Tag
OSINT
all chapters
- Chapter 14 The call factory In chapter 9 someone tried to make my phone switch pay for their calls. I wrote it up and closed the incident, with one question left hanging: who was on the other end? This time I didn't just watch through the window. I gave the decoy a memory, followed the number's trail, and found out why they pick exactly those numbers.
- Chapter 16 The tenant who'd been there eleven years A bot walked into my honeypot, stayed 62 seconds and left. I filed it as Gafgyt and I was wrong. A week later I followed its command servers and ended up inside an operation that has been running since 2015 — one I'd had in my hands from day one.
- Chapter 17 Fresh out of the oven A quiet Sunday, my new-binary alarm went off after days of silence. The first thought was the best one there is: something fresh. What followed was a rollercoaster — an old acquaintance, a false positive that nearly fooled me, and finally a critter that wasn't in any public repository, caught less than thirty hours after it was born.
- Chapter 20 Twelve alibis and a mailbox The previous chapter left a question the binary doesn't answer: of the thirteen STUN servers Cling beacons to, one has to be the operator's mailbox —because the bot announces its ports only to those thirteen, to nobody else— and yet all thirteen look like innocent VoIP providers. I didn't catch it issuing an order; I found it by elimination and exclusivity, using public records to see who talks to each one. Twelve have an alibi. The thirteenth doesn't.
- Chapter 25 Twenty-odd dollars a day The teardown left me a Monero wallet and a question the binary doesn't answer: how much has this thing earned. Monero is built so no balance can be looked up — but the pool they mine against publishes per-wallet statistics, and that's an open page. What turned up when I asked: one wallet collecting since January 2021, another already running months before it showed up in any sample, about twenty-three dollars a day, and an electricity bill paid by the victims that comes to more than the operator makes.
- Chapter 28 The wallet that never travels The two previous chapters left the kit taken apart piece by piece, and one question unanswered: who it pays. I went looking. And what I found was a design that prevents it — the mining config never travels inside the critter, it gets downloaded afterwards — and scaffolding somebody had already dismantled. This is the chase, what it does plant when you let it run, and how far what I can prove about who's behind it actually goes.