https://blog.efespain.com/en/mirai/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainSat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-17/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-17/A quiet Sunday, my new-binary alarm went off after days of silence. The first thought was the best one there is: something fresh. What followed was a rollercoaster — an old acquaintance, a false positive that nearly fooled me, and finally a critter that wasn't in any public repository, caught less than thirty hours after it was born.https://blog.efespain.com/en/chapter-4/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-4/The bot from the last chapter kept its config encrypted and its orders under lock and key. Ghidra spills the lot: the decryption (a laughable XOR), the botnet's real name, its C2 protocol and its full arsenal — without handing out weapons.https://blog.efespain.com/en/chapter-3/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-3/Another one walks in and drops its critter. But this one left a door open on its own delivery server — and inside was the source code. A multi-architecture Mirai, caught red-handed.