Threat Pulse W33 — RCE Campaign Blitz & Telnet Botnet Recruitment

Executive Summary

Between 2026-08-03 and 2026-08-10, tarpit-lab.xyz recorded 150,796 inbound probes, a 28.4% decrease from the prior week. Despite lower overall volume, the threat landscape remained aggressive: four distinct critical-severity RCE campaigns each logged an identical 42,403 hits, pointing to automated, multi-payload tooling operating in lockstep. Telnet remained the dominant attack surface by a wide margin, and notable credential-stuffing and BusyBox shell-injection patterns suggest active IoT botnet recruitment efforts.

Attack Volume & Trends

Facade breakdown:

The volume drop from last week does not reflect reduced threat actor capability — the synchronized RCE campaign structure and high Telnet probe share indicate sustained, purposeful automation rather than opportunistic noise reduction. Scans account for 71.9% of all activity, with bruteforce and RCE together comprising a significant secondary layer.

Top Threat Actors

Key observations:

• Three distinct GoDaddy-hosted IPs collectively generated 45,654 events — nearly 30% of total weekly volume. These are almost certainly compromised or rented VPS nodes used as scanning infrastructure. GoDaddy abuse reporting is recommended.
• The Alibaba-hosted source from Hangzhou alone accounts for 16.8% of all probes, continuing a pattern of Chinese cloud infrastructure abuse seen in prior weeks.
• SS-Net (RO) contributes a concentrated scan bloc; Romanian ASNs have featured consistently in recent weeks.
• The top five sources are all classified as scan actors, confirming that bulk reconnaissance continues to anchor the attack pyramid.

Active Campaigns

Four critical RCE campaigns each recorded an identical hit count of 42,403, a statistical signature strongly suggesting a single automated framework dispatching multiple exploit payloads per connection attempt or sweep cycle.

1. Hikvision ISAPI RCE — Critical

• Hits: 42,403
• Type: RCE
• Targets unauthenticated command injection vulnerabilities in Hikvision IP camera management interfaces. Widely exploited for RTSP hijacking and botnet node installation.

2. PHPUnit eval-stdin RCE — Critical

• Hits: 42,403
• Type: RCE
• Exploits CVE-2017-9841, a long-known but persistently weaponized flaw in PHPUnit allowing arbitrary PHP code execution via HTTP POST to vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php. Continued high prevalence reflects the long tail of unpatched PHP applications.

3. Apache Path Traversal / RCE — Critical

• Hits: 42,403
• Type: Path Traversal / RCE
• Likely targeting CVE-2021-41773 / CVE-2021-42013 or similar Apache HTTP Server traversal chains. Attackers use directory traversal to reach executable CGI paths.

4. GeoServer OGC Filter RCE — Critical

• Hits: 42,403
• Type: RCE
• Targets CVE-2024-36401, a critical unauthenticated RCE via OGC filter evaluation in GeoServer. Despite patches being available, internet-exposed GeoServer instances remain common in government and academic GIS infrastructure.

5. HTTP/2 PRI Method Probe — Low

• Hits: 42,404
• Type: Scan
• Sends the HTTP/2 client preface (PRI * HTTP/2.0) to identify HTTP/2-capable services. Functions as a service fingerprinting precursor to more targeted exploitation.

> Note: The near-identical hit counts across all five campaigns (42,403–42,404) is a strong indicator of a single orchestration layer delivering a multi-exploit payload bundle per target, rather than five independent campaigns operating in coincidental parallel.

Notable Paths & Techniques

Several probe patterns not attributed to known named campaigns appeared in significant volume this week:

IoT/Embedded Shell Injection

sh\n/bin/busybox   — 4,108 hits
sh                — 2,054 hits
;sh\nbusybox      — 1,798 hits

These patterns are characteristic of Mirai-family and derivative botnet recruitment. After gaining initial access (typically via Telnet credential brute-force), payloads probe for BusyBox availability to confirm the target is an embedded Linux device (router, DVR, IP camera). The layered sh / busybox sequencing is consistent with fallback execution logic.

PostgreSQL Probing

database=postgres  — 4,043 hits

Direct database connection attempts targeting default PostgreSQL credentials on the fake-postgres facade. Combined with the facade's 8,802 total hits this week, this confirms active enumeration of exposed database services.

Telnet Banner Fingerprinting

UNSTABLE           — 4,027 hits

The string UNSTABLE appears in certain embedded device firmware banners. Probes containing this token suggest scanners are fingerprinting devices that self-identify via their Telnet banner, likely to target known vulnerable firmware versions.

Credential Stuffing (Telnet/SSH)

pass=admin    — 1,316 hits
pass=1234     — 1,129 hits
pass=xc3511   —   800 hits
pass=vizxv    —   728 hits

xc3511 and vizxv are well-documented default credentials for XiongMai-based DVR/NVR hardware and certain Dahua OEM devices — staple targets for Mirai and Satori botnets. Their presence alongside admin and 1234 confirms ongoing IoT credential harvesting campaigns targeting default-credential devices.

HTTP Root Probe

/  —  745 hits

Baseline HTTP root requests used for service confirmation and WAF/IDS fingerprinting prior to targeted exploit delivery.

Geographic Distribution

The US leading in source volume continues to reflect the abuse of American hosting providers (notably GoDaddy this week) as scanning infrastructure. Attribution to US origin does not imply US-based threat actors — VPS rental and compromise by international actors is the dominant explanation. China's contribution remains substantial, concentrated in Alibaba cloud ranges.

Recommendations

1. Patch GeoServer immediately. CVE-2024-36401 is actively exploited at scale. Any internet-exposed GeoServer instance without the patch applied is a high-priority remediation target. Consider placing GeoServer behind a VPN or restricting OGC endpoint access.

1. Audit and eliminate PHPUnit from production environments. CVE-2017-9841 has been known for nearly a decade. Remove vendor/phpunit directories from any web-accessible path; this is a deployment hygiene issue, not just a patching issue.

1. Harden Hikvision and XiongMai-based devices. Change all default credentials immediately. Disable Telnet where not operationally required. Apply available firmware updates. Consider network segmentation for all IP cameras and DVR/NVR units.

1. Block or rate-limit GoDaddy IP ranges at the perimeter if hosting infrastructure is not in use by your organization. The three GoDaddy source nodes alone generated ~30% of weekly probe volume.

1. Disable or firewall PostgreSQL, MySQL, Redis, and MongoDB from internet exposure. All four database facades received meaningful probe traffic this week. No production database should be directly internet-accessible.

1. Monitor for BusyBox/shell injection patterns in Telnet and SSH logs. The busybox / sh probe sequences are a reliable IoT compromise precursor indicator. Devices logging these strings against their Telnet service should be considered actively targeted.

1. Investigate Apache HTTP Server versions. Ensure CVE-2021-41773 and CVE-2021-42013 are patched and that CGI execution is disabled unless explicitly required.