SSH & Telnet brute-force trap.

Threat Intelligence Report: November 2025

Executive Summary

Put on your tin foil hat, dear defenders, because November 2025 was filled with the usual digital skullduggery. Our Sydney-based SSH and Telnet honeypots captured a delightful assortment of brute force shenanigans targeting SSH ports. The culprits? A mix of your usual script kiddies, compromised clouds, and those carnivorous IoT botnets that just won’t leave us alone. As always, our mission remains: outwit, outplay, outlast these digital ne'er-do-wells.

Key Stats

• Timeframe: November 2025
• Sensor: SSH & Telnet honeypots (T-Pot Sydney)
• Event Volume: Thousands of brute force attempts recorded
• Noteworthy ASNs:
  • Telstra Limited (AU)
  • LG DACOM Corporation (KR)
  • PT Cloud Hosting Indonesia (ID)
  • DigitalOcean (NL/US)
  • Amazon AWS (US)
• Activity Highlights: Mirai-style botnet behavior detected, with substantial brute force attempts congregating around known weak credentials.

Campaign Narrative

Ah, November—a month where the world anticipates holidays, and botnets anticipate your unpatched SSH services. The digital miscreants were at it again, hammering IPs from dawn till far past dusk. Leading the digital charge, Korean IPs from LG DACOM, enthusiastically scanning and brute-forcing their way through networks. Meanwhile, the keen folks at PT Cloud Hosting Indonesia might as well have been running a Mirai club, with attacks leveraging default credential lists like they were going out of style.

Infrastructure Details

Our overachieving attackers tapped into several ASNs with some clouds looking surprisingly cozy with the bad guys. DigitalOcean and Amazon AWS have their fair share of potential C2 servers—though some might be nosy researchers or sloppy testers who couldn't read a service agreement. PT Cloud Hosting Indonesia is the usual haunt for IoT botnet chaos. Bulletproof hosts, beware—your reputation is showing.

Malware and Behaviour

The smell of Mirai is strong here. Most attempts involved brute force attacks using common creds like 'root' and 'admin'. What else is new? The diversity of IPs used and the sheer volume of attempts suggest an extensive botnet, possibly compromised devices globally. They hit hard, they hit fast, and if your SSH service was listening, they knocked on your door.

Detection and Mitigation

• SSH Vigilance: Monitor those login attempts. If you see those suspicious IPs, put the kibosh on them with firewall rules.
• Password Policy: If "12345" is your password, we need to talk. Strong, unique passwords are not optional.
• Network Segmentation: Keep IoT devices in their corner of the network—don’t let your smart fridge ruin your day.
• Threat Intel Feeds: Keep an eye on OTX, URLhaus, or whatever floats your cybersecurity boat to keep updated on shady characters.
• Scan Differentiation: Be smart about distinguishing between valid researchers and threat actors. Benign scanners should live to scan another day.

Closing Thoughts

Another month, another parade of brute forces, as we maintain the endless game of digital whack-a-mole. Some of the cloud folks need to either tighten their operations or enjoy a smugglers' den reputation. Arm yourself with strong creds, good segmentation, and lots of coffee. Here’s to another month in the trenches, because these bots aren't putting themselves to sleep anytime soon. Cheers!