https://blog.efespain.com/en/redtail/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainSat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-15/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-15/I built a cage, ran the miner and pulled from memory the configuration I couldn't decrypt back in chapter 6. I got excited… and walked away with two things I wasn't looking for: that this family was already documented top to bottom —somewhere it never occurred to me to look— and that the piece I thought I'd decrypted was for something else.https://blog.efespain.com/en/chapter-5/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-5/The previous critter kicked the door in with wget. This one walked in with an SSH key in its pocket, cleared the house of rival miners, and settled in with a professional's manners. It's RedTail, and it plays in a different league.https://blog.efespain.com/en/chapter-6/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-6/We unpack RedTail's miner and crack it open in Ghidra hunting for the pool and the wallet. What we find is more interesting than a number: the data is in there, embedded and encrypted — and nobody has published how to crack it.