JPCERT/CC Reports Increased Scanning and Telnet Traffic from DVR/NVR Devices
Summary
JPCERT/CC’s TSUBAME sensors observed a temporary October spike in Japanese hosts sending Telnet traffic, much of it from DVR/NVR devices, and a gradual rise in packet volumes across domestic and overseas sensors.
Key points
- Japanese hosts sending traffic to Telnet (23/TCP) spiked temporarily in October, then declined from around November 7.
- On some days, groups of DVR/NVR devices accounted for roughly 80% of the observed Telnet traffic.
- Outdated copyright dates on some device interfaces suggest firmware may be old; JPCERT/CC advises users to check devices and apply firmware updates.
- Overseas sensors received more packets on average than sensors in Japan, while packet volumes gradually increased from October across both.
- Commonly observed destination ports across sensor regions included 22, 23, 80, 443, and 8080/TCP, indicating broad scanning activity.
Article Details
- Publisher
- JPCERT/CC
- Report Period
- 2025-10 to 2025-12
- Scope
- Monitoring trends from domestic and overseas TSUBAME sensors, including Telnet traffic from hosts in Japan and packet activity by destination port.
- Sample Size
- Eight sensors compared in Table 1: two each in Japan, North America, Europe, and other regions.
- Key Statistics
- DVR/NVR devices accounted for roughly 80% of source hosts on some days.
- The number of hosts in Japan sending traffic to 23/TCP temporarily spiked in October and began trending downward around November 7.
- Overseas sensors received more packets than sensors in Japan.
- Recommendations
- Check whether similar DVR/NVR devices are in the described condition and ensure their firmware updates are applied.
- Pay attention to scanning activity.