Threat Pulse W34 — Persistent RCE Campaigns & Telnet Botnet Surge

Executive Summary

Week 34 (2026-08-10 to 2026-08-17) saw a 13.5% reduction in total probe volume to 130,466 events, but the decline in raw numbers should not be misread as reduced threat severity. Five concurrent critical-rated RCE campaigns remained fully active, each registering identical hit counts — a pattern consistent with coordinated, scripted mass-exploitation tooling. The fake-telnet facade dominated sensor intake at 87,003 hits (66.7%), reflecting sustained IoT credential stuffing and botnet propagation efforts. Credential probes targeting weak default passwords and active busybox shell injection attempts indicate a mature, multi-stage compromise pipeline operating across the sensor's attack surface.

Attack Volume & Trends

Key observations:

• Despite the volume drop, the RCE category remains disproportionately active relative to overall probe counts.
• Scans still constitute the plurality of traffic, consistent with automated internet-wide reconnaissance tooling.
• Bruteforce activity at 21,317 events is substantial, driven primarily by the telnet and SSH facades.

Facade Breakdown

The fake-postgres facade at 11.1% of traffic — well above fake-mysql and fake-redis — warrants attention, particularly in context of the database=postgres notable path (6,809 hits). Actors are actively probing for exposed PostgreSQL instances, likely targeting credential reuse and privilege escalation via extensions.

Top Threat Actors

All top-5 source IPs this week are classified as scan-dominant. Three originate from GoDaddy-hosted infrastructure, suggesting continued abuse of shared/cloud hosting for scan operations.

Notable patterns:

• The top Alibaba-hosted IP alone accounts for 20.6% of all probe events, an unusually high single-source concentration.
• Three distinct GoDaddy IP addresses collectively contributed 30,214 events (23.2%), pointing to either coordinated multi-IP scan distribution or compromised hosting accounts being leveraged for reconnaissance.
• The Romanian SS-Net source (13,242 events) is consistent with bulletproof or permissive hosting frequently associated with Eastern European scanning infrastructure.

Active Campaigns

Five campaigns each recorded 38,652 hits this week — an identical count across all five that strongly suggests a single automated toolkit or campaign framework executing them in parallel.

Analysis:

• The GeoServer OGC Filter RCE (CVE-2024-36401) is the most recently disclosed vulnerability in this group and its presence alongside older CVEs confirms that threat actors bundle legacy and contemporary exploits into unified toolkits.
• Hikvision ISAPI and PHPUnit targets are perennial honeypot fixtures; their continued dominance reflects the long tail of unpatched internet-facing devices and legacy PHP deployments.
• ProxyLogon targeting persists despite patches being available since March 2021, confirming that on-premises Exchange servers remain a viable attack surface in many environments.
• The uniform hit count across all five campaigns is highly anomalous and suggests either a single threat actor rotating through exploit modules, or a shared exploit framework being deployed by multiple actors using the same default configuration.

Notable Paths & Techniques

Several paths recorded this week fall outside known campaign signatures and deserve independent scrutiny.

Database Credential Probing

• database=postgres — 6,809 hits. High-volume targeted probing of PostgreSQL authentication. Likely credential stuffing or default credential checks against exposed instances.

Shell Injection & Busybox Propagation

• sh\n/bin/busybox — 2,658 hits
• sh — 1,334 hits
• ;sh\nbusybox — 665 hits

These patterns are characteristic of Mirai-lineage botnet propagation. After initial telnet authentication, malware drops busybox to establish a persistent foothold and enumerate architecture for payload selection. The UNSTABLE string (3,966 hits) may correspond to a specific Mirai variant build tag observed in the wild.

Default Credential Attempts

The pass=xc3511 and pass=vizxv credentials are highly specific to HiSilicon-based IP cameras and Dahua DVR/NVR hardware — a fingerprint consistent with Mirai and its descendants. The presence of these alongside the Hikvision ISAPI RCE campaign suggests actors are pursuing multiple vectors against surveillance hardware simultaneously.

Geographic Distribution

US and CN together account for 57% of probe traffic. US-origin traffic is primarily scan-driven from cloud and shared hosting infrastructure (GoDaddy dominates this week). CN-origin traffic skews toward high-volume single-source scanning. Romanian traffic is consistent with prior weeks and associated with SS-Net hosted infrastructure. The Netherlands presence, while modest in volume, is a typical indicator of VPN exit node or proxy-based scanning.

Recommendations

Immediate Priority:

• Patch GeoServer CVE-2024-36401 immediately if running exposed GeoServer instances. This is the most recently disclosed RCE in this week's active campaign set and patching lag is being actively exploited.
• Audit internet-facing Exchange deployments for ProxyLogon indicators. Any on-premises Exchange server not patched to at least March 2021 CU levels should be treated as compromised until verified otherwise.
• Firewall or VPN-gate all Telnet (TCP 23) exposure. This week's data confirms sustained mass credential attacks; no legitimate management use case justifies open internet telnet access.

Short-Term Actions:

• Rotate all default credentials on IP cameras, DVRs, and NAS devices — particularly Dahua and HiSilicon-based hardware. The presence of xc3511 and vizxv passwords in probe traffic confirms active targeting of these device families.
• Restrict PostgreSQL (TCP 5432) to internal networks or authenticated tunnels only. The 6,809 database=postgres probe events indicate active reconnaissance for exposed instances.
• Block or rate-limit known scan ASNs at the perimeter, specifically GoDaddy-hosted IP ranges contributing disproportionate scan volume this week.
• Disable PHPUnit from production environments. CVE-2017-9841 targets a development dependency that should never be deployed to production; its continued exploitation reflects persistent misconfigurations.

Ongoing:

• Monitor for busybox and UNSTABLE build tag indicators in endpoint telemetry — these are reliable post-compromise markers for Mirai-family infections on embedded Linux systems.
• Continue tracking the five concurrent critical RCE campaigns for volume divergence next week; if hit counts decouple, it may indicate campaign operators splitting toolkits or shifting targeting priorities.
• Maintain blocklists derived from Romanian (SS-Net) and Alibaba cloud ranges generating high-volume scan traffic to this sensor.