https://blog.efespain.com/en/tags/ngioweb/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainTue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-19/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-19/I pulled down the three binaries from the previous chapter expecting the usual DDoS arsenal. It wasn't there: not one attack function. What it does instead —and above all, the channel its orders arrive on— is the strangest thing that has come through the honeypot. A bug designed, top to bottom, not to be seen.https://blog.efespain.com/en/chapter-18/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-18/An already-infected IP connected to the honeypot's telnet and pasted a recipe all at once: eleven binaries, one per architecture, each with a made-up name that will never come round again. Two weighed exactly the same and looked like variants — they turned out to be the i586 and i686 builds of the same program. And behind them wasn't a stray bug: fifty-odd distinct binaries in two weeks. The whole delivery is built so that no blocklist, by name or by signature, catches anything.https://blog.efespain.com/en/chapter-20/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-20/The previous chapter left a question the binary doesn't answer: of the thirteen STUN servers Cling beacons to, one has to be the operator's mailbox —because the bot announces its ports only to those thirteen, to nobody else— and yet all thirteen look like innocent VoIP providers. I didn't catch it issuing an order; I found it by elimination and exclusivity, using public records to see who talks to each one. Twelve have an alibi. The thirteenth doesn't.