JPCERT TSUBAME Q4 2025 Internet Observatory Report
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
JPCERT's Q4 2025 Internet monitoring reveals outdated DVR/NVR devices sending suspicious traffic and widespread network scanning activity.
JPCERT/CC's TSUBAME (Internet Fixed-Point Observation System) published its Q4 2025 (October–December) observation report. The primary findings show a significant volume of suspicious outbound traffic originating from specific DVR/NVR product families deployed within Japan's address space, particularly Telnet (23/TCP) connections. Analysis indicates these devices carry copyright dates as old as 2014, suggesting they have not received firmware updates in years and remain vulnerable to known exploits. Globally, JPCERT's sensors across Japan, North America, Europe and other regions detected consistent scanning activity targeting common service ports (22/TCP, 23/TCP, 80/TCP, 443/TCP, 8080/TCP), indicating widespread network reconnaissance by multiple threat sources. Packet volume increased each month from October through December 2025, with overseas sensors recording higher traffic than domestic ones. The report emphasizes that unpatched and legacy DVR/NVR equipment represents an active attack surface accessible from the internet, and recommends that organizations verify their device inventory, check firmware currency, and apply available updates.
Detection guidance
Port Scanner Tool Targeting Telnet and Common Service Ports on Windows
Detects nmap, masscan or zmap on Windows run with a port list that includes Telnet (23), the kind of IoT/DVR reconnaissance seen in TSUBAME observations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Port Scanner Tool Targeting Telnet and Common Service Ports on Windows
description: Detects execution of network scanners (nmap, masscan, zmap) on Windows
with an explicit port list that includes 23/TCP, or with a full or top-ports sweep.
Matches the reconnaissance pattern against Telnet/SSH/HTTP(S) services described
in the TSUBAME report.
tags:
- attack.discovery
- attack.t1046
- attack.reconnaissance
- attack.t1595.002
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \nmap.exe
- \masscan.exe
- \zmap.exe
selection_ports:
CommandLine|re: (-p\s*|--ports?[ =])\S*\b23\b
selection_sweep:
CommandLine|contains:
- --top-ports
- ' -p-'
condition: selection_img and (selection_ports or selection_sweep)
falsepositives:
- Authorised vulnerability assessment or asset discovery run by the security or network
team
- Network administrators auditing their own device inventory for open Telnet
level: medium
id: 08407bfd-6980-5076-98f2-c6c49ea2d390
status: experimental
author: Vorant
references:
- https://blogs.jpcert.or.jp/ja/2026/05/tsubame-overflow20251012.html
Port Scanner Tool Targeting Telnet and Common Service Ports on Linux
Detects masscan, zmap or nmap on Linux scanning a port list that includes Telnet (23/TCP), consistent with the mass scanning of exposed DVR/NVR and IoT devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Port Scanner Tool Targeting Telnet and Common Service Ports on Linux
description: Detects execution of masscan, zmap or nmap on Linux hosts with a port
list containing 23/TCP, or a full or top-ports sweep. Matches the mass scanning
of common service ports (22, 23, 80, 443, 8080) described in the TSUBAME report.
tags:
- attack.reconnaissance
- attack.t1595.002
- attack.discovery
- attack.t1046
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith:
- /nmap
- /masscan
- /zmap
selection_ports:
CommandLine|re: (-p\s*|--ports?[ =])\S*\b23\b
selection_sweep:
CommandLine|contains:
- --top-ports
- ' -p-'
condition: selection_img and (selection_ports or selection_sweep)
falsepositives:
- Authorised vulnerability scanning from a security jump host
- Network monitoring scripts that periodically probe known device ranges
level: medium
id: ca87d3e1-8900-5d5a-94b1-a5353ef65dcf
status: experimental
author: Vorant
references:
- https://blogs.jpcert.or.jp/ja/2026/05/tsubame-overflow20251012.html
Outbound Telnet Connection to Public IP by Non-Telnet Client Process
Detects a Windows host making outbound TCP/23 connections to public addresses from a process that is not a known Telnet client, indicating possible scanning or IoT brute-force tooling. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound Telnet Connection to Public IP by Non-Telnet Client Process
description: Detects outbound connections to port 23/TCP on non-private addresses
from processes other than the built-in telnet client. Compromised DVR/NVR and IoT-style
scanners generate large volumes of outbound Telnet; this rule is meant to be investigated
with volume context over time.
tags:
- attack.discovery
- attack.t1046
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 23
filter_telnet_client:
Image|endswith: \telnet.exe
filter_private:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
condition: selection and not filter_telnet_client and not filter_private
falsepositives:
- Terminal emulators such as PuTTY or SecureCRT used by network engineers to reach
internet-facing legacy devices
- Authorised external attack-surface scanning from a Windows host
level: low
id: 08aa9206-f2ff-50a9-abed-272d74553bdf
status: experimental
author: Vorant
references:
- https://blogs.jpcert.or.jp/ja/2026/05/tsubame-overflow20251012.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://blogs.jpcert.or.jp/ja/2026/05/tsubame-overflow20251012.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs