January 2026: Global Telnet Traffic Plummets 59% in Apparent Botnet Takedown
By
pjf
3mo ago· 8 min readenInsight
100/100
Golden Brown
Bagelometer↗
Crisp on the outside, thoughtful on the inside. A keeper.
Score100TypeanalysisSentimentneutral
Summary
On January 14, 2026, GreyNoise Labs observed a dramatic 59% sustained reduction in global telnet traffic, with 18 ASNs going completely silent and 5 countries vanishing from their data. The article presents this as a significant cybersecurity event, suggesting a coordinated takedown of telnet-based botnets, particularly Mirai variants. Six days later, CVE-2026-24061 was published, hinting at a possible connection between the traffic disappearance and a major vulnerability disclosure. The content is presented in a creative, poetic format that references the historical significance of telnet protocol in botnet operations and the implications of its sudden decline.
Key quotes
· 4 pulledOn January 14, 2026, global telnet traffic observed by GreyNoise sensors fell off a cliff. A 59% sustained reduction, eighteen ASNs going completely silent, five countries vanishing from our data entirely.
Six days later, CVE-2026-24061 dropped. Coincidence is one explanation.
But January made me shiver / With every packet I tried to deliver / Bad news on the backbone / I couldn't scan a single ASN
So bye, bye mass spreading Mirai / Drove my SYNs down on the fiber line / But the fiber line was dry / And good old bots were passing creds in the clear and dr
On January 14, 2026, global telnet traffic observed by GreyNoise sensors fell off a cliff. A 59% sustained reduction, eighteen ASNs going completely silent, five countries vanishing from our data entirely. Six days later, CVE-2026-24061 dropped. Coinciden
