JPCERT/CC Reports IoT Scanning Trends in January–March 2026
Summary
JPCERT/CC’s TSUBAME sensors observed changing IoT scanning activity: Mirai-like 23/TCP traffic from Japan declined during FY2025, while scans from other compromised devices increased. No unusual activity requiring a special alert was seen in Q1 2026.
Key points
- Mirai-like traffic made up about 70% of observed 23/TCP packets from Japan at the start of FY2025, falling to about 30% by March 2026.
- From June 2025, scans without Mirai-like characteristics increased, originating from surveillance cameras, DVRs, NAS devices and routers, with device types varying over time.
- Mirai-associated IP addresses also scanned ports beyond 23/TCP, suggesting targeting of internet-accessible services and known product vulnerabilities.
- Overseas sensors received more packets than sensors in Japan; counts dipped in February 2026 and returned to January levels in March.
- Port 23/TCP was the most frequently observed on most sensors, though some saw more traffic on 443/TCP.
- JPCERT/CC shared findings with Japanese product developers and telecom operators; it recommends current firmware, secure configuration and checking for unnecessary exposed services.
- No unusual activity requiring a special alert was observed in the January–March 2026 quarter.
Article Details
- Publisher
- JPCERT/CC
- Report Period
- 2026-01-01 to 2026-03-31; includes FY2025 observations from 2025-04-01 to 2026-03-31
- Scope
- TSUBAME sensor observations in Japan and overseas, including scanning traffic and destination-port trends.
- Sample Size
- Eight sensors in the destination-port comparison; total packet count not disclosed.
- Key Statistics
- Traffic with Mirai-like characteristics accounted for approximately 70% of observed 23/TCP packets at the start of FY2025 and around 30% by its end.
- 23/TCP was the most frequently observed destination port on the majority of the eight sensors compared.
- Overseas sensors received more packets than sensors in Japan during January–March 2026.
- Recommendations
- Keep Internet-connected devices on the latest firmware and configure them securely.
- After deployment, perform port scans or use SHODAN to check that unnecessary services are not exposed to the Internet.