Tag
OSINT
all chapters
- Chapter 14 The call factory In chapter 9 someone tried to make my phone switch pay for their calls. I wrote it up and closed the incident, with one question left hanging: who was on the other end? This time I didn't just watch through the window. I gave the decoy a memory, followed the number's trail, and found out why they pick exactly those numbers.
- Chapter 16 The tenant who'd been there eleven years A bot walked into my honeypot, stayed 62 seconds and left. I filed it as Gafgyt and I was wrong. A week later I followed its command servers and ended up inside an operation that has been running since 2015 - one I'd had in my hands from day one.
- Chapter 17 Fresh out of the oven A quiet Sunday, my new-binary alarm went off after days of silence. The first thought was the best one there is: something fresh. What followed was a rollercoaster - an old acquaintance, a false positive that nearly fooled me, and finally a critter that wasn't in any public repository, caught less than thirty hours after it was born.
- Chapter 20 Twelve alibis and a mailbox The previous chapter left a question the binary doesn't answer: of the thirteen STUN servers Cling beacons to, one has to be the operator's mailbox (because the bot announces its ports only to those thirteen, to nobody else) and yet all thirteen look like innocent VoIP providers. I didn't catch it issuing an order; I found it by elimination and exclusivity, using public records to see who talks to each one. Twelve have an alibi. The thirteenth doesn't.
- Chapter 25 Twenty-odd dollars a day The teardown left me a Monero wallet and a question the binary doesn't answer: how much has this thing earned. Monero is built so no balance can be looked up - but the pool they mine against publishes per-wallet statistics, and that's an open page. What turned up when I asked: one wallet collecting since January 2021, another already running months before it showed up in any sample, about twenty-three dollars a day, and an electricity bill paid by the victims that comes to more than the operator makes.
- Chapter 28 The wallet that never travels The two previous chapters left the kit taken apart piece by piece, and one question unanswered: who it pays. I went looking. And what I found was a design that prevents it - the mining config never travels inside the critter, it gets downloaded afterwards - and scaffolding somebody had already dismantled. This is the chase, what it does plant when you let it run, and how far what I can prove about who's behind it actually goes.
- Chapter 30 The C2's Landlord Last chapter I opened shem up from the inside, but one thing nagged at me: its command centre is a bare IP, no domain, so I couldn't follow the operator. I pulled on that IP anyway. And what turns up at the other end isn't the operator - it's his landlord: a bulletproof hosting block that swaps its name and its plates to stay out of reach, rents to half a dozen botnets at once, and throws the server away after ten days.
- Chapter 31 One door, three visitors Forty megabytes of binary that won't open: the decompiler takes one look and refuses. Before forcing that door, the boring part that has to come first - who brought them here.
- Chapter 33 DIICOT: Ciocolata flavour Almost three megabytes that do one single thing: call home, say two words and wait ten seconds for someone to answer. If nobody does, it leaves without a trace. But inside, encrypted a different way, it carries a second address: a domain nobody has registered. And the rest of the program fits in one line of shell.
- Chapter 34 DIICOT: One syllable apart The executor from the last chapter calls a machine I already knew and keeps as a fallback a domain that looks far too much like one that did exist. Pulling on that one-syllable difference brings out its big brother, the previous C2 and the slot it uses to get into its victims. In the end, I asked the other side what it sends.