JPCERT flags vulnerable DVR/NVR scanning traffic
JPCERT's TSUBAME sensors observed Telnet scanning traffic largely originating from outdated, unpatched DVR/NVR devices in Q4 2025.
Sourceblogs.jpcert.or.jp — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
JPCERT/CC's TSUBAME Report Overflow for October-December 2025 examines monitoring trends from its global sensor network, focusing on Telnet (23/TCP) traffic originating from Japan. Analysts observed a spike in October followed by a decline from early November, but noted that a large share of this traffic—up to 80% on some days—came from specific groups of DVR/NVR devices. Login banners on these devices showed outdated copyright dates (e.g., 2014), indicating long-neglected firmware that likely contains known, exploitable vulnerabilities.
The report also compared packet volumes between domestic and overseas sensors, finding overseas sensors consistently receive more traffic, with a gradual upward trend in both regions from October onward. Common destination ports (22, 23, 80, 443, 8080/TCP) were observed across nearly all sensors regardless of region, indicating widespread, non-targeted scanning activity against these standard service ports.
No specific alerts or novel threats were issued this quarter; the report is primarily informational, reinforcing the value of distributed monitoring and urging owners of DVR/NVR devices to verify firmware update status given the persistence of internet-facing, outdated devices.
Detection guidance
Telnet Connection Attempts to Standard Service Ports
A behavioural hunt for the technique in general.
Detects Telnet (23/TCP) connections to multiple standard service ports (22, 80, 443, 8080) indicative of active scanning for vulnerable services. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Telnet Connection Attempts to Standard Service Ports
description: Detects Telnet protocol connections to common service ports (SSH, HTTP,
HTTPS, alternate HTTP) which is characteristic of non-targeted active scanning for
vulnerable network appliances.
tags:
- attack.reconnaissance
- attack.t1595
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort:
- 22
- 80
- 443
- 8080
Protocol: tcp
telnet_source:
SourcePort: 23
condition: selection and telnet_source
falsepositives:
- Legitimate network monitoring tools initiating service discovery
- Authorized penetration testing or vulnerability assessment traffic
level: medium
id: 06b1850f-35c8-5f81-b2c4-84e16dc00a5a
status: experimental
author: Vorant
DVR/NVR Device Outbound Scanning Activity
A behavioural hunt for the technique in general.
Identifies outbound network connections from devices with outdated firmware signatures or known DVR/NVR user-agent patterns initiating connections to multiple destination ports. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DVR/NVR Device Outbound Scanning Activity
description: Detects outbound scanning-like connection patterns from network appliances
(DVR/NVR devices) characterized by connections to multiple standard service ports
from a single source, typical of compromised or misconfigured devices performing
active reconnaissance.
tags:
- attack.reconnaissance
- attack.t1595
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort:
- 22
- 23
- 80
- 443
- 8080
outbound:
Initiated: true
filter_internal_dest:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and outbound and not filter_internal_dest
falsepositives:
- Legitimate firmware update checks from networked devices
- Network health monitoring by device management platforms
level: low
id: a0c9c854-6f06-5df5-9c2c-25cd975e10dd
status: experimental
author: Vorant
Multiple Telnet Authentication Attempts from Single Source
A behavioural hunt for the technique in general.
Detects multiple Telnet login attempts (23/TCP) from a single source IP across a short timeframe, indicating potential credential guessing against Telnet-accessible devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Multiple Telnet Authentication Attempts from Single Source
description: Identifies repeated Telnet connection attempts on port 23/TCP from a
single source within a short window, consistent with credential guessing or brute-force
activity against Telnet-accessible network devices such as DVR/NVR appliances.
tags:
- attack.credential-access
- attack.t1078
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 23
Protocol: tcp
condition: selection
falsepositives:
- Network administrators troubleshooting device connectivity via Telnet
- Automated device provisioning or configuration management systems
level: medium
id: 7e8dd255-2420-5e9b-85b6-1c53e2f39761
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://blogs.jpcert.or.jp/en/2026/05/tsubame_overflow_2025-10-12.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs