The APNIC Honeynet underwent significant expansion this year to capture a broader spectrum of attack activity. The infrastructure now includes upgraded data collection and processing systems, refreshed Cowrie and Dionaea sensors, and newly added OpenCanary and Webpot honeypots. Coverage has extended beyond traditional targets like SSH, Telnet, Windows and web services to encompass honeypots mimicking a Fortinet SSL-VPN portal and an exposed Android device debug interface.
Malware samples collected by the honeypots now feed into a Linux sandbox environment that integrates with threat intelligence platforms including MISP and Abuse.ch, enabling deeper visibility into observed attack patterns.
During the week of 21–27 September 2026, nearly 99,000 distinct IP addresses interacted with the honeypots, generating 173 million logged events. The analysis counts unique source IPs rather than event volume, since a single bot can produce millions of log entries while another system may connect only once. This metric better reflects how many devices actually reach the sensors.
The week at a glance
SSH and Telnet accounted for nearly three-quarters of all attack activity. The Cowrie honeypot, which emulates SSH and Telnet services, recorded 72,256 distinct attacking IPs. OpenCanary, by contrast, saw one-fifth as many attackers but logged more events per attacker—approximately 2,400 compared with 1,700—indicating more persistent probing behavior.
Where the attackers came from
By Regional Internet Registry region, attack sources split almost evenly between Asia Pacific and Europe, with Latin America ranking as a distant third. This distribution reflects the location of compromised devices and scanning infrastructure rather than the physical whereabouts of actual attackers. Botnets routinely leverage infected systems across multiple regions, making geographic patterns most useful for identifying where remediation efforts could have the greatest impact rather than attributing activity to specific threat actors.
For incident response and threat information sharing, analysis typically shifts to the Autonomous System Number level. Economy-level insights also prove valuable, particularly when coordinating with National CERTs.
Top credentials
The passwords attempted by attackers rarely show sophistication—factory defaults, short numeric sequences, and usernames repeated as passwords dominate the lists. Each ranking reflects the number of distinct IPs that tried each credential.
SSH
A total of 9,669 IPs attempted SSH login during the week. Most relied on a small set of predictable usernames and passwords, indicating reliance on automated tools and shared credential lists. The most frequently observed credentials included root with password, admin with admin, and root with 123456.
Telnet
Telnet login attempts came from 9,669 IPs during the week. The most common usernames and passwords followed similar patterns to SSH activity. Notably, Telnet brute-force activity generates substantial noise. Network operators observing Telnet traffic leaving their networks should treat it as a warning sign, as it often indicates an infected device attempting to recruit additional systems into a botnet.
MSSQL
Microsoft SQL Server login attempts came from 3,337 IPs, with 3,332 of them targeting the sa built-in administrator account. The most common password was blank, attempted by 2,953 IPs. Other frequently used passwords included password, 12345678, 123456, abc123, 12345, admin, and 123456789, each attempted by roughly 1,560–1,600 IPs. The similarity suggests attackers were using a shared wordlist.
Honeypot highlights
Cowrie (SSH and Telnet): Old botnets, new victims
Attackers directed Cowrie sensors to 7,635 unique download URLs during the week, submitted by 6,493 IPs. When the sensors fetched these URLs, 4,224 returned a file. Including files written directly into sessions, 8,797 IPs left 506 distinct files on the sensors.
The three most common malware deliveries were pairs of binaries from the Mozi and Mirai IoT botnet families. In each case, both files were delivered by exactly the same set of IPs, suggesting they were downloaded together as part of a single infection routine. All six most widely delivered samples were first reported in 2020.
Mozi represents a particularly persistent threat. Its operators were reportedly arrested in 2021, and ESET found in 2023 that a kill switch had disabled the botnet. However, renewed Mozi activity emerged earlier this year, with roughly 80% of approximately 3,000 infected devices in August and September originating from two economies in the Asia Pacific region. APNIC is working closely with two National CERTs to address the resurgence.
On the SSH side, 2,621 IPs executed the same one-liner after logging in. This command deletes the existing ~/.ssh folder, writes a single attacker key into authorized_keys, and locks down permissions. The key ends with the comment mdrfckr, which Kaspersky links to the Outlaw (Dota) botnet, a Perl-based cryptomining botnet that spreads through weak SSH passwords. Once installed, the attacker no longer needs the password.
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr
Key fingerprints: MD5 13:47:1e:8f:5a:18:fc:8e:35:0a:51:cc:7d:b4:06:61, SHA256:MkYY9qiVsFGBC5WkjoClCkwEFW5iSjcGQF7m4n4H7Cw. If this key appears in an authorized_keys file on any server, that system is compromised.
