TSUBAME Report Overflow (Jan-Mar 2026)
This TSUBAME Report Overflow series discusses observation trends from TSUBAME sensors both in Japan and overseas, as well as other topics not covered in the Internet Threat Monitoring Quarterly Report. This article covers monitoring results from January to March 2026.
Observation Trends Related to Japan in FY2025 (April 2025–March 2026)
JPCERT/CC analyzes data collected daily through TSUBAME. In this article, we review incidents and observation trends related to Japan based on data observed during FY2025. As noted in the Internet Threat Monitoring Report, the packets most frequently observed by TSUBAME are scans targeting 23/TCP. Some of the packets observed on 23/TCP exhibit characteristics associated with Mirai. Figure 1 shows the proportion of traffic with Mirai-like characteristics. At the beginning of FY2025, traffic associated with Mirai accounted for approximately 70% of the observed packets. However, changes began to emerge around June 2025, and by the end of the fiscal year, the proportion had declined to around 30%. Although the packets observed from around June 2025 onward did not exhibit Mirai-like characteristics, they were also generated by compromised devices. In addition to differences in packet characteristics, the targeted IoT devices also differed from those targeted by Mirai.
|
| Figure 1: Trend in the number of source hosts in Japan sending packets to 23/TCP |
Figure 1: Trend in the number of Mirai-like sources observed on 23/TCP from Japan
The following device types were notably observed among devices originating from Japan between June 2025 and the end of March 2026: From June to July 2025: An increase in sources without Mirai-like characteristics was observed from devices such as surveillance cameras, DVRs, and NAS devices manufactured by overseas vendors. From mid to late July 2025: In addition to the DVRs and NAS devices mentioned above, increases were also observed from devices such as broadband routers manufactured by Japanese vendors. From September to mid-October 2025: Sources without Mirai-like characteristics increased primarily from Korean-made DVR products and Chinese-made routers. From October 2025 to the end of March 2026: Such sources increased almost exclusively from overseas DVR products.
IP addresses associated with Mirai-like scanning activity were also observed communicating over ports other than 23/TCP. This suggests that the scans were targeting Internet-accessible services and known vulnerabilities associated with specific products.
Based on insights gained from these observations, JPCERT/CC shared information on Mirai-related attack trends with domestic product developers and telecommunications operators, while also discussing possible countermeasures with them. When connecting devices such as routers to the Internet, it is essential to take appropriate precautions to prevent them from becoming infected with Mirai and contributing to the growth of botnets. Users should be aware that Internet-connected devices may be accessible to attackers and ensure that they are running the latest firmware and configured securely. After deployment, we also recommend performing port scans or using services such as SHODAN to verify that unnecessary services are not exposed to the Internet.
JPCERT/CC expects continued attacks targeting specific products, as well as the emergence of suspicious packet sources. We will therefore continue to investigate IP addresses originating from Japan and share observation data and analysis results with product developers and telecommunications operators to support mitigation efforts.
Comparison of the observation trends in Japan and overseas
Figure 2 shows a monthly comparison of the average number of packets received in Japan and overseas. Overseas sensors received more packets than domestic sensors. A temporary decrease was observed in February across both domestic and overseas sensors, but observation counts in March returned to levels comparable to those seen in January.
|
| Figure 2: Monthly comparison of the average number of packets received in Japan and overseas |
Comparison of monitoring trends by sensor
Each sensor is assigned a unique global IP address. To examine differences in observation trends among sensors in Japan, North America, Europe, and other regions, Table 1 summarizes the top 10 destination ports observed by each sensor. 23/TCP was the most frequently observed port on the majority of sensors, although some sensors observed higher traffic on 443/TCP. This suggests that scanning activity targeting these ports is being conducted across a wide range of networks.
Table 1: Comparison of top 10 packets by domestic and overseas sensors
| Japan #1 | Japan #2 | North America #1 | North America #2 | Europe #1 | Europe #2 | Other regions #1 | Other regions #2 | |
|---|---|---|---|---|---|---|---|---|
| #1 | 23/TCP | 23/TCP | 443/TCP | 23/TCP | 23/TCP | 23/TCP | ICMP | 22/TCP |
| #2 | 22/TCP | ICMP | 23/TCP | 80/TCP | 443/TCP | 443/TCP | 23/TCP | 443/TCP |
| #3 | 80/TCP | 22/TCP | 80/TCP | 443/TCP | 8728/TCP | 22/TCP | 443/TCP | 23/TCP |
| #4 | 443/TCP | 80/TCP | ICMP | 8080/TCP | ICMP | 80/TCP | 80/TCP | 8728/TCP |
| #5 | ICMP | 443/TCP | 22/TCP | ICMP | 22/TCP | ICMP | 8728/TCP | 80/TCP |
| #6 | 8080/TCP | 8080/TCP | 8728/TCP | 22/TCP | 80/TCP | 25/TCP | 22/TCP | ICMP |
| #7 | 3389/TCP | 3389/TCP | 8080/TCP | 8443/TCP | 8080/TCP | 3389/TCP | 8080/TCP | 445/TCP |
| #8 | 8728/TCP | 8728/TCP | 3389/TCP | 8728/TCP | 3389/TCP | 8080/TCP | 3389/TCP | 8080/TCP |
| #9 | 5555/TCP | 5555/TCP | 8443/TCP | 445/TCP | 8443/TCP | 8728/TCP | 8443/TCP | 3389/TCP |
| #10 | 2222/TCP | 2222/TCP | 3000/TCP | 3389/TCP | 3000/TCP | 445/TCP | 3000/TCP | 3000/TCP |
In closing
Monitoring at multiple locations enables us to identify whether certain changes are occurring only within specific networks. Although no unusual activity requiring an extra issue or special alert was observed this quarter, it remains important to continue monitoring scanning activity closely. We will continue to publish quarterly blog articles on Internet threat monitoring trends and provide additional reports when significant changes are observed. We welcome your feedback on this series. Please use the comment form below to let us know which topics you would like us to cover in future articles. Thank you for reading.
Keisuke Shikano
(Translated by Takumi Nakano)
