April 2026 Threat Landscape: Go Eats libssh, Mirai Refuses to Die, and Half a Million RDP Probes From One Polish Reseller
Analysis of 3.4M+ attacks captured across 18 protocols by the threat.gg honeypot network during April 2026: a single-day 884K telnet spike still riding 2016-era Mirai credentials, a coordinated 606K-attempt RDP campaign from three sequential Cogent IPs, and the rise of Go-based scanners overtaking libssh as the dominant SSH attack tooling.
threat-intelligence analysis telnet rdp mirai elasticsearch go-scanners