https://blog.efespain.com/en/shem/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainThu, 01 Oct 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-29/Thu, 01 Oct 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-29/Another IoT ELF with the look of a run-of-the-mill Mirai landed in the decoy. I christened it “zbot” after its cron files, and it turned out that wasn’t even its name: by three separate routes (the paths it left on disk, the banners it speaks SSH and HTTP with, and the first bytes of every message to its C2) the thing kept telling me its real name. Behind it was something more interesting than a server-flooding bot: a machine for renting out its victim’s home line as a proxy. And an operator who, with the whole thing built, kept breaking his own download URLs. XLab had already named it “Shemzbot” in a tweet; this is the teardown that tweet didn’t carry.https://blog.efespain.com/en/chapter-30/Thu, 01 Oct 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-30/Last chapter I opened shem up from the inside, but one thing nagged at me: its command centre is a bare IP, no domain, so I couldn't follow the operator. I pulled on that IP anyway. And what turns up at the other end isn't the operator - it's his landlord: a bulletproof hosting block that swaps its name and its plates to stay out of reach, rents to half a dozen botnets at once, and throws the server away after ten days.