SBIDIOT · Diary of a Lost Honeypothttps://blog.efespain.com/en/tags/sbidiot/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainSat, 01 Aug 2026 12:00:00 +0000KHserverhttps://blog.efespain.com/en/khserver/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/khserver/

KHserver has no name in any repository: antivirus engines file it asgafgyt/tsunami and that is where its record ends. I name it after the two marks its own author left compiled inside the binary,KHserverHACKER andKHcommSOCK, because those survive even when the files it hands out are renamed.

What sets it apart fromMirai orXorDDoS is not the technique — the skeleton is the usual one — butthe business. Its command list includesFORTNITE,COD,R6,RUST andVSE, plus two commands aimed atOVH andNFOservers, the two big game-server hosts. This is not used for whatever comes up:it is rented by the hour so that somebody’s match goes down.

Nikki, you are lovedhttps://blog.efespain.com/en/chapter-12/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-12/The binary arrived unstripped: its author left inside the names of all six hundred and twenty-eight functions he wrote. It is like being handed a closed book with the index stapled to the cover. Here I read it end to end, function by function, until I reach the one string that fitted nowhere.