Threat Pulse W38 — Sharp Surge in RCE Campaigns & Telnet Exploitation

Executive Summary

The honeypot sensor at tarpit-lab.xyz recorded 92,931 inbound probes during the week of September 7–14, 2026 — a 38.8% spike over the prior week. Five simultaneous critical-severity RCE campaigns each registered identical hit counts, suggesting coordinated or automated multi-vector tooling. The fake-telnet facade absorbed the largest share of traffic, consistent with ongoing IoT and embedded device targeting. Credential brute-force attempts against database services (MySQL, PostgreSQL, Redis, MongoDB) remained persistent, and newly observed paths indicate active exploitation of default credentials and shell injection attempts.

Attack Volume & Trends

Facade breakdown:

Telnet's dominant share (41.9%) points to sustained automated scanning of IoT and embedded Linux targets. The combined database facades (MySQL + PostgreSQL + Redis + MongoDB) accounted for 6.5% of traffic — a non-trivial surface given how frequently these services are exposed with weak or default credentials.

The overall volume spike is likely attributable to a single or small cluster of automated scanning platforms executing multi-campaign playbooks simultaneously, evidenced by identical hit counts across five distinct RCE campaign signatures.

Top Threat Actors

Key observations:

• GoDaddy-hosted IPs collectively contributed over 23,700 events across three distinct source addresses, accounting for approximately 25.5% of total probe volume. This is almost certainly indicative of compromised shared hosting or VPS infrastructure rather than GoDaddy as an actor. Abuse reports to GoDaddy's NOC are warranted.
• The Host Universal Pty Ltd source focused on recon activity (~12,926 events), suggesting structured enumeration behavior — potentially a crawler or vulnerability scanner building target inventories.
• The DigitalOcean GB-routed source generated 3,643 scanning events; cloud provider abuse for scanning is a well-established pattern and should be reported upstream.

Active Campaigns

All five tracked campaigns recorded 33,678 hits each, a statistically improbable uniformity that strongly suggests a single automated framework dispatching these probes in parallel or that a counting artifact normalized these figures. Regardless, each campaign represents an active, critical-severity threat.

Analysis: The simultaneous activation of five critical RCE campaigns — spanning IoT firmware, PHP frameworks, web servers, geospatial platforms, and enterprise email — is consistent with multi-exploit botnet recruitment tooling (e.g., Mirai derivatives or Mozi successors). Defenders should treat this as an active, broad-spectrum exploitation wave rather than isolated incidents.

Notable Paths & Techniques

The following paths and probe strings were observed at significant volume outside of known campaign signatures:

Highlights:

• IZ1H9 and UNSTABLE are well-documented Mirai botnet variant identifiers, confirming active IoT recruitment campaigns aligned with the high telnet facade traffic.
• pass=xc3511 is the factory default password for a large range of Hikvision OEM cameras, directly corroborating the Hikvision ISAPI RCE campaign above.
• The Redis set command probes target misconfigured Redis instances with no authentication — a vector historically used to write cron jobs or SSH keys for persistence.
• Shell injection attempts (;sh\necho) indicate opportunistic command injection probing across multiple service types.

Geographic Distribution

US dominance (53.6%) is primarily an artifact of large hosting providers (GoDaddy, DigitalOcean) being leveraged as scanning infrastructure — the attacks do not necessarily originate from US-based threat actors. Turkey and Pakistan both show volumes worth monitoring for trend confirmation in coming weeks.

Recommendations

1. Patch critical RCE vulnerabilities immediately. All five active campaigns target known, patched CVEs. Organizations running Hikvision devices, Apache 2.4.49–2.4.50, GeoServer, unpatched Exchange, or exposed PHPUnit installations are at acute risk. Apply vendor patches or isolate these services.

1. Disable or firewall Telnet (port 23) globally. With 41.9% of probe volume targeting the telnet facade and confirmed Mirai variant activity, any internet-exposed Telnet service should be considered compromised until proven otherwise.

1. Audit and harden database services. Redis, PostgreSQL, MySQL, and MongoDB instances should never be internet-exposed without authentication. Enforce strong passwords, bind to localhost or private networks, and use firewall rules to restrict access.

1. Rotate Hikvision default credentials. The pass=xc3511 probe volume confirms active targeting of factory-default camera credentials. All Hikvision and OEM-equivalent devices should have default passwords changed and ISAPI remote access disabled where not required.

1. Report compromised hosting infrastructure. The GoDaddy and DigitalOcean sources generating tens of thousands of events should be reported to the respective abuse teams with log evidence. Blocking at the ASN level is not recommended due to collateral impact but IP-level blocks are appropriate.

1. Monitor for Mirai beacons. The presence of IZ1H9 and UNSTABLE strings indicates active botnet recruitment. Network defenders should add detection rules for these strings on ingress traffic and monitor for outbound C2 connections on compromised embedded devices.

1. Implement Redis authentication and rename dangerous commands. The set command probes confirm unauthenticated Redis access attempts. Enable requirepass, use rename-command for dangerous operations, and ensure Redis is not accessible from untrusted networks.