Telnet Is Still Open: Why the IoT Botnet Notices Keep Describing the Same Reachable Population

When a national CERT publishes a notice about active botnet families, the intrusion methods listed are usually unremarkable. The August 2026 notice from China's National Network and Information Security Notification Centre named five cross-border families — Mirai, CondiBot, Gafgyt, TBot and SoftBot — and described initial access through Telnet and SSH brute force against unchanged factory credentials, plus exploitation of vulnerabilities disclosed years earlier.

The interesting question is not what the malware does. It is why the same entry path remains available in 2026.

The exposure that makes brute force viable

Brute force against default credentials only works if two conditions hold: the service is reachable, and the credential has not been changed. Internet measurement speaks directly to the first condition.

ZoomEye indexes internet-reachable services, including Telnet on port 23 and SSH on port 22. A query for hosts exposing Telnet returns a population that is, by definition, reachable from the open internet. That population is the pool from which IoT botnets recruit.

The measurement has to be read carefully, because the raw count of reachable Telnet services overstates the number of vulnerable devices.

Not every open Telnet service is a device with a default password. Some are honeypots, deliberately deployed to observe scanning activity. Some are network equipment with Telnet enabled but credentials already changed. Some are embedded systems in labs or test environments.

Geographic distribution reflects hosting, not deployment. A large share of reachable Telnet endpoints sit in cloud and hosting networks rather than in the consumer or branch networks where IoT devices actually live. A country-level count therefore says more about where hosting providers are located than about where cameras are installed.

The fingerprint is weak. Telnet banners are often minimal or absent, so a query for port 23 reachability identifies the service but not the device model. Distinguishing a camera from a router from an industrial gateway requires additional signals, which not every device provides.

What the measurement does establish is that the entry path is not closed. Devices continue to expose the service that botnets use to reach them.

Why the population is stable rather than shrinking

The 2026 notices describe the same methods as the 2016 Mirai release. That continuity is not a failure of detection. It reflects three structural conditions.

Devices outlive their support. A camera installed in 2021 may still be functioning in 2026 with firmware that has not been updated since installation. If the vendor stopped issuing updates after a short window, no patch exists to apply.

Ownership is unclear. The person who installed the device is often not the person responsible for maintaining it. In small organisations, the device may not appear in any asset register, so no one receives the vendor's advisory or acts on it.

Remote management is convenient. Telnet and unauthenticated HTTP interfaces are frequently enabled to make initial setup easy, and they are rarely disabled afterwards. Where the device is reachable from the internet, the convenience becomes the exposure.

Newer botnet families have changed what they do after infection — the Dysphoria botnet, flagged in a July 2026 CNCERT and QiAnXin notice, uses blockchain naming services to make its control infrastructure harder to take down — but the entry path has not changed, because the entry path still works.

Reducing the reachable population

The measurement is useful because it can be repeated. An organisation that wants to know whether its own devices are exposed can query for its own network ranges and see what is visible from outside.

That check is worth running for three reasons.

It finds devices you forgot. A query against your own address space often surfaces management interfaces that no one remembered were exposed, including devices installed by contractors or inherited through acquisition.

It confirms that a remediation worked. After disabling Telnet or moving a management interface behind a firewall, re-running the same query shows whether the change took effect from the outside. A configuration change that was applied but not verified is not the same as a closed port.

It produces a list to act on. The output is a set of specific addresses with the service and banner observed, which is directly actionable: change the credential, disable the service, restrict the source, or replace the device.

The part that measurement cannot fix

External observation tells you a device is reachable. It does not tell you whether the credential has been changed, whether the firmware is current, or whether the device is still supported by its vendor.

Those questions require an internal answer. The most useful thing a measurement programme does is force them to be asked, by producing a concrete list of devices that are visible from outside and therefore must be accounted for.

For the population described in the 2026 botnet notices, the fix is not a new detection signature. It is knowing which devices are exposed, whether they are still maintained, and who is responsible for them. Measurement answers the first question and makes the other two impossible to defer.

References

• National Network and Information Security Notification Centre notice on cross-border botnet families, August 2026.
• CNCERT and QiAnXin joint risk notice on the Dysphoria botnet, July 2026.
• ZoomEye cyberspace search engine documentation for service and port queries.