A public bus stop electronic display in Wuhu, Anhui became a compromised botnet node after its router retained factory-default credentials and exposed administrative services. Local police traced anomalous traffic to the device in April 2026 and confirmed it had been recruited by malware without causing further damage.
Case Details: Default Credentials and Open Ports
The router used unchanged admin/admin credentials, kept its web management interface, SSH port, and NAT traversal functions enabled. These settings allowed remote attackers to gain control with minimal effort, turning the station display into a remotely operated 肉鸡 (zombie). Authorities ordered the operator to remediate but noted that the absence of severe consequences did not exempt the entity from legal responsibility.
The case formed part of the Ministry of Public Security’s Hu Wang 2026 campaign, which publicly listed ten representative incidents. Researcher Zhi Zhenfeng from the Chinese Academy of Social Sciences emphasized that the Cybersecurity Law requires network operators to adopt technical measures against intrusion and to maintain logs for no less than six months; failure to change defaults or restrict ports already breaches these obligations.
RCtea Botnet Activity and National Scale
The National Internet Emergency Center had previously warned that the RCtea botnet, active since late 2025, specifically targets routers and cameras via Telnet brute-force of weak passwords. Between 20 and 25 January 2026 alone, 9,827 Chinese devices were confirmed infected. Similar enforcement actions followed in Qinghai Guoluo and Nanchong, where entities received administrative warnings after refusing to fix persistent weak-password issues.
International Precedents and Root Causes
Comparable incidents abroad include compromised bus displays in Yeosu, South Korea, and Curitiba, Brazil, where attackers replaced scheduled information with inappropriate content. Analysts attribute the pattern to procurement practices that omit security budgets, lack of skilled personnel at operating agencies, and unclear responsibility between contractors and owners.
Recommended Actions for Operators, Regulators, and Vendors
- Operators must change default passwords immediately, disable unnecessary remote ports, enforce network segmentation, retain logs, and establish monitoring procedures.
- Regulators should incorporate IoT assets into routine inspections and pursue administrative penalties for non-compliance.
- Manufacturers should enforce mandatory password changes on first login and disable high-risk remote functions by default.
The campaign ultimately identified more than 7,900 network and data security risks and prompted remediation of 38,000 vulnerabilities while handling 38,000 administrative cases for failure to fulfill security obligations. The Ministry concluded that every networked device, regardless of size, represents a potential entry point that must be inventoried and hardened.
