TSUBAME Report Overflow (Apr-Jun 2024)

JPCERT/CC’s TSUBAME report for April–June 2024 highlights a surge in Telnet scan traffic traced to TP-LINK AX3000 routers running firmware 1.0.0, concentrated in five network ranges of a single ISP and persisting through the quarter. Overseas sensors saw higher packet volumes than those in Japan, and common targeted ports included 23/TCP, 8728/TCP, 22/TCP, 80/TCP, 8080/TCP, and ICMP. The report suggests the activity may stem from centralized deployments and stresses maintaining supported devices, timely firmware updates, and proper configuration, while noting no special alerts were issued this quarter.