DDoS · Diary of a Lost Honeypothttps://blog.efespain.com/en/tags/ddos/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainSat, 01 Aug 2026 12:00:00 +0000Fresh out of the ovenhttps://blog.efespain.com/en/chapter-17/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-17/A quiet Sunday, my new-binary alarm went off after days of silence. The first thought was the best one there is: something fresh. What followed was a rollercoaster — an old acquaintance, a false positive that nearly fooled me, and finally a critter that wasn't in any public repository, caught less than thirty hours after it was born.The tenant who'd been there eleven yearshttps://blog.efespain.com/en/chapter-16/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-16/A bot walked into my honeypot, stayed 62 seconds and left. I filed it as Gafgyt and I was wrong. A week later I followed its command servers and ended up inside an operation that has been running since 2015 — one I'd had in my hands from day one.KHserverhttps://blog.efespain.com/en/khserver/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/khserver/

KHserver has no name in any repository: antivirus engines file it asgafgyt/tsunami and that is where its record ends. I name it after the two marks its own author left compiled inside the binary,KHserverHACKER andKHcommSOCK, because those survive even when the files it hands out are renamed.

What sets it apart fromMirai orXorDDoS is not the technique — the skeleton is the usual one — butthe business. Its command list includesFORTNITE,COD,R6,RUST andVSE, plus two commands aimed atOVH andNFOservers, the two big game-server hosts. This is not used for whatever comes up:it is rented by the hour so that somebody’s match goes down.

Nikki, you are lovedhttps://blog.efespain.com/en/chapter-12/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-12/The binary arrived unstripped: its author left inside the names of all six hundred and twenty-eight functions he wrote. It is like being handed a closed book with the index stapled to the cover. Here I read it end to end, function by function, until I reach the one string that fitted nowhere.The bot that bragged — and couldn't be botheredhttps://blog.efespain.com/en/chapter-11/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-11/A 1,177-byte loader landed: nine lines of wget, one per architecture, in the style I have already opened three times on this blog. I was going to file it as a repeat offender and get on with my day. I opened it anyway, out of habit — and the first thing I saw was that it had a few characters too many.Someone brought their malware to my househttps://blog.efespain.com/en/chapter-1/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-1/I keep a honeypot in some corner of the network. Most of it is noise: scanners that look and leave. Until one got in, decided it was the administrator, and pushed its critter up through the service door.The botnet that left its code out in the openhttps://blog.efespain.com/en/chapter-3/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-3/Another one walks in and drops its critter. But this one left a door open on its own delivery server — and inside was the source code. A multi-architecture Mirai, caught red-handed.The one that came in through the debug cablehttps://blog.efespain.com/en/chapter-7/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-7/The previous three went after servers. This one went after a phone: it came in through ADB, wiped out the competition, installed its app disguised as Google, and hid itself. First Android malware in the honeypot.