This year, we rebuilt much of the APNIC Honeynet to broaden the range of activity we can observe. We upgraded the backend that collects and processes sensor data, refreshed our Cowrie and Dionaea sensors, and added OpenCanary and Webpot. We also expanded coverage beyond SSH, Telnet, Windows, and web services to include honeypots that mimic a Fortinet SSL-VPN portal and an Android device with its debug port exposed.
Captured malware now flows into a Linux sandbox that integrates with threat intelligence platforms such as MISP and Abuse.ch, providing greater visibility into the activity we observe.
It is still too early for a detailed analysis, but the rebuilt network is already revealing interesting patterns. From 21-27 September 2026, almost 99,000 distinct IP addresses interacted with our honeypots, generating 173 million logged events.
Throughout this article, we measure attackers by unique source IP rather than event volume. A single bot can generate millions of log entries, while another system may connect only once. Counting unique IPs therefore better indicates how many devices reach our sensors. The sensors also perform limited interactions to confirm connections and exploitation attempts and gather additional context.
The week at a glance
Nearly three-quarters of attackers targeted SSH or Telnet. Cowrie, our SSH and Telnet honeypot, saw 72,256 distinct IPs (Table 1).
Honeypot | What it pretends to be | Unique IPs | Share of all observed IPs | Events |
Cowrie | SSH and Telnet login on a Linux or IoT device | 72,256 | 73% | 121.1 million |
Dionaea | Windows and database services (SMB, MSSQL, MySQL, SIP) | 21,210 | 21% | 12.9 million |
OpenCanary | Remote access and databases (RDP, MSSQL, VNC, SIP, MySQL) | 14,393 | 15% | 34.5 million |
Fortinet | A FortiGate firewall’s SSL-VPN | 1,876 | 2% | 4.4 million |
ADBHoney | An Android device with its debug port (5555) open | 1,841 | 2% | 23,000 |
Webpot | Web applications | 1,723 | 2% | 32,000 |
All honeypots | 98,958 | 173.0 million |
In Table 1, the events column shows why IPs matter. OpenCanary saw one-fifth as many attackers as Cowrie but logged more events per attacker, about 2,400 compared with 1,700.
Where the attackers came from
By Regional Internet Registry (RIR) region, attackers split almost evenly between Asia Pacific and Europe, with Latin America a clear third (Figure 1). This distribution reflects where compromised devices and scanning infrastructure are located rather than the physical location of attackers. Botnets routinely draw on infected systems across multiple regions, so geographic patterns are most useful for identifying where remediation efforts may have the greatest impact rather than attributing activity to a particular actor.
For incident response and threat information sharing, however, analysis quickly shifts to the Autonomous System Number (ASN) level. Additional insights at the economy level can also be useful, particularly when working with National CERTs.
Top credentials
The passwords attackers try are almost never clever — factory defaults, short number sequences, and the username repeated as the password. Each list is ranked by the number of distinct IPs that tried it.
SSH
A total of 9,669 IPs attempted to log in over SSH during the week. Most relied on a small set of predictable usernames and passwords, suggesting the use of automated tools and shared credential lists. Table 2 shows the most frequently observed credentials.
Username | IPs | Password | IPs |
root | 5,275 | 123456 | 2,868 |
admin | 2,858 | 345gs5662d34 | 2,606 |
support | 2,645 | 3245gs5662d34 | 2,590 |
345gs5662d34 | 2,606 | support | 2,195 |
ubuntu | 2,497 | 123 | 2,162 |
user | 1,849 | 1234 | 2,096 |
test | 1,715 | password | 1,833 |
ftpuser | 1,308 | 12345678 | 1,776 |
Telnet
A total of 9,669 IPs attempted to log in over Telnet during the week. Table 3 shows the most common usernames and passwords they tried, ranked by the number of distinct IPs that used each credential.
Username | IPs | Password | IPs |
root | 14,199 | admin | 9,561 |
admin | 11,279 | (blank) | 7,845 |
user | 6,425 | 1234 | 7,011 |
support | 6,375 | Pon521 | 6,807 |
guest | 6,326 | 12345 | 6,589 |
super | 5,974 | 123456 | 6,584 |
administrator | 5,549 | password | 6,406 |
supervisor | 5,472 | Samsung | 6,328 |
One thing worth noting is that Telnet brute-force activity is very noisy. If network operators observe Telnet traffic leaving their networks, it should be a red flag. In many cases, it may indicate an infected device attempting to recruit others into a botnet.
