Ethics

This diary tells the story of what falls into a honeypot. To tell it without doing harm, there are fixed rules. Here they are.

The bait is mine. The honeypot runs on my own infrastructure, built and paid for exactly this purpose. Nothing analyzed here was sought out: every sample arrived on its own, attacking a machine of mine. There are no third-party victims involved, no one else’s data, no systems that don’t belong to me.

The analysis starts cold and, when it has to, carries on in a cage. Samples are opened in the disassembler first: their strings read, their logic pieced back together. When that isn’t enough, they are run — but on an isolated machine with no way out to the network, reverted once it’s done. Never on the bait and never against anyone: observing is not releasing. When a chapter shows a console, it is the record of what the attacker did on the bait or of what the sample did inside the cage, and it says which of the two.

The binaries are not distributed. For each specimen I publish its hash, enough to identify it or look it up on the analysis services. The file itself is not shared, whole or in pieces: this diary documents malware, it doesn’t hand it out.

The bait’s location is not published. Not the address, not the provider, not any clue that could lead to it. A honeypot that has been pointed at stops working, and what it catches would no longer be spontaneous.

Reconnaissance observes, it doesn’t strike back. When a chapter follows the trail of a command infrastructure, it only looks at what is publicly exposed: resolving names, reading banners, checking records. Nothing gets exploited, nothing gets broken into, no blow is returned.

The IOCs are published real. Addresses, domains, paths and hashes go in as they are, because their value lies in detection. One nuance: the source IPs are rarely the attacker’s own machine — most are third-party systems already compromised, attacking without their owners knowing. They get published as indicators all the same, as the whole industry does: flagging them is the first step toward someone cleaning them up. The exception is payload download URLs that may still be live: those are defanged (hxxp, [.]) so nobody follows them by accident.

This is not professional advice. It is a personal diary: what it tells may contain mistakes or go stale. If anything here touches your infrastructure, check it against your own sources before acting.

Spotted an error, or have something to report? Write to me: hola@efespain.com.