# T-Pot Honeypot Weekly Threat Intelligence Summary: 2026-10-19 to 2026-10-26

**Reporting Window:** 2026-10-19 to 2026-10-26  
**Deployment:** T-Pot Distributed Sensor Network  
**Target Focus:** RDP (3389), SSH/Telnet (22/23), Ingress Malware Droppers  
**Generated At:** 2026-10-26 00:00:01 UTC  

---

## 1. Weekly Executive Summary

Over the 7-day monitoring window from **2026-10-19 to 2026-10-26**, the sensor array recorded substantial automated reconnaissance and intrusion traffic.

* **RDP Attack Volume**: Over **327,196** connection attempts detected across **412** unique source IPs.
* **SSH & Telnet Probes**: **196,661** events processed across **1,009** distinct attacking hosts.
* **Captured Payloads**: **475** automated ingress tool transfer(s) captured by honeypot emulators.

---

## 2. Top Remote Desktop (RDP) Threat Actors

Automated scanners continue aggressive password spraying against exposed RDP endpoints. The top attacking hosts identified during this period:

| Source IP | Country | Autonomous System (ASN) | Attempt Count | Target Profile |
| :--- | :--- | :--- | :--- | :--- |
| `45.88.138.51` | BG | AS213737 AYOSOFT LTD | **93,978** | Automated RDP NLA Spray |
| `13.140.32.153` | US | AS40021 Contabo Inc. | **22,971** | Automated RDP NLA Spray |
| `145.223.7.39` | US | AS209854 Cyberzone S.A. | **13,598** | Automated RDP NLA Spray |
| `85.11.190.10` | NL | AS209101 IP Vendetta Inc. | **12,587** | Automated RDP NLA Spray |
| `121.156.19.13` | KR | AS4766 Korea Telecom | **12,331** | Automated RDP NLA Spray |

### Targeted RDP Accounts
The most frequently targeted account names across incoming RDP sessions:
* **`Administrator`**: 24,285 attempts
* **`Admin`**: 9,830 attempts
* **`admin`**: 2,078 attempts
* **`administrator`**: 1,418 attempts
* **`manager`**: 1,301 attempts
* **`adama`**: 349 attempts

---

## 3. SSH & Telnet Exploitation Telemetry

### Top Attacking IPs
| Source IP | Country | Autonomous System (ASN) | Attempt Count |
| :--- | :--- | :--- | :--- |
| `144.172.116.247` | US | AS14956 RouterHosting LLC | **14,406** |
| `39.125.93.26` | KR | AS9318 SK Broadband Co Ltd | **10,115** |
| `160.119.66.206` | NL | AS49870 Alsycon B.V. | **8,790** |
| `77.239.124.77` | NL | AS198364 BANATSYNC SRL | **7,313** |
| `77.239.124.39` | NL | AS198364 BANATSYNC SRL | **7,303** |

### Targeted SSH/Telnet Credentials
Common authentication pairs observed:
* **`root`**: 9,445 login attempts
* **`admin`**: 1,927 login attempts
* **`ubuntu`**: 1,153 login attempts
* **`system`**: 990 login attempts
* **`enable`**: 976 login attempts
* **`centos`**: 798 login attempts

---

## 4. Captured Ingress Malware & Payloads

The honeypot captured 475 malicious staging script(s) dropped via shell access during this window:

* **SHA-256**: `0db4656687a425c47d19000db866db52c7e415dbfaf6b5c651adcb9275ab23ca`
  * **Source IP**: `130.12.180.51`
  * **Download URL**: `None`
  * **Timestamp**: `2026-10-19T00:18:12.008589+00:00`

* **SHA-256**: `ae8d459595257f2f22c9d1ff74c4fb8a91643fad7899b57556496716692b904e`
  * **Source IP**: `130.12.180.51`
  * **Download URL**: `None`
  * **Timestamp**: `2026-10-19T00:18:12.008931+00:00`

* **SHA-256**: `ae8d459595257f2f22c9d1ff74c4fb8a91643fad7899b57556496716692b904e`
  * **Source IP**: `130.12.180.51`
  * **Download URL**: `None`
  * **Timestamp**: `2026-10-19T00:42:20.031130+00:00`


---

## 5. Defensive Mitigations & IoCs

1. **Firewall Blocking**: Block all incoming traffic from the top offending autonomous systems and subnets identified above.
2. **Eliminate Public RDP Exposure**: Place RDP access strictly behind an authenticated VPN or Cloudflare Zero Trust / WireGuard gateway.
3. **Disable Telnet & Default Accounts**: Ensure port 23 is closed at perimeter firewalls and disable default accounts (`root`, `admin`, `guest`).