MSSQL
A total of 3,337 IPs attempted to log in to the Microsoft SQL Server, and 3,332 used sa, the built-in administrator account. The most common password was blank, attempted by 2,953 IPs.
Other frequently used passwords included password, 12345678, 123456, abc123, 12345, admin, and 123456789. Each was tried by roughly 1,560 – 1,600 IPs. The similarity suggests the use of a shared wordlist.
Honeypot highlights
Cowrie (SSH and Telnet): Old botnets, new victims
Attackers directed our Cowrie sensors to 7,635 unique download URLs during the week, submitted by 6,493 IPs. When the sensors fetched them, 4,224 of those URLs returned a file.
Including files written directly into the session, such as the SSH key shown below, 8,797 IPs left a file on our sensors, resulting in 506 distinct files.
Table 4 shows the malware deliveries observed most widely across those attacks, ranked by the number of distinct IPs that delivered each file. The three most common deliveries were pairs of binaries from the Mozi and Mirai IoT botnet families. In each case, both files were delivered by exactly the same set of IPs, suggesting that they were downloaded together as part of a single infection routine.
Delivered by | Files (SHA-256) | Family |
3,323 IPs | 12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef and acd0712ea85c759020b448cf8344b7cee72b646cbc8e96eb53507a83463ee340 | Mozi / Mirai |
3,061 IPs | 3c060e8c70da8634814e0d4560ca150e087cdbf62bcacf83dbf48559ca08bb89 and 4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7 | Mozi / Mirai |
2,728 IPs | 94990cc87f4fc49c54cd1c0234818e5089a7b91363bb33b3eede640211e5e71d and f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8 | Mozi / Mirai |
All six files were first reported in 2020. Mozi is a particularly stubborn ghost. Its operators were reportedly arrested in 2021, and in 2023 ESET found that a kill switch had disabled the botnet.
We started seeing renewed Mozi activity earlier this year. In August and September, roughly 80% of the approximately 3,000 infected devices came from two economies in the Asia Pacific region. We are working closely with two National CERTs to address the issue.
On the SSH side, 2,621 IPs ran the same one-liner after logging in. It deletes the existing ~/.ssh folder, writes a single attacker key into authorized_keys and locks down the permissions. The key ends with the comment mdrfckr, which Kaspersky links to the Outlaw (Dota) botnet, a Perl-based cryptomining botnet that spreads through weak SSH passwords. Once the key is installed, the attacker no longer needs the password.
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr
Fingerprints: MD5 13:47:1e:8f:5a:18:fc:8e:35:0a:51:cc:7d:b4:06:61, SHA256:MkYY9qiVsFGBC5WkjoClCkwEFW5iSjcGQF7m4n4H7Cw.
If this key appears in an authorized_keys file on any of your servers, that server is compromised.
Dionaea: WannaCry is still knocking
Dionaea pretends to be a Windows and database server. Windows file sharing (SMB, port 445) attracted by far the most activity, with 13,395 IPs, ahead of MSSQL (5,113), MySQL (4,233), Windows RPC (3,251), and SIP (2,407).
SMB is not only scanned. During the week, 6,213 IPs pushed a malware sample into Dionaea, resulting in 1,078 distinct files.
Five of the six most widespread samples are components of WannaCry, the ransomware worm that emerged in May 2017 through the EternalBlue SMB exploit. All five are confirmed by VirusTotal, MalwareBazaar, and several MISP communities, and together they were delivered by at least 1,399 IPs.
Those 1,399 machines are likely unpatched Windows systems that remain infected nine years later and are still attempting to spread. They were concentrated in Asia, with India (183 IPs), Indonesia (165), Vietnam (151), China (86), and Thailand (74) leading the list.
c05e2dab77349cd639aa837e7e121710b8a0718d8fc93fb4cc6458ae90e5c597
df6d5b29a97647bca44e2306069f7675ef992f591c8c761af99bbdc17cfa7692
64bb708b31b4b043018457c1098465ea83da7d6408c7029b2f68c333fc25891c
6c8f85db6604cf701c5fbe62c872e21625a51f7edb407f813eb67918722d33b7
cf5ddb5dedea0104a3fc464c822e6181a9dd9fa6e27e713c54af0eafb7c5faf0
OpenCanary: Few attackers, endless retries
OpenCanary emulates remote-access and database services. Remote Desktop (RDP, port 3389) was the most targeted service, attracting 6,637 IPs, followed by MSSQL (3,598), VNC (3,179), SIP (1,284), and MySQL (378).
