https://blog.efespain.com/en/tags/honeypot/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainTue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-26/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-26/The family from the previous chapter didn't stand still: there's a newer build going around, and I caught it from the first second. It brute-forces its way in over SSH, sizes the machine up, evicts the competition —its own older version included—, uploads sixteen megabytes in a single file and fires. All in a little over a minute. And then it walks straight into one line of fstab.https://blog.efespain.com/en/chapter-23/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-23/I left a password sitting on a decoy and, one Sunday, something came through it three times. I neutralised what it brought; what I didn't see until later was what it left planted — a line in .bashrc that makes «top» lie and hide the very process eating the machine. A rootkit without a rootkit. And putting two frozen disks side by side turned up the detail that changes everything: the same line, with a different number.https://blog.efespain.com/en/chapter-21/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-21/An automated scanner found the honeypot's telnet and, eighteen seconds later, there was a binary inside. The password was «telnet». The loader it dropped comes with two operator typos, one of which breaks an entire infection. And when I finally put a name to the family —IranBot, a Mirai fork with a public dossier— it turned out that name had been written on this blog since August: a rival bot had put it there, in the list of competitors it uninstalls on arrival.https://blog.efespain.com/en/chapter-18/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-18/An already-infected IP connected to the honeypot's telnet and pasted a recipe all at once: eleven binaries, one per architecture, each with a made-up name that will never come round again. Two weighed exactly the same and looked like variants — they turned out to be the i586 and i686 builds of the same program. And behind them wasn't a stray bug: fifty-odd distinct binaries in two weeks. The whole delivery is built so that no blocklist, by name or by signature, catches anything.https://blog.efespain.com/en/chapter-17/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-17/A quiet Sunday, my new-binary alarm went off after days of silence. The first thought was the best one there is: something fresh. What followed was a rollercoaster — an old acquaintance, a false positive that nearly fooled me, and finally a critter that wasn't in any public repository, caught less than thirty hours after it was born.https://blog.efespain.com/en/chapter-14/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-14/In chapter 9 someone tried to make my phone switch pay for their calls. I wrote it up and closed the incident, with one question left hanging: who was on the other end? This time I didn't just watch through the window. I gave the decoy a memory, followed the number's trail, and found out why they pick exactly those numbers.https://blog.efespain.com/en/chapter-1/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-1/I keep a honeypot in some corner of the network. Most of it is noise: scanners that look and leave. Until one got in, decided it was the administrator, and pushed its critter up through the service door.https://blog.efespain.com/en/chapter-3/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-3/Another one walks in and drops its critter. But this one left a door open on its own delivery server — and inside was the source code. A multi-architecture Mirai, caught red-handed.https://blog.efespain.com/en/chapter-5/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-5/The previous critter kicked the door in with wget. This one walked in with an SSH key in its pocket, cleared the house of rival miners, and settled in with a professional's manners. It's RedTail, and it plays in a different league.https://blog.efespain.com/en/chapter-7/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-7/The previous three went after servers. This one went after a phone: it came in through ADB, wiped out the competition, installed its app disguised as Google, and hid itself. First Android malware in the honeypot.https://blog.efespain.com/en/chapter-9/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-9/This time no binary landed. A fraud did: for two hours, fifteen machines tried to make my PBX place 3,457 international calls — the trial run of an International Revenue Share Fraud (IRSF), with the bill in my name. A chapter with no Ghidra: just protocol, money and OSINT.