IoT · Diary of a Lost Honeypothttps://blog.efespain.com/en/tags/iot/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainTue, 01 Sep 2026 12:00:00 +0000Introduced by its enemyhttps://blog.efespain.com/en/chapter-21/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-21/An automated scanner found the honeypot's telnet and, eighteen seconds later, there was a binary inside. The password was «telnet». The loader it dropped comes with two operator typos, one of which breaks an entire infection. And when I finally put a name to the family —IranBot, a Mirai fork with a public dossier— it turned out that name had been written on this blog since August: a rival bot had put it there, in the list of competitors it uninstalls on arrival.A Mirai that couldn't attack?https://blog.efespain.com/en/chapter-19/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-19/I pulled down the three binaries from the previous chapter expecting the usual DDoS arsenal. It wasn't there: not one attack function. What it does instead —and above all, the channel its orders arrive on— is the strangest thing that has come through the honeypot. A bug designed, top to bottom, not to be seen.Nothing to filehttps://blog.efespain.com/en/chapter-18/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-18/An already-infected IP connected to the honeypot's telnet and pasted a recipe all at once: eleven binaries, one per architecture, each with a made-up name that will never come round again. Two weighed exactly the same and looked like variants — they turned out to be the i586 and i686 builds of the same program. And behind them wasn't a stray bug: fifty-odd distinct binaries in two weeks. The whole delivery is built so that no blocklist, by name or by signature, catches anything.Fresh out of the ovenhttps://blog.efespain.com/en/chapter-17/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-17/A quiet Sunday, my new-binary alarm went off after days of silence. The first thought was the best one there is: something fresh. What followed was a rollercoaster — an old acquaintance, a false positive that nearly fooled me, and finally a critter that wasn't in any public repository, caught less than thirty hours after it was born.KHserverhttps://blog.efespain.com/en/khserver/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/khserver/

KHserver has no name in any repository: antivirus engines file it asgafgyt/tsunami and that is where its record ends. I name it after the two marks its own author left compiled inside the binary,KHserverHACKER andKHcommSOCK, because those survive even when the files it hands out are renamed.

What sets it apart fromMirai orXorDDoS is not the technique — the skeleton is the usual one — butthe business. Its command list includesFORTNITE,COD,R6,RUST andVSE, plus two commands aimed atOVH andNFOservers, the two big game-server hosts. This is not used for whatever comes up:it is rented by the hour so that somebody’s match goes down.

The bot that bragged — and couldn't be botheredhttps://blog.efespain.com/en/chapter-11/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-11/A 1,177-byte loader landed: nine lines of wget, one per architecture, in the style I have already opened three times on this blog. I was going to file it as a repeat offender and get on with my day. I opened it anyway, out of habit — and the first thing I saw was that it had a few characters too many.The botnet that left its code out in the openhttps://blog.efespain.com/en/chapter-3/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-3/Another one walks in and drops its critter. But this one left a door open on its own delivery server — and inside was the source code. A multi-architecture Mirai, caught red-handed.