https://blog.efespain.com/en/tags/chacha20/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainSat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-8/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-8/We peel the APK apart layer by layer: a DEX that's nothing but a launcher, an app that nails itself into /system if there's root, and a native DDoS engine. The C2 slammed the door in my face — until I came back another way and it opened.