[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader attempted multiple logins against our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a ...
show more[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader attempted multiple logins against our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match ZTE CPE.
Observed: 2026-09-30 11:53 to 2026-09-30 11:57 UTC | 7 sessions | 98 events | Telnet (port 23)
Attack chain:
1. 6 credential attempts: root/Zte521
2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal
3. Download-and-execute attempted (payload host is not routable from the internet)
Technique: CWE-78 OS command injection | Classification: IoT botnet loader, malware loader | Signatures: Mirai/IoT Botnet Busybox Probe, Download-and-Execute Payload Chain
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/119.30.119.255.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
IoT Targeted
Brute-Force
Anonymous
denied traffic to a honeypot network. destination port 23.
