Threat Pulse W35 — Mass Scan Dominance & Multi-Platform RCE Campaigns

Executive Summary

Week 35 (2026-08-17 to 2026-08-24) recorded 129,648 inbound probes, a marginal 0.6% decline versus the prior week — effectively flat, indicating sustained attacker interest rather than an easing of pressure. Scanning activity dominated at 72.4% of all events, driven heavily by three GoDaddy-hosted source IPs that collectively generated over 57,000 events. Five critical RCE campaigns ran in parallel across the full week, suggesting coordinated or automated exploitation infrastructure targeting a broad range of unpatched services. IoT credential stuffing indicators (Mirai-family default passwords) remained prominent across Telnet and database facades.

Attack Volume & Trends

Facade breakdown:

The fake-telnet facade absorbed nearly 68% of all traffic — a persistent pattern consistent with IoT botnet recruitment attempts. Database facades (PostgreSQL, MySQL, Redis, MongoDB) combined for over 19,700 hits, reflecting continued automated database enumeration. The near-identical hit counts on fake-postgres and fake-ssh suggest coordinated tooling scanning both port 5432 and 22 simultaneously.

Top Threat Actors

Key observations:

• Three distinct GoDaddy-hosted IPs accounted for ~57,932 events combined (~44.7% of weekly total). This volume from a single commercial hosting provider points to either compromised shared-hosting accounts or rented VPS infrastructure being abused for mass scanning. GoDaddy's abuse team should be considered for reporting.
• The SS-Net (Romania) source contributed 14,283 scan events — a regionally notable actor for this sensor, consistent with Eastern European scanning infrastructure observed in prior weeks.
• The Alibaba Cloud (CN) source at 10,680 events continues a recurring pattern of Chinese cloud-originated reconnaissance seen across multiple reporting periods.
• All top-five actors are scan-dominant, suggesting automated, non-targeted reconnaissance rather than focused intrusion attempts from these nodes.

Active Campaigns

Five campaigns each recorded 35,745 hits — an identical count that strongly suggests a single automated campaign framework cycling through multiple exploit modules against each connection.

Analysis:

• The uniform hit count across all five campaigns is analytically significant. This is consistent with a single scanning tool or exploit framework that attempts all five payloads per target session, rather than five independent campaigns. The total (~178,725 campaign hits) exceeds the week's total probe count, confirming multiple payloads per connection.
• Hikvision ISAPI RCE targets IP cameras and NVRs — a well-known IoT attack surface that aligns with the high Telnet facade volume and IoT credential patterns observed.
• PHPUnit eval-stdin (CVE-2017-9841) remains a persistent low-effort, high-yield exploit against legacy PHP deployments that have never been patched.
• Exchange ProxyLogon (CVE-2021-26855 family) continues to see active exploitation years after disclosure, underscoring the longevity of critical Exchange vulnerabilities in unpatched environments.
• GeoServer OGC Filter RCE (CVE-2024-36401) is a more recent addition to attacker toolkits and its presence confirms threat actors are integrating 2024-era CVEs into multi-exploit frameworks.

Notable Paths & Techniques

Key findings:

• The pass=xc3511 and pass=vizxv entries are known Mirai botnet default credentials targeting Hikvision and Dahua IP cameras respectively. Their presence alongside the Hikvision ISAPI RCE campaign strongly suggests a combined approach: try known CVE exploitation first, fall back to credential stuffing.
• /bin/busybox execution attempts indicate attackers are past the authentication stage on some targets (or testing post-exploitation paths), attempting to fingerprint the OS and download Mirai payloads.
• The UNSTABLE string seen 3,340 times is consistent with Telnet negotiation artifacts from Mirai-family scanners probing for responsive Telnet daemons.
• database=postgres at 7,370 hits aligns directly with the fake-postgres facade volume, confirming targeted PostgreSQL enumeration tooling in active use.

Geographic Distribution

The US share (49.8%) is inflated by abused commercial hosting — the underlying attack infrastructure is not necessarily US-operated. Romania's 11.9% share is disproportionately high relative to its internet population and merits continued monitoring. The diversity of source countries (8 significant contributors) reflects broad, internet-wide automated scanning rather than a geographically focused campaign.

Recommendations

1. Patch critical RCE vulnerabilities immediately. All five active campaigns target known, CVE-tracked vulnerabilities with public exploits. Prioritize: Exchange ProxyLogon, GeoServer CVE-2024-36401, Apache path traversal variants, and PHPUnit deployments. Hikvision ISAPI firmware updates should be applied across all network-accessible cameras.

1. Disable Telnet on all IoT and embedded devices. Telnet attracted 67.7% of weekly probe volume. No modern deployment requires unauthenticated or cleartext Telnet access. Replace with SSH where remote management is necessary.

1. Enforce non-default credentials on all internet-facing devices. The presence of pass=xc3511, pass=vizxv, pass=admin, and blank password attempts confirms that default credentials remain a primary attack vector. Implement credential change enforcement at device provisioning.

1. Segment and firewall database services. PostgreSQL, MySQL, Redis, and MongoDB should never be directly internet-accessible. Combined, these facades received nearly 20,000 probes this week. Network-level access controls should restrict database ports to application-tier hosts only.

1. Report GoDaddy-hosted scanning infrastructure. Three source IPs within a single commercial hosting provider generated 44.7% of weekly traffic. Submit abuse reports to the provider with supporting log evidence. Commercial hosting abuse teams can act on well-documented complaints.

1. Monitor for post-exploitation busybox activity. The /bin/busybox execution pattern indicates some attacker sessions are progressing beyond initial access. Ensure endpoint detection rules flag busybox-based lateral movement and file download attempts on Linux/IoT assets.

1. Track GeoServer deployments. CVE-2024-36401 (GeoServer OGC Filter RCE) is a 2024 vulnerability now integrated into multi-exploit frameworks. Any internet-facing GeoServer instance must be updated to a patched release immediately.