Threat Pulse W36 — Volume Drop Masks Critical RCE Campaign Surge

Executive Summary

Week 36 (2026-08-24 to 2026-08-31) recorded 101,661 inbound probes, a 21.6% decline from the prior week. However, the volume drop should not be interpreted as reduced threat activity. Five concurrent critical-severity RCE campaigns each registered identical hit counts of 35,523, indicating a coordinated, broad-spectrum exploitation sweep rather than targeted opportunism. Telnet remained the dominant attack surface by a wide margin, and GoDaddy-hosted infrastructure continued to serve as a primary scan origination point.

Attack Volume & Trends

Scans account for 65% of all traffic, confirming that the bulk of activity is reconnaissance and target enumeration rather than direct exploitation. Bruteforce remains the second-largest category, concentrated on the fake-ssh and fake-telnet facades.

Traffic by Facade

fake-telnet attracted 45.7% of all probes, disproportionately high relative to other services. This aligns with the IZ1H9 and UNSTABLE Mirai-variant signatures observed in the notable paths data (see below). fake-postgres remains a high-value target, with database=postgres appearing as the top novel path at 8,211 hits.

Top Threat Actors

Four of the top five sources originate from GoDaddy-hosted infrastructure (AS26496), collectively accounting for approximately 26,700 events — over 26% of total weekly traffic. This concentration on a single commercial hosting provider is notable. GoDaddy-hosted nodes are frequently associated with compromised shared hosting environments or abused virtual machines. The Romanian SS-Net source is consistent with prior weeks and may represent persistent scanning infrastructure.

Active Campaigns

All five tracked campaigns reported an identical hit count of 35,523 this week. This uniformity strongly suggests a single automated toolset or botnet performing multi-payload sweeps simultaneously against each sensor interaction.

Key Observations

• Hikvision ISAPI RCE: Continued targeting of IP cameras and DVR devices. Combined with Mirai-related path signatures (sh, /bin/busybox), this suggests active IoT botnet recruitment efforts.
• PHPUnit eval-stdin RCE (CVE-2017-9841): Despite being nearly a decade old, this vulnerability remains actively exploited. Unpatched legacy PHP applications continue to offer viable targets.
• Apache Path Traversal / RCE: Covers a family of Apache HTTP Server vulnerabilities. The presence of bare / path hits (806 events) may be associated with root-level traversal probing.
• GeoServer OGC Filter RCE (CVE-2024-36401): A more recent critical vulnerability in GeoServer, indicating threat actors are rapidly operationalizing newly disclosed CVEs alongside older ones.
• Exchange ProxyLogon (CVE-2021-26855 and related): Targeting of on-premises Exchange servers persists years after initial disclosure, reflecting the long tail of enterprise patching cycles.

Notable Paths & Techniques

Analysis

• The database=postgres path dominating novel hits (8,211) correlates with the elevated fake-postgres facade traffic. Attackers are probing for unauthenticated or default-credential PostgreSQL instances.
• /bin/busybox and sh payloads are textbook Mirai post-exploitation commands, used to download and execute botnet malware on compromised IoT devices.
• pass=xc3511 is a well-known Hikvision factory default, directly linking bruteforce activity to the Hikvision ISAPI RCE campaign.
• IZ1H9 and UNSTABLE are named Mirai variants with documented histories of targeting routers and cameras. Their presence confirms active botnet propagation campaigns this week.
• set commands against fake-redis indicate automated Redis exploitation attempts, commonly used for unauthorized data access or cryptominer deployment.

Geographic Distribution

The United States ranking first by event volume is attributable to abused commercial hosting infrastructure rather than domestic threat actors. Romania maintains a disproportionately high share relative to its internet footprint, consistent with hosted scanning-as-a-service or persistent criminal infrastructure. Indonesia activity at 3,744 events is consistent with high regional IoT infection rates feeding Mirai-family botnets.

Recommendations

• Prioritize Hikvision and IoT patching: The convergence of Hikvision ISAPI RCE, pass=xc3511 bruteforce, and Mirai shell-drop payloads indicates active, multi-stage campaigns targeting camera and DVR devices. Audit all internet-exposed IoT devices immediately and apply vendor patches or firewall ingress.

• Block or rate-limit GoDaddy ASN traffic at perimeter: Four of the top five source IPs originate from AS26496. Where GoDaddy-hosted traffic is not operationally required, applying ingress rate limits or temporary blocks may reduce scan noise significantly.

• Patch PHPUnit and legacy PHP dependencies: CVE-2017-9841 continues to see active exploitation. Any application still shipping PHPUnit in a web-accessible path (particularly vendor/phpunit) should remediate immediately.

• Audit PostgreSQL exposure: 8,211 probes on database=postgres this week signals sustained interest in database services. Ensure PostgreSQL is not internet-exposed; if required, enforce strong credentials, TLS, and IP allowlisting.

• Monitor for GeoServer CVE-2024-36401: This is a recent critical vulnerability that has been rapidly operationalized. Organizations running GeoServer should apply patches and validate WAF rules against OGC filter injection payloads.

• Harden Redis deployments: The set command probes confirm Redis remains a target. Redis should never be bound to public interfaces without authentication; enforce requirepass and bind to localhost or VPN interfaces only.

• Review Exchange patch status: ProxyLogon exploitation attempts persist. On-premises Exchange environments should be fully patched to the latest Cumulative Update and monitored for webshell artifacts.