Threat Pulse W42 — Critical RCE Campaigns Dominate Amid Volume Drop

Executive Summary

Week 42 (2026-10-05 to 2026-10-12) recorded 165,458 inbound probes, a 23.6% decline versus the prior week. Despite lower overall volume, the threat landscape remained severe: five distinct critical-severity RCE campaigns — targeting Hikvision ISAPI, PHPUnit, Apache, GeoServer, and Exchange ProxyLogon — each registered over 101,000 hits, indicating a concentrated, automated exploitation push rather than broad opportunistic noise. Reconnaissance and scanning activity together accounted for more than 80% of classified events, consistent with pre-exploitation infrastructure mapping.

Attack Volume & Trends

Facade breakdown:

HTTP and HTTPS facades together absorbed 53.2% of all traffic, reflecting the continued dominance of web-layer exploitation attempts. Telnet remained surprisingly high at 27.6%, suggesting sustained IoT/embedded device targeting. Database facades (Postgres, Redis, MySQL, MongoDB) collectively received 6,313 probes, a meaningful signal of credential-stuffing and misconfiguration hunting against exposed database services.

The overall volume drop may reflect weekend timing, upstream blocking of known scanner infrastructure, or a natural ebb in campaign scheduling — it does not indicate reduced threat actor capability.

Top Threat Actors

Key observations:

• Oracle Corporation (NL) infrastructure accounts for two of the top three sources, contributing a combined 77,953 events — roughly 47% of total weekly volume. Both sources exhibit dominant scan behavior, consistent with either a contracted internet-measurement service or compromised cloud instances being used as scanning platforms. Oracle Cloud's permissive free-tier policies continue to make it an attractive launchpad for high-volume scanners.
• GoDaddy.com (US) contributes two additional top-five sources with a combined 31,311 events. Shared hosting and VPS infrastructure from major providers is routinely abused; these sources warrant abuse report escalation.
• Bucklog SARL (FR) stands out as a recon-dominant actor at 2,999 events, suggesting focused reconnaissance against specific services rather than broad internet sweeping.

No single actor demonstrated bruteforce or exploit-dominant behavior at scale this week, though campaign-level RCE activity (see below) points to automation operating across distributed infrastructure.

Active Campaigns

All five tracked campaigns registered an identical 101,144 hits this week — a strong indicator that a single coordinated automation framework drove all five simultaneously, cycling through known critical CVEs in a unified scan-and-exploit chain.

Analysis: The uniform hit count across all five campaigns is analytically significant. This pattern is characteristic of a single multi-exploit scanner that tests all five vulnerabilities per target rather than five independent campaigns. Defenders should treat these as a bundled threat: exposure to any one of these CVEs likely means the same actor probed all five on the same host. GeoServer CVE-2024-36401 is the most recently disclosed vulnerability in this set and represents the highest patching urgency for organizations running geospatial infrastructure.

Notable Paths & Techniques

HTTP Path Probing

Credential patterns observed (database/auth facades):

Technique highlights:

• /cgi-bin-sdb/ is specifically associated with Synology DiskStation Manager (DSM) devices, indicating targeted NAS hunting — likely for ransomware staging or data exfiltration.
• The /phpmyadmin/ and /manager/ paths receiving near-identical hit counts (1,727 each) reinforces the bundled scanner hypothesis — a single tool testing multiple admin interfaces per target.
• Credential patterns pass=admin and pass=1234 confirm ongoing default-credential campaigns against database services. The database=postgres pattern at 1,239 hits reflects mass probing of exposed PostgreSQL instances.
• Root path (/) probing at 3,864 hits serves as a universal reconnaissance step to capture server banners, framework disclosures, and redirect behavior before targeted exploitation.

Geographic Distribution

The Netherlands accounting for 49.2% of all source traffic is heavily skewed by the two Oracle Cloud sources. Stripping those out, the underlying geographic distribution is more typical for honeypot traffic. Turkey (TR) at 4,302 events is worth flagging for trend monitoring — if this figure grows in W43, further investigation of specific ASNs is warranted.

Recommendations

1. Patch GeoServer immediately. CVE-2024-36401 (GeoServer OGC Filter RCE) is the most recently disclosed critical vulnerability in this week's active campaign set and is being actively weaponized. Any internet-facing GeoServer instance should be patched or isolated without delay.

1. Audit Exchange deployments. ProxyLogon (CVE-2021-26855) activity persists years after disclosure. Organizations still running unpatched on-premises Exchange should treat this as a critical finding. Consider migration to patched versions or cloud-hosted alternatives.

1. Remove or restrict PHPUnit from production. CVE-2017-9841 affects PHPUnit's eval-stdin.php file. This file should never be present on production web servers; its presence represents a trivially exploitable RCE condition.

1. Disable or firewall /cgi-bin/ and /cgi-bin-sdb/ on all internet-facing devices that do not require CGI functionality. Synology NAS devices should not be directly internet-exposed; place behind VPN if remote access is required.

1. Block default credentials at the service level. The volume of pass=admin and pass=1234 attempts against database facades confirms that default credentials remain an active attack vector. Enforce strong, unique passwords and disable default accounts on all database services.

1. Report abuse to Oracle and GoDaddy. The concentration of scan traffic originating from these providers' infrastructure warrants formal abuse reports. Many providers will act on reports, potentially disrupting the scanning infrastructure.

1. Monitor Turkey-origin traffic (TR). The 4,302 events from Turkish sources this week represent a potential emerging trend. Increase logging fidelity for TR-origin connections in W43 to assess whether this represents new campaign infrastructure.

1. Restrict database service exposure. The 6,313 probes across Postgres, Redis, MySQL, and MongoDB facades highlight the risk of internet-exposed database services. These should be bound to localhost or private network interfaces exclusively, with firewall rules enforcing the restriction.