What stands out is persistence. Those 6,637 RDP attackers made 25.6 million connection attempts, almost 3,900 each in a single week. VNC was similar, with 4.2 million attempts from 3,179 IPs. These are not scanners passing by. Once they find an exposed service, they keep returning.
Webpot
As mentioned above, this is our new experimental honeypot. Webpot poses as a set of web applications and labels each request according to what it is attempting to do.
During the week, 1,723 IPs sent requests to Webpot. Table 5 shows the most common exploit and reconnaissance activity we observed, ranked by the number of distinct IPs associated with each technique. Together, the requests span almost a decade of vulnerabilities, from long-patched flaws such as PHPUnit command injection (CVE-2017-9841) to vulnerabilities disclosed as recently as 2025.
What was attempted | Year disclosed | IPs |
Cisco SD-WAN (vManage) login page probe | n/a | 376 |
SAP NetWeaver file upload (CVE-2025-31324) | 2025 | 346 |
Generic login-page credential attempts | n/a | 270 |
Default login on ‘boaform’ IoT router administration pages | n/a | 210 |
PHPUnit command injection (CVE-2017-9841) | 2017 | 183 |
PHP-CGI command injection (CVE-2024-4577) | 2024 | 174 |
FortiOS SSL-VPN overflow (CVE-2022-42475) | 2022 | 126 |
GPON router command injection (CVE-2018-10562) | 2018 | 89 |
React Server Components RCE, ‘React2Shell’ (CVE-2025-55182) | 2025 | 81 |
The 2017 PHPUnit vulnerability was the busiest by far. Its 183 IPs sent almost 21,000 requests, more than every other entry in the table combined.
Old vulnerabilities that are cheap to scan never disappear, while newer flaws such as SAP NetWeaver and React2Shell quickly join the rotation.
Fortinet: Password spraying the VPN
Our Fortinet honeypot imitates a FortiGate firewall’s SSL-VPN portal.
Of the 1,876 IPs that found it, 1,510 attempted to log in to the VPN, generating 4.4 million attempts, or about 2,900 each.
A smaller group of 237 IPs probed for the symbolic-link backdoor that Fortinet warned about in April 2025. Attackers who had already compromised a FortiGate device left a link that preserved read-only access even after the device was patched.
Probing for it suggests that someone is checking which devices still carry that backdoor.
ADBHoney
ADBHoney resembles an Android device, such as a TV box or phone, with its Android Debug Bridge (ADB, port 5555) interface exposed to the Internet.
A total of 1,841 IPs connected. Only 109 issued commands and 28 transferred files, but their behaviour is revealing.
The most common script, executed by 89 IPs, starts by checking whether a cryptominer is already present.
pm path com.ufo.miner
ps | grep com.ufo.miner
ps | grep trinity
In the sessions we followed, the bot then uploaded and launched its own mining binaries.
The most widely delivered file, observed from 18 IPs, was d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0, flagged as malicious by VirusTotal and MWDB.
Another dropper, observed from a handful of IPs, is less polite. It installs its application with every permission pre-granted, generates a fake device boot event so the application starts immediately, and then removes seven competing bot applications by name.
Exposed Android devices are valuable enough for malware operators to compete for control.
Takeaways
Nothing we observed was new, and that is the point.
Botnets from 2017 and 2020, default passwords printed on router stickers, and exploits for long-patched vulnerabilities are still enough to keep tens of thousands of machines attacking every week.
For anyone running a network:
- Turn off Telnet and change default passwords on every router, camera, and IoT device.
- Keep SMB, RDP, VNC, and database ports off the public Internet.
- Check authorized_keys files on Internet-facing Linux servers for keys you do not recognize.
- Patch VPN appliances promptly and, after patching, check for signs of an earlier compromise.
- Never leave Android Debug Bridge (port 5555) reachable from the Internet.
- If you are an APNIC Member, log in to DASH, APNIC’s network health dashboard. It draws on honeypot data such as ours to flag suspicious traffic originating from your address space, alongside routing and security alerts, and it is free for Members.
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of APNIC. Please note a Code of Conduct applies to this blog.