Dionaea: WannaCry is still knocking
Dionaea emulates Windows and database servers. Windows file sharing (SMB, port 445) attracted the most activity by far, with 13,395 IPs, followed by MSSQL (5,113), MySQL (4,233), Windows RPC (3,251), and SIP (2,407).
SMB activity extended beyond scanning. During the week, 6,213 IPs pushed malware samples into Dionaea, resulting in 1,078 distinct files. Five of the six most widespread samples are components of WannaCry, the ransomware worm that emerged in May 2017 through the EternalBlue SMB exploit. All five are confirmed by VirusTotal, MalwareBazaar, and several MISP communities, and together were delivered by at least 1,399 IPs.
Those 1,399 machines are likely unpatched Windows systems that remain infected nine years later and continue attempting to spread. They were concentrated in Asia, with India (183 IPs), Indonesia (165), Vietnam (151), China (86), and Thailand (74) leading the distribution.
c05e2dab77349cd639aa837e7e121710b8a0718d8fc93fb4cc6458ae90e5c597 df6d5b29a97647bca44e2306069f7675ef992f591c8c761af99bbdc17cfa7692 64bb708b31b4b043018457c1098465ea83da7d6408c7029b2f68c333fc25891c 6c8f85db6604cf701c5fbe62c872e21625a51f7edb407f813eb67918722d33b7 cf5ddb5dedea0104a3fc464c822e6181a9dd9fa6e27e713c54af0eafb7c5faf0
OpenCanary: Few attackers, endless retries
OpenCanary emulates remote-access and database services. Remote Desktop (RDP, port 3389) was the most targeted service, attracting 6,637 IPs, followed by MSSQL (3,598), VNC (3,179), SIP (1,284), and MySQL (378).
What stands out is persistence. Those 6,637 RDP attackers made 25.6 million connection attempts, averaging almost 3,900 each in a single week. VNC showed similar behavior, with 4.2 million attempts from 3,179 IPs. These are not casual scanners. Once they locate an exposed service, they continue returning.
Webpot
Webpot is a new experimental honeypot that emulates a set of web applications and categorizes each request by its intended action. During the week, 1,723 IPs sent requests to Webpot. The requests spanned almost a decade of vulnerabilities, from long-patched flaws such as PHPUnit command injection (CVE-2017-9841) to vulnerabilities disclosed as recently as 2025.
The 2017 PHPUnit vulnerability dominated activity by far. Its 183 IPs sent almost 21,000 requests, more than every other entry combined. Old vulnerabilities that are inexpensive to scan never disappear, while newer flaws such as SAP NetWeaver and React2Shell quickly join the rotation.
Fortinet: Password spraying the VPN
The Fortinet honeypot imitates a FortiGate firewall's SSL-VPN portal. Of the 1,876 IPs that found it, 1,510 attempted VPN login, generating 4.4 million attempts, or about 2,900 each.
A smaller group of 237 IPs probed for the symbolic-link backdoor that Fortinet warned about in April 2025. Attackers who had already compromised a FortiGate device could leave a link that preserved read-only access even after patching. Probing for this backdoor suggests someone is checking which devices still carry it.
ADBHoney
ADBHoney mimics an Android device, such as a TV box or phone, with its Android Debug Bridge (ADB, port 5555) interface exposed to the Internet. A total of 1,841 IPs connected. Only 109 issued commands and 28 transferred files, but their behavior is revealing.
The most common script, executed by 89 IPs, begins by checking whether a cryptominer is already present.
pm path com.ufo.miner ps | grep com.ufo.miner ps | grep trinity
In the sessions observed, the bot then uploaded and launched its own mining binaries.
The most widely delivered file, observed from 18 IPs, was d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0, flagged as malicious by VirusTotal and MWDB. Another dropper, observed from a handful of IPs, takes a more aggressive approach. It installs its application with every permission pre-granted, generates a fake device boot event to ensure the application starts immediately, and then removes seven competing bot applications by name. Exposed Android devices are valuable enough for malware operators to compete for control.
Takeaways
Nothing observed was new, and that is precisely the point. Botnets from 2017 and 2020, default passwords printed on router stickers, and exploits for long-patched vulnerabilities remain sufficient to keep tens of thousands of machines attacking every week.
- Turn off Telnet and change default passwords on every router, camera, and IoT device.
- Keep SMB, RDP, VNC, and database ports off the public Internet.
- Check authorized_keys files on Internet-facing Linux servers for keys you do not recognize.
- Patch VPN appliances promptly and, after patching, check for signs of an earlier compromise.
- Never leave Android Debug Bridge (port 5555) reachable from the Internet.
- If you are an APNIC Member, log in to DASH, APNIC's network health dashboard. It draws on honeypot data such as this to flag suspicious traffic originating from your address space, alongside routing and security alerts, and it is free for Members.