https://blog.efespain.com/en/superior/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainSun, 01 Nov 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-36/Sun, 01 Nov 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-36/One attack method is called kimwolf, the console signs with Mozi's name, the operator's contact wears the face of a hacker wanted by the FBI and antivirus engines say Mirai. It's none of them. It's a bot all its own, belonging to an operator who dresses up in other people's names, on a domain that has been serving bots for almost nine months.https://blog.efespain.com/en/chapter-37/Sun, 01 Nov 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-37/The same server that was handing out Superior served another bot one day, written in Rust and with a motto on the door: "memory safe. system optimized." I put it in a sealed cage, made it believe its server was answering, and it told me everything. The most useful part isn't what it does when it's given commands, but what it does without them.https://blog.efespain.com/en/chapter-35/Sun, 01 Nov 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-35/An installer in a hurry drops onto a TV box an app that claims to be a Google update. Inside is a bot that, if it gets root, installs itself in the system, deletes Prime Video and leaves Netflix alone, and brings a face to paint on the screen. And when the owner uninstalls it, it stays.