OT honeypot telemetry shows March 2026 as the key attack spike

At a glance

What this is: TXOne Networks’ honeypot analysis says March 2026 was the clearest attack anomaly in H1, driven by broad payload diversity, CVE exploitation and OT protocol scanning.

Why it matters: OT and identity teams need to treat legacy SMB, default credentials and exposed industrial protocols as active governance risks, because attackers are combining automation, cloud staging and application-aware credential targeting.

By the numbers:

• Over 91% of malware downloads were delivered over SMB 445/TCP.
• 97% of sessions from the 99 highest-volume attacker IPs were traced to cloud and VPS hosting providers.
• March 2026 produced 46.55M unique attack payloads, the highest monthly total in the report.

Context

OT honeypot telemetry is a view into how attackers probe exposed industrial environments, not a measure of actual production compromise. In this report, the security gap is not a single zero-day but the continued operational value of legacy SMB, default credentials, and widely scanned industrial protocols.

For identity and access teams, the important signal is that attack traffic now blends infrastructure scale with access logic. Cloud-hosted scanning, credential stuffing and protocol-aware targeting all intersect with machine identity, service access and authentication boundaries inside OT and adjacent systems.

The report is primarily about a broad attack pattern across industrial and internet-facing services, not a single incident. That makes it useful for governance planning because it shows which control assumptions are still being tested at scale rather than which one breach happened to succeed.

Key questions

Q: What breaks when legacy SMB stays exposed in OT and adjacent networks?

A: Legacy SMB exposure keeps old exploitation paths, malware delivery and credential abuse open long after organisations think the original risk has passed. The control failure is usually not a missing patch alone, but a lack of ownership over service retirement, segmentation and protocol minimisation. In practice, exposed SMB becomes a standing ingress path for opportunistic actors.

Q: Why does cloud-hosted attacker infrastructure matter for defenders?

A: Because it changes the economics of detection and blocking. Disposable cloud and VPS ranges let attackers rotate sources quickly, which weakens controls that depend on stable source attribution but strengthens controls that can identify bulk-hosting behaviour, rate patterns and suspicious scan density. Defenders should tune controls to infrastructure behaviour, not just IP reputation.

Q: What are the signs that credential abuse is becoming application aware?

A: Look for login attempts that match a specific ecosystem rather than generic default-credential lists, especially when usernames and passwords mirror the technology stack being targeted. That pattern shows attackers are no longer spraying one-size-fits-all wordlists. It usually means the target has become visible enough for stack-specific reconnaissance and login testing.

Q: What should organisations prioritise first in long-lived OT environments: patching or access control?

A: Access control should come first when devices are hard to patch, unsupported, or widely distributed. Patching remains important, but it rarely removes exposure quickly enough in OT. Reducing reachability, removing unnecessary vendor paths and constraining sessions can lower risk immediately while lifecycle updates are planned.

Technical breakdown

Why legacy SMB remains the main delivery path

SMB over 445/TCP remains attractive because it is widely reachable, heavily embedded in older Windows and mixed-environment estates, and often left exposed long after the original business need has faded. When a protocol becomes both common and tolerated, attackers can reuse exploit chains and malware delivery logic across many targets. The report’s data shows the defensive problem is not novelty but persistence: old exposure survives because ownership, segmentation and decommissioning lag behind the attack surface. In OT-adjacent environments, that becomes especially risky where legacy compatibility is preserved for operational continuity.

Practical implication: Treat SMB exposure as an ownership and segmentation issue, not just a patching issue.

How cloud and VPS infrastructure changes attacker visibility

The report shows that most high-volume attacker sessions came from hosting providers rather than residential networks, which means bulk scanning is being industrialised on disposable compute. That matters because reputation controls, ASN blocks and host-based rate limiting behave differently against rented cloud ranges than against a distributed botnet. This is not anonymity through sophistication; it is scale through cheap infrastructure turnover. For defenders, the architecture of the attacker platform shapes what can be blocked, logged and correlated at the perimeter and in upstream threat intelligence feeds.

Practical implication: Use hosting-provider intelligence in detection and blocking logic, especially where bulk scanning is the dominant pattern.

Why credential stuffing is becoming more application aware

The credential data is important because it shows two behaviours at once: broad default-login abuse and targeted attempts aligned to specific ecosystems such as Solana infrastructure. That means attackers are no longer just spraying generic wordlists; some are matching usernames and passwords to the technology stack they expect to find. In governance terms, authentication exposure is no longer limited to human login portals. Any internet-facing service with weak defaults, shared admin patterns or machine-facing authentication paths can become a viable entry point.

Practical implication: Harden default credentials and machine access paths with the same seriousness as user authentication.

Threat narrative

Attacker objective: Attackers appear to want scalable initial access, malware delivery and opportunistic monetisation rather than a single targeted intrusion.

