The Asia-Pacific Network Information Center (APNIC) has revealed a sweeping snapshot of modern global cyber threats following a comprehensive rebuild of its honeynet infrastructure. Designed to dramatically broaden the range of malicious internet activity captured by security researchers, the upgraded network processed an astonishing 173 million logged events generated by nearly 99,000 distinct IP addresses in a single week between September 21 and 27, 2026.
The overhaul involved significant architectural upgrades to the backend systems responsible for collecting and processing sensor data. Researchers refreshed the existing Cowrie and Dionaea sensors while introducing new tools such as OpenCanary and Webpot. Furthermore, the coverage was successfully expanded far beyond traditional targets like SSH, Telnet, Windows, and web services. The newly deployed honeypots now mimic sophisticated enterprise assets, including a Fortinet SSL-VPN portal and an Android device with an exposed debugging port.
Captured malware samples now flow directly into an integrated Linux sandbox connected to prominent threat intelligence platforms, including MISP and Abuse.ch, granting analysts deeper visibility into automated attacks. Although researchers noted it is still too early for exhaustive, long-term analysis, the preliminary data harvested during that single week underscores a sobering reality: legacy vulnerabilities, weak credentials, and decade-old botnets continue to drive the vast majority of automated global cyber attacks.
Measuring Attackers by Unique Sources
To accurately gauge the scale of the threat, APNIC measures malicious entities by unique source IP addresses rather than raw event volumes. Security experts point out that a single compromised bot can flood a sensor with millions of log entries in a short span, whereas another system might connect only once. Counting unique IP addresses provides a much clearer picture of the sheer volume of distinct devices actively scanning and probing sensors across the internet.
During the monitored week, the vast majority of attackers heavily targeted remote login protocols. The Cowrie SSH and Telnet honeypot bore the brunt of the activity, recording 72,256 distinct IP addresses—accounting for roughly 73 percent of all observed attacking IPs and logging 121.1 million individual events.
Dionaea, which simulates Windows and database services such as SMB, MSSQL, MySQL, and SIP, attracted 21,210 unique IPs and generated nearly 13 million events. Meanwhile, OpenCanary, simulating remote access tools and databases like RDP and VNC, registered 14,393 unique IPs. Interestingly, OpenCanary logged significantly more events per attacker compared to Cowrie, averaging roughly 2,400 events per source IP as automated scripts relentlessly probed exposed ports.
Other specialized honeypots also captured significant attention. The emulation of a Fortinet firewall’s SSL-VPN portal attracted 1,876 unique IPs, while the ADBHoney sensor, pretending to be an Android device with its debugging port 5555 open, recorded 1,841 unique IPs. The experimental Webpot sensor, designed to mimic various web applications, drew 1,723 distinct attacking IPs.
Geographic Distribution and Credential Brute-Forcing
An analysis of Regional Internet Registry regions revealed that attacking sources split almost evenly between the Asia-Pacific and European regions, with Latin America trailing as a clear third. Researchers emphasize that this geographic distribution largely reflects where compromised consumer devices and automated scanning infrastructure happen to be hosted, rather than the physical origins of the malicious actors pulling the strings. Because botnets routinely harness infected machines scattered globally, regional data is most valuable for helping National CERTs prioritize remediation efforts.
When analyzing the credentials attempted during brute-force campaigns, researchers found that attackers rarely rely on sophisticated tactics. Instead, automated scripts overwhelmingly depend on predictable factory defaults, short number sequences, and repeating the username as the password.
On SSH sensors, where 9,669 unique IPs attempted logins, the most frequent combinations heavily favored standard administrative accounts like "root," "admin," and "support," paired with rudimentary passwords such as "123456" and simple alphanumeric strings. Telnet activity proved even noisier and more widespread. Telnet brute-force campaigns are considered a major red flag by network operators, as high volumes of such traffic leaving a network typically indicate an infected local device attempting to draft other machines into a sprawling botnet. Microsoft SQL Server probes similarly relied on predictable vectors, with the vast majority of attacking IPs attempting access through the built-in "sa" administrator account using blank passwords or simple dictionary words.
Persistence and Reappearance of Legacy Malware
The honeypot data highlighted how older, well-documented malware families continue to thrive by exploiting unpatched systems and lax administrative hygiene. Cowrie sensors recorded thousands of unique download URLs, leading to hundreds of distinct malware files being left behind. The most widely delivered binaries belonged to the Mozi and Mirai IoT botnet families.
Intriguingly, Mozi—an infamous peer-to-peer IoT botnet whose operators were reportedly arrested in 2021 and which was allegedly neutralized by a kill switch in 2023—has shown a clear resurgence. During August and September, roughly 80 percent of approximately 3,000 infected devices tracked by APNIC originated from two specific economies in the Asia-Pacific region, prompting close collaboration with local National CERTs.
SSH sensors also detected widespread use of automated post-exploitation scripts associated with the Outlaw botnet. Thousands of IPs executed a routine that purged existing SSH configuration folders, installed a hardcoded attacker key into authorized files, and locked down permissions to secure persistent cryptomining access without requiring a password.
On the Windows front, the Dionaea honeypot demonstrated that the notorious WannaCry ransomware worm from 2017 is still actively probing the internet. Components of WannaCry, driven by the EternalBlue SMB exploit, were delivered by at least 1,399 unique IP addresses. These attacking machines are believed to be unpatched Windows systems that remain chronically infected years later, concentrated largely in developing Asian markets including India, Indonesia, Vietnam, China, and Thailand.
Meanwhile, the experimental Webpot sensor captured reconnaissance and exploit attempts spanning nearly a decade of software vulnerabilities. While newer flaws, such as the SAP NetWeaver file upload vulnerability and React remote code execution bugs disclosed in 2025, quickly joined attackers’ rotations, older issues like the 2017 PHPUnit command injection vulnerability generated massive spikes in traffic, proving that low-cost automated scanning for historic flaws never truly ceases.
Similarly, the Fortinet SSL-VPN honeypot recorded heavy password spraying alongside probes searching for a symbolic-link backdoor previously warned about by cybersecurity authorities, indicating that malicious actors are actively auditing corporate gateways for residual compromise. The ADBHoney sensor likewise captured active cryptomining operations and aggressive dropper scripts competing for control over exposed Android-based devices.
Ultimately, APNIC’s comprehensive observations underscore a persistent cybersecurity challenge. The vast majority of malicious traffic observed across the global honeynet relies on tools, vulnerabilities, and credential weaknesses that have been documented for years, proving that foundational security hygiene remains the most critical defense against relentless automated threats.
