Threat Pulse W37 — Volume Drop Masks Persistent RCE Campaign Surge

Executive Summary

Week 37 (2026-08-31 to 2026-09-07) recorded 66,942 inbound probes across all honeypot facades — a 34.2% reduction from the prior week. However, the volume drop is misleading: five independently tracked critical RCE campaigns each registered 21,524 hits, suggesting a coordinated or automated multi-exploit framework systematically probing HTTP/HTTPS surfaces. Credential brute-force and shell injection activity against SSH and Telnet facades remained elevated, with IoT-oriented payloads (busybox, IZ1H9, UNSTABLE) appearing prominently in novel path data.

Attack Volume & Trends

Facade breakdown:

SSH and Telnet together account for 69.4% of all probe traffic, consistent with continued automated credential-stuffing and IoT exploitation operations. The near-identical hit counts on fake-http and fake-https (6,600 vs 6,598) strongly suggest the same scanner tooling targeting both ports indiscriminately. Database facades (MySQL, PostgreSQL, Redis, MongoDB) collectively drew 7,281 probes, a non-trivial attack surface that warrants monitoring.

Top Threat Actors

Key observations:

• GoDaddy (US): The top source by a wide margin with 4,388 events, exclusively scanning. Likely a compromised hosted instance or automated scan tool running on shared infrastructure.
• Hetzner (DE): A recurring fixture in honeypot telemetry globally. The volume here is consistent with a low-speed, persistent scanner operating from a rented VPS.
• Google LLC (US): 1,856 recon-classified events. While some traffic may originate from legitimate crawler infrastructure, the recon classification and volume warrant scrutiny. Could indicate abuse of Google Cloud Compute instances.
• DigitalOcean (SG): Singapore-egress scanning is common for actors deliberately selecting geographically dispersed infrastructure. Likely a rented droplet running automated tooling.
• Omegatech LTD (US): A lesser-known provider appearing as a significant recon source. Omegatech-attributed traffic should be monitored for escalation toward exploit attempts.

Active Campaigns

Five campaigns were tracked this week, each recording an identical 21,524 hits — a statistical anomaly strongly suggesting a single automated framework or campaign orchestrator cycling through multiple exploit modules sequentially against the same target pool.

Analysis:

The uniform hit count across five distinct campaigns is the most significant finding of the week. This pattern is characteristic of multi-exploit scanner frameworks (e.g., tools similar to Nuclei, custom botnet propagation modules, or Mirai-derivative loaders) that iterate through a fixed exploit list against a discovered target list. Targets likely include exposed management interfaces, legacy web applications, and unpatched enterprise software.

• Hikvision ISAPI RCE and GeoServer OGC Filter RCE both target IoT/geospatial infrastructure often overlooked in enterprise patch cycles.
• PHPUnit eval-stdin (CVE-2017-9841) remains a durable attack vector despite its age — unpatched PHP development environments persist at scale.
• Exchange ProxyLogon (CVE-2021-26855) continues to see active exploitation years after disclosure, targeting organizations that have not applied Microsoft patches or retired on-premises Exchange.
• Apache Path Traversal / RCE covers a broad family of Apache vulnerabilities; operators should ensure Apache HTTPD and Struts deployments are fully patched.

Notable Paths & Techniques

The following paths and payloads appeared in probe data this week and are not attributed to tracked campaigns:

Key takeaways:

• The presence of IZ1H9 and UNSTABLE strings confirms active Mirai-family botnet propagation targeting embedded/IoT devices reachable on Telnet and SSH facades.
• The /bin/busybox payload in combination with shell injection fragments (;sh\necho, sh) indicates attackers probing for command injection vulnerabilities in web interfaces and IoT management panels.
• Redis SET command probes reflect continued opportunistic targeting of unauthenticated Redis instances exposed to the internet.
• database=postgres parameter probing against the PostgreSQL facade suggests credential enumeration or exploitation of misconfigured connection strings.
• Credential pairs pass=1234 and pass=admin reflect low-effort, high-volume stuffing consistent with botnet-driven automation targeting default configurations.

Geographic Distribution

The US-attributed volume is largely an artifact of cloud infrastructure hosting (GoDaddy, Google Cloud) rather than geographically native actors. Germany's contribution is similarly cloud-provider-driven. China and India represent more distributed sourcing. Pakistan's appearance at position 8 with 2,149 events is worth noting for trend analysis in coming weeks.

Recommendations

1. Patch critical RCE surfaces immediately. The five active campaigns (Hikvision, PHPUnit, Apache, GeoServer, Exchange ProxyLogon) target known, patched CVEs. Organizations still running vulnerable versions face active, automated exploitation. Prioritize patch verification for on-premises Exchange, Apache deployments, and any internet-exposed GeoServer or Hikvision endpoints.

1. Remove or firewall internet-facing database ports. PostgreSQL (5432), Redis (6379), MySQL (3306), and MongoDB (27017) should never be exposed directly to the internet. Enforce network-level access controls and require authentication on all database services.

1. Hunt for Mirai-family infections. The IZ1H9 and UNSTABLE markers indicate active botnet propagation. Audit IoT and embedded devices on your network for unexpected outbound connections, unusual CPU usage, or default credential exposure on Telnet/SSH.

1. Harden SSH and Telnet surfaces. SSH (27,666 hits) and Telnet (18,797 hits) remain the highest-volume attack targets. Disable Telnet universally. For SSH: enforce key-based authentication, disable root login, and implement rate-limiting or fail2ban-equivalent controls.

1. Monitor cloud-egress scanning from shared hosting ASNs. GoDaddy and Google LLC-attributed scanning volume is high. If your organization uses these providers, audit hosted instances for compromise or unauthorized tooling. Consider ASN-level alerting for scan traffic originating from shared hosting environments.

1. Track Pakistan-sourced traffic in coming weeks. The 2,149-event volume from PK-attributed sources is a notable uptick. If this trend continues or shifts from scan to exploit-type traffic, targeted blocking or enhanced logging may be warranted.

1. Audit Redis instances for unauthenticated access. The set command probes against the Redis facade indicate continued targeting. Enable requirepass in Redis configuration and bind only to localhost or trusted interfaces.