1. Entry begins with broad cloud-hosted scanning and protocol probing against exposed OT and adjacent services, with March 2026 standing out for attacker diversity and payload experimentation.
2. Credential harvesting and exploitation follow through default logins, application-aware credential attempts and long-lived SMB flaws such as MS17-010-era exposure.
3. Escalation occurs when attackers move from discovery to malware delivery or exploit execution over the most reachable service paths, especially SMB 445/TCP.
4. Impact is the deployment of mining, trojan or ransomware payloads, or the expansion of reconnaissance against industrial protocols and blockchain infrastructure.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Legacy exposure is the real attack surface debt: the report shows that decade-old SMB weaknesses still deliver value because organisations continue to preserve compatibility longer than they preserve governance. That is not just a patching failure. It is an access-lifecycle failure in which old services remain reachable because ownership, segmentation and retirement are treated as secondary tasks. Practitioners should read this as a warning that exposure management must include decommissioning discipline, not only vulnerability queues.

Cloud infrastructure has become attacker staging infrastructure: when 97% of high-volume sessions come from hosting providers, the practical problem is no longer whether attackers can hide, but how cheaply they can rotate. This matters for security architecture because detection, blocking and intelligence all change when the source is disposable compute rather than a fixed endpoint. The programme implication is to tune controls for hosted bulk activity, not for a myth of evenly distributed adversary traffic.

Credential governance now extends beyond people: the Solana-focused login attempts are a reminder that authentication abuse is increasingly application-aware and machine-facing. That means identity governance cannot stop at human accounts and classic IAM workflows. Where services expose admin surfaces or node access, the governance question becomes whether defaults, shared secrets and machine authentication are being managed with the same discipline as privileged human access.

Industrial reconnaissance is becoming sector-specific: the report’s protocol patterns show that attackers are not only scanning for open ports, they are selecting protocols that reveal how a plant, hospital or utility actually operates. That makes protocol exposure a governance signal, not just a network one. For practitioners, the meaningful control gap is whether asset visibility and segmentation are aligned to the protocols that matter in each environment.

March 2026 looks like an attacker experimentation window: the convergence of CVE hits, payload diversity and OT scanning suggests a period where multiple tools and techniques were being tried in parallel. That is important because it indicates campaign adaptation, not one-off noise. Security teams should use that signal to prioritise change detection, not just alert volume, because experimentation often precedes wider operationalisation.

What this signals

March is the signal, not May: the report suggests that attacker experimentation, not raw volume, was the best indicator of escalation in this period. When payload diversity, CVE hits and OT scanning all rise together, security teams should assume adversaries are testing combinations of exploit and delivery paths before settling on the most productive ones.

The governance lesson is that OT security cannot be measured only by incident count. Exposure to legacy SMB, default credentials and protocol-specific reconnaissance creates a recurring entry surface that lives outside conventional patch velocity metrics, so programme owners need visibility into service retirement, credential hygiene and industrial protocol exposure at the same time.

For practitioners

• Restrict legacy SMB exposure Inventory every SMB-reachable asset, remove unnecessary 445/TCP exposure, and segment legacy systems that still require SMB for business continuity.
• Block and monitor hosting-provider scanning Treat cloud and VPS ASN ranges as a distinct threat source in perimeter filters, rate limits and enrichment workflows for bulk scanning activity.
• Eliminate default credentials on machine-facing services Replace shared admin defaults with unique credentials or key-based authentication on any internet-facing node, validator or service endpoint.
• Tune detection for protocol-specific reconnaissance Prioritise monitoring for the industrial protocols your environment actually exposes, including OT discovery traffic that matches sector-specific patterns.

Key takeaways

• Legacy SMB exposure remains a durable delivery path for opportunistic attackers, which means old services still create present-day governance debt.
• The report’s strongest signal was not raw session volume but the simultaneous rise in payload diversity, CVE exploitation and OT protocol scanning in March 2026.
• Defenders should treat cloud-hosted scanning, default credentials and sector-specific reconnaissance as a connected exposure problem rather than separate alerts.

Key terms

• Legacy SMB Exposure: Legacy SMB exposure is the continued availability of old file-sharing services on systems that no longer need them. In attack telemetry, it remains valuable because it gives opportunistic actors a predictable path for scanning, exploitation and malware delivery across mixed IT and OT environments.
• Application-Aware Credential Stuffing: Application-aware credential stuffing is login abuse that targets a specific platform, service or device family rather than spraying generic passwords everywhere. It indicates that attackers have enough context to match credential guesses to the technology stack they expect to find.
• Hosting-Provider Scanning: Hosting-provider scanning is bulk reconnaissance launched from cloud or VPS infrastructure rather than residential networks. It is operationally important because it usually reflects cheap, disposable attacker staging that can be rotated quickly and filtered using infrastructure intelligence.
• Industrial Reconnaissance: Industrial reconnaissance is the use of scanning and protocol probing to map how an OT or industrial environment is exposed. It matters because the protocol choices themselves often reveal plant design, sector type and likely control priorities, even when no compromise occurs.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It is a practical fit for practitioners who need to connect identity controls to broader security operations and access governance.