The Asia Pacific Network Information Centre (APNIC) has revealed early insights from its newly overhauled global honeynet infrastructure, offering a stark reminder of the persistent, automated threats facing modern network operators. Following a comprehensive architectural upgrade implemented throughout the year, the updated monitoring network recorded nearly 99,000 distinct IP addresses generating 173 million logged events over a single week in late September 2026.
APNIC’s technical team rebuilt large portions of the honeynet to broaden the spectrum of observable network activity. The overhaul included upgrading the backend data collection and processing pipeline, refreshing existing Cowrie and Dionaea sensors, and introducing OpenCanary and Webpot into the sensor array. Furthermore, the network expanded its operational footprint beyond traditional targets like SSH, Telnet, Windows environments, and web services. It now incorporates sophisticated honeypots designed to mimic a Fortinet SSL-VPN portal and an Android device with its debugging port exposed to the open internet.
Captured malware samples now flow seamlessly into a specialized Linux sandbox integrated with leading threat intelligence platforms, including MISP and Abuse.ch. This integration grants researchers deeper visibility into malicious behaviors and automated exploitation campaigns.
While researchers emphasize that it remains too early for an exhaustive longitudinal analysis, the freshly deployed network has already begun mapping intricate global attack patterns. Between September 21 and September 27, 2026, a total of 98,958 distinct IP addresses interacted with the sensors. APNIC measures attacker activity primarily by unique source IP addresses rather than raw event volume. Because a single compromised bot can generate millions of individual log entries while another system might connect only once, counting unique IPs provides a far more accurate metric for the sheer number of distinct devices reaching out to the sensors.
The Week at a Glance
An analysis of the weekly traffic distribution shows that remote administration protocols remain the primary target for automated threat actors. Nearly three-quarters of all observed attackers targeted SSH or Telnet services. The Cowrie SSH and Telnet honeypot alone captured 72,256 distinct IP addresses, representing 73 percent of all observed attacking entities and accumulating 121.1 million events.
Other sensors recorded substantial engagement across various protocols. Dionaea, which simulates Windows and database services such as SMB, MSSQL, MySQL, and SIP, attracted 21,210 unique IPs, accounting for 21 percent of the total share and nearly 12.9 million events. OpenCanary, mimicking remote access and database services like RDP and VNC, recorded 14,393 unique IPs and a staggering 34.5 million events. The data underscores the difference between breadth and persistence: while OpenCanary attracted roughly one-fifth the number of unique attackers compared to Cowrie, it logged significantly more events per attacker, averaging about 2,400 interactions compared to Cowrie’s 1,700.
Specialized honeypots also captured targeted traffic. The Fortinet SSL-VPN portal simulation attracted 1,876 unique IPs generating 4.4 million events, while ADBHoney, mimicking an exposed Android debugging port, and Webpot, which simulates various web applications, captured 1,841 and 1,723 unique IPs respectively.
Where the Attackers Came From
Geographic attribution of the attacking infrastructure reveals an almost even split between the Asia Pacific and Europe Regional Internet Registry regions, with Latin America following closely behind as a clear third. Analysts note that this geographic distribution reflects the physical locations of compromised consumer devices, enterprise servers, and scanning infrastructure rather than the ultimate geographic residence of the threat actors themselves. Modern botnets routinely commandeer infected systems distributed across multiple continents, meaning geographic clustering is primarily valuable for identifying regions where remediation efforts could yield the most significant impact.
For operational incident response and threat intelligence sharing, analysis quickly shifts from broad regional distributions to Autonomous System Numbers and specific economy-level insights, particularly when coordinating remediation with national Computer Emergency Readiness Teams.
Top Credentials and Persistent Weaknesses
An examination of the credentials utilized in automated brute-force attacks demonstrates a continued reliance on simple, predictable combinations rather than sophisticated credential-guessing techniques. Across thousands of distinct IP addresses attempting logins via SSH and Telnet, attackers heavily favored factory default combinations, sequential numbers, and usernames repeated as passwords.
For SSH login attempts, popular usernames like root, admin, and support were paired with rudimentary passwords such as simple number sequences and string repetitions. Telnet brute-force activity displayed similar characteristics, noted by researchers as exceptionally noisy behavior that should immediately alert network operators to potential local device infections and botnet recruitment. Similarly, Microsoft SQL Server attacks overwhelmingly targeted the built-in administrator account using blank passwords or common dictionary strings, reflecting the widespread deployment of automated scanning and credential-stuffing scripts.
Honeypot Highlights: Old Botnets and Persistent Vulnerabilities
Detailed analysis of the payloads captured by individual sensors highlights the remarkable longevity of certain malware families and exploitation techniques.
The Cowrie sensors directed attackers to thousands of unique download URLs, resulting in hundreds of distinct malware binaries and scripts. The most widely delivered malware files were pairs of binaries associated with the Mozi and Mirai Internet of Things botnet families. Intriguingly, all identified Mozi and Mirai binaries were originally documented as early as 2020. Despite reports of the Mozi botnet being dismantled following arrests and the activation of a kill switch, researchers have observed a distinct resurgence of Mozi activity. A vast majority of these newly infected devices were traced to specific economies within the Asia Pacific region, prompting coordinated outreach with national cybersecurity authorities.
Additionally, SSH sensors captured numerous instances of attackers deploying automated scripts designed to purge existing SSH configuration folders, inject a specific attacker-controlled public key, and lock down file permissions. This specific key, terminating with the comment "mdrfckr," has been linked by security analysts to the Outlaw botnet, a Perl-based cryptomining operation that spreads via compromised credentials, subsequently allowing attackers to maintain persistent access without relying on passwords.
Meanwhile, the Dionaea honeypot demonstrated that legacy ransomware worms continue to scan the internet aggressively. File-sharing traffic directed at SMB ports captured multiple components of the WannaCry ransomware worm, originally unleashed in May 2017 via the EternalBlue exploit. The continued presence of these payloads indicates that unpatched, vulnerable Windows systems remain active across the globe nearly a decade after the initial global outbreak.
The experimental Webpot honeypot observed reconnaissance and exploitation attempts spanning almost an entire decade of web application vulnerabilities. While newer disclosures quickly enter automated scanning rotations, long-standing vulnerabilities such as older PHPUnit command injection flaws continue to generate massive volumes of traffic due to their low scanning cost and persistent exposure across unmaintained web servers.
Similarly, traffic directed at the Fortinet SSL-VPN and Android debugging honeypots revealed aggressive credential spraying alongside probing for known backdoors and unauthorized cryptomining deployments. Exposed administrative interfaces and debugging ports continue to serve as highly lucrative targets for automated threat actors competing for control of compromised hardware.
APNIC’s ongoing observations emphasize a sobering reality for cybersecurity professionals: the vast majority of malicious internet traffic relies on foundational security oversights that have been understood for years. Outdated botnets, default administrative credentials printed on hardware stickers, and unpatched software vulnerabilities continue to sustain tens of thousands of active attacks every single week, underscoring the vital importance of basic hygiene, timely patching, and continuous network monitoring.
