JPCERT/CC Reports TSUBAME Sensor Trends and Suspected Compromised Devices in Q3 2025

Summary

JPCERT/CC’s TSUBAME sensors observed suspicious packets from networks with exposed NVR, router and SDN-controller interfaces, and compared scanning volumes and destination ports across Japan and overseas from July to September 2025.

Key points

• Some Japanese source IPs exposed multiple services, including an NVR login page, an enterprise router administration interface and an SDN controller login page.
• The exposed device interfaces used the same port numbers across different IP addresses, suggesting systems may have been deployed with identical configurations.
• JPCERT/CC considers it likely that one or more devices in the observed case were compromised, but could not identify the affected device from external observations and had not reached the operators.
• Overseas sensors received more packets than Japanese sensors; domestic packet counts peaked in July and declined, while overseas counts rose again in September after falling through August.
• Ports 22, 23, 80, 443 and 8080 appeared among the top destinations across nearly all sensors, indicating broad scanning activity targeting those protocols.
• JPCERT/CC reported no special alerts or extra issues for the quarter and said it would continue monitoring and publish updates when unusual changes occur.

Products

Countries