Compromised DVR/NVR devices fuel Telnet scanning in Japan

JPCERT observed increased Telnet scanning from compromised DVR/NVR devices in Japan during Q4 2025, with many running outdated firmware containing known vulnerabilities.

JPCERT's TSUBAME sensor network detected a temporary spike in Telnet traffic (23/TCP) originating from Japan in October 2025, followed by a decline starting November 7. Analysis revealed that up to 80% of this traffic on certain days originated from specific groups of DVR/NVR devices. Many of these devices displayed login screens with outdated copyright notices (e.g., 2014), indicating prolonged periods without firmware updates and likely exposure to known vulnerabilities.

Comparative analysis between Japanese and overseas sensors showed that overseas sensors received higher packet volumes overall, with a gradual upward trend observed from October onward in both domestic and international networks. Cross-regional sensor comparison revealed consistent scanning activity targeting common protocols including SSH (22/TCP), Telnet (23/TCP), HTTP (80/TCP), HTTPS (443/TCP), and HTTP-alt (8080/TCP) across Japan, North America, Europe, and other regions.

The findings underscore the persistent security risk posed by legacy IoT devices, particularly DVR/NVR systems, that remain internet-accessible despite running obsolete firmware. Organizations operating similar devices should verify their exposure and implement timely firmware updates to mitigate exploitation risks.

title: Outbound Telnet Scanning Behavior from Internal Host
id: 6c3cfe08-4e78-5d89-87c9-d90dfee69c99
status: experimental
description: Detects a host initiating outbound connections on port 23/TCP to external
  addresses, consistent with compromised DVR/NVR devices performing Telnet scanning;
  investigate for high connection counts to many distinct external IPs in a short
  window (e.g. >50 destinations/hour) as the volumetric indicator of scanning rather
  than legitimate management traffic.
references:
- JPCERT TSUBAME - Compromised DVR/NVR devices fuel Telnet scanning in Japan
logsource:
  category: network_connection
  product: network
detection:
  selection:
    DestinationPort: 23
    Initiated: true
  filter_internal:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_internal
fields:
- SourceIp
- DestinationIp
- DestinationPort
falsepositives:
- Legitimate network management tools polling Telnet-enabled devices
- Authorized vulnerability scanning or asset discovery platforms
- ISP/CDN health-check probes to managed customer devices
level: medium
tags:
- attack.discovery
- attack.t1046
- attack.reconnaissance
- attack.t1595.001
author: Vorant

title: Multi-Protocol Port Scanning Pattern Across Common IoT/Management Ports
id: 68c7cacf-a759-595a-9903-38a6df71608d
status: experimental
description: Detects outbound connection attempts from a single host to a common set
  of ports (22,23,80,443,8080) associated with cross-regional scanning campaigns targeting
  SSH, Telnet, HTTP, HTTPS and HTTP-alt services; treat as scanning when the same
  source contacts many distinct external destinations across these ports within a
  short time window.
references:
- JPCERT TSUBAME - Compromised DVR/NVR devices fuel Telnet scanning in Japan
logsource:
  category: network_connection
  product: network
detection:
  selection:
    DestinationPort:
    - 22
    - 23
    - 80
    - 443
    - 8080
    Initiated: true
  filter_internal:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_internal
fields:
- SourceIp
- DestinationIp
- DestinationPort
falsepositives:
- Internal or third-party authorized scanning/asset-inventory tools
- Load balancer or CDN health checks across multiple service ports
- Security research/monitoring sensors intentionally probing common ports
level: medium
tags:
- attack.reconnaissance
- attack.t1595.001
- attack.t1046
author: Vorant

Source reporting: https://blogs.jpcert.or.jp/en/2026/05/tsubame_overflow_2025-10-12.html