sharing alone.

1. Treat identical multi-campaign hit counts as a single actor signal. The synchronized 39,177-hit counts across five distinct RCE campaigns warrants correlation analysis — organizations should check logs for all five vulnerability signatures simultaneously, as a single attacker likely attempted all five against any reachable target.