Threat Pulse W39 — Volume Drop With Persistent RCE Campaign Pressure

Executive Summary

Week 39 (2026-09-14 to 2026-09-21) saw a significant 34% reduction in total inbound probes to 61,382, suggesting either a temporary lull in opportunistic scanning infrastructure or a coordinated pause by key actors. Despite the volume drop, the threat landscape remained serious: five distinct critical-severity RCE campaigns were simultaneously active, and bruteforce and exploit activity held steady in absolute terms. SSH and Telnet facades continued to dominate, reinforcing that legacy protocol exposure remains the primary attack surface for mass-scanning operations.

Attack Volume & Trends

Facade Breakdown:

Scans accounted for 71.8% of all activity, consistent with broad-net opportunistic reconnaissance. The SSH facade absorbed nearly half of all traffic (47.9%), followed by Telnet at 25.6%. Database facades (MySQL, PostgreSQL, Redis, MongoDB) collectively received 7,169 hits — a meaningful share that reflects continued interest in exposed data-layer services.

The overall volume reduction may reflect weekend infrastructure downtime, botnet disruption, or simply rotation of targeting priorities among active threat actors. The relative stability of RCE and exploit counts despite the overall drop suggests that higher-intent, targeted activity was largely unaffected.

Top Threat Actors

Key observations:

• The top source (ID, PT Air Lintas Komunikasi) generated 4,155 events almost exclusively via scanning, consistent with an automated tool or botnet node rather than a human operator.
• The Norwegian-registered source (Sino Worldwide Trading Limited) stands out as the only top actor primarily engaged in recon rather than raw scanning. The ASN name suggests a hosting or reseller environment potentially used as a proxy. This warrants monitoring for follow-on exploit activity.
• The Nigerian source attributed to ABCCLOUD SDN.BHD. is notable — the SDN.BHD. suffix indicates a Malaysian-registered entity, suggesting either geolocation/ASN routing anomalies or abuse of cloud infrastructure registered in one jurisdiction and operated from another.
• All top actors operated at the scanning/recon tier; no single source IP was the dominant driver of RCE or exploit traffic this week, suggesting those campaigns are distributed across a broader botnet.

Active Campaigns

Five critical campaigns were simultaneously active this week, each logging an identical 17,294 hits — a pattern that strongly suggests coordinated, multi-vector tooling or a single actor/toolkit firing all payloads in parallel.

Analysis:

• The identical hit count across all five campaigns is statistically improbable without coordination. This pattern is consistent with a single automated scanner or exploit framework running a fixed payload bundle against the honeypot's IP range.
• Hikvision ISAPI RCE continues to signal active targeting of IP cameras and DVR systems — a persistent IoT attack vector with a large vulnerable device population globally.
• PHPUnit eval-stdin (CVE-2017-9841) is a 9-year-old vulnerability still seeing heavy exploitation, confirming that unpatched legacy PHP deployments remain common and lucrative targets.
• GeoServer OGC Filter RCE (CVE-2024-36401) is comparatively recent and its inclusion alongside older CVEs suggests threat actors are rapidly incorporating new high-value vulnerabilities into existing toolchains.
• Exchange ProxyLogon (CVE-2021-26855) remains a persistent fixture in campaign data, indicating many Exchange deployments remain unpatched years after public disclosure.

Notable Paths & Techniques

Several emerging or noteworthy probe patterns were observed outside known campaigns:

• / (1,059 hits): Generic root-path HTTP requests are standard fingerprinting behavior, used to determine server software via response headers and content before targeted exploitation.
• database=postgres (868 hits): Direct PostgreSQL connection string probes suggest actors are testing for misconfigured or unauthenticated PostgreSQL services, consistent with the 2,564 hits on the fake-postgres facade.
• UNSTABLE (563 hits): This string pattern on the Telnet facade is consistent with Mirai variant handshaking behavior. "UNSTABLE" appears in some Mirai forks as a banner-check or session probe.
• set (521 hits): Likely Redis SET command probes targeting unauthenticated Redis instances — consistent with the 1,384 hits on fake-redis. Attackers use Redis SET commands to write malicious cron jobs or SSH keys for persistence.
• IZ1H9 (434 hits): This string is associated with the IZ1H9 Mirai variant, which targets a wide range of routers and IoT devices. Its appearance confirms active Mirai-family botnet recruitment operations against the sensor.
• sh\n/bin/busybox (312 hits): Classic post-exploitation shell probe used to confirm BusyBox availability on embedded Linux devices — a standard step in IoT botnet infection chains.
• pass=enable, pass=1234, pass= (222, 198, 195 hits): Default and blank credential attempts on Telnet — consistent with IoT device credential stuffing targeting common factory-default passwords.
• /favicon.ico (193 hits): Favicon requests are commonly used for server fingerprinting and to identify specific web application frameworks.

The convergence of Mirai-specific strings (UNSTABLE, IZ1H9, sh/bin/busybox) and default credential attempts paints a clear picture: active IoT botnet recruitment operations were running in parallel with the RCE campaign activity this week.

Geographic Distribution

The US and Germany entries likely represent compromised VPS instances or rented infrastructure rather than domestically-operated threat actors, given the hosting-heavy nature of their ASN profiles. Indonesia and Thailand are represented at elevated levels consistent with their top-ranking source IPs. The Nigeria entry is notable in context of the ABCCLOUD SDN.BHD. attribution anomaly noted above.

Recommendations

1. Patch immediately — GeoServer CVE-2024-36401: This recent, actively-exploited RCE vulnerability has been incorporated into mass-scanning toolkits. Any internet-facing GeoServer instance should be patched or taken offline without delay.

1. Audit and harden IoT/embedded device deployments: The presence of IZ1H9 Mirai variant signatures, BusyBox probe commands, and default credential attempts confirms active IoT recruitment campaigns. Audit all network-attached devices, change default credentials, and segment IoT devices from production networks.

1. Restrict Redis, PostgreSQL, and MongoDB exposure: Database facades received over 7,100 combined hits. Ensure no database services are internet-reachable without authentication and IP allowlisting. Redis SET-based persistence attacks are trivial to execute on unauthenticated instances.

1. Review Telnet exposure: With 15,732 Telnet facade hits, any operational Telnet service represents significant risk. Migrate to SSH universally; disable Telnet at the network perimeter.

1. Monitor for ProxyLogon and PHPUnit post-exploitation: These legacy vulnerabilities continue to see active exploitation. Organizations running unpatched Exchange or PHP environments should treat compromise as a working hypothesis and conduct threat hunting exercises.

1. Investigate the identical campaign hit-count anomaly: The 17,294 identical hits across five campaigns may indicate a single source not captured in top-IP data, or traffic distributed across many low-volume sources. Correlating by payload signature rather than source IP may reveal campaign infrastructure details.

1. Track the Norwegian/Sino Worldwide recon source: The elevated recon (not scan) behavior from this actor distinguishes it from opportunistic scanners and may indicate pre-exploitation intelligence gathering. Monitor for follow-on activity from associated infrastructure.