# T-Pot Honeypot Weekly Threat Intelligence Summary: 2026-10-12 to 2026-10-19

**Reporting Window:** 2026-10-12 to 2026-10-19  
**Deployment:** T-Pot Distributed Sensor Network  
**Target Focus:** RDP (3389), SSH/Telnet (22/23), Ingress Malware Droppers  
**Generated At:** 2026-10-19 00:00:01 UTC  

---

## 1. Weekly Executive Summary

Over the 7-day monitoring window from **2026-10-12 to 2026-10-19**, the sensor array recorded substantial automated reconnaissance and intrusion traffic.

* **RDP Attack Volume**: Over **179,617** connection attempts detected across **316** unique source IPs.
* **SSH & Telnet Probes**: **162,140** events processed across **862** distinct attacking hosts.
* **Captured Payloads**: **274** automated ingress tool transfer(s) captured by honeypot emulators.

---

## 2. Top Remote Desktop (RDP) Threat Actors

Automated scanners continue aggressive password spraying against exposed RDP endpoints. The top attacking hosts identified during this period:

| Source IP | Country | Autonomous System (ASN) | Attempt Count | Target Profile |
| :--- | :--- | :--- | :--- | :--- |
| `109.205.211.4` | PL | AS201814 MEVSPACE sp. z o.o. | **33,955** | Automated RDP NLA Spray |
| `13.140.32.153` | US | AS40021 Contabo Inc. | **21,755** | Automated RDP NLA Spray |
| `5.189.128.62` | FR | AS51167 Contabo GmbH | **15,423** | Automated RDP NLA Spray |
| `45.88.138.51` | BG | AS213737 AYOSOFT LTD | **10,887** | Automated RDP NLA Spray |
| `77.91.71.43` | NL | AS211486 Alferov Aleksey Aleksandrovich | **10,717** | Automated RDP NLA Spray |

### Targeted RDP Accounts
The most frequently targeted account names across incoming RDP sessions:
* **`Administrator`**: 28,477 attempts
* **`Admin`**: 3,300 attempts
* **`admin`**: 1,559 attempts
* **`test`**: 1,506 attempts
* **`manager`**: 1,089 attempts
* **`administrator`**: 423 attempts

---

## 3. SSH & Telnet Exploitation Telemetry

### Top Attacking IPs
| Source IP | Country | Autonomous System (ASN) | Attempt Count |
| :--- | :--- | :--- | :--- |
| `89.251.0.193` | CA | AS41564 Orion Network Limited | **34,981** |
| `143.198.135.111` | US | AS14061 DigitalOcean, LLC | **7,650** |
| `77.239.124.202` | NL | AS198364 BANATSYNC SRL | **7,318** |
| `77.239.124.66` | NL | AS198364 BANATSYNC SRL | **7,313** |
| `64.227.159.78` | IN | AS14061 DigitalOcean, LLC | **5,470** |

### Targeted SSH/Telnet Credentials
Common authentication pairs observed:
* **`root`**: 2,952 login attempts
* **`system`**: 998 login attempts
* **`enable`**: 995 login attempts
* **`admin`**: 507 login attempts
* **`ubuntu`**: 247 login attempts
* **`345gs5662d34`**: 180 login attempts

---

## 4. Captured Ingress Malware & Payloads

The honeypot captured 274 malicious staging script(s) dropped via shell access during this window:

* **SHA-256**: `a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2`
  * **Source IP**: `121.242.232.147`
  * **Download URL**: `None`
  * **Timestamp**: `2026-10-13T04:31:40.771321+00:00`

* **SHA-256**: `a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2`
  * **Source IP**: `62.10.174.7`
  * **Download URL**: `None`
  * **Timestamp**: `2026-10-13T04:33:29.265298+00:00`

* **SHA-256**: `a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2`
  * **Source IP**: `35.234.136.205`
  * **Download URL**: `None`
  * **Timestamp**: `2026-10-13T04:33:30.926728+00:00`


---

## 5. Defensive Mitigations & IoCs

1. **Firewall Blocking**: Block all incoming traffic from the top offending autonomous systems and subnets identified above.
2. **Eliminate Public RDP Exposure**: Place RDP access strictly behind an authenticated VPN or Cloudflare Zero Trust / WireGuard gateway.
3. **Disable Telnet & Default Accounts**: Ensure port 23 is closed at perimeter firewalls and disable default accounts (`root`, `admin`, `guest`).