https://blog.efespain.com/en/xorddos/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainSat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-16/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-16/A bot walked into my honeypot, stayed 62 seconds and left. I filed it as Gafgyt and I was wrong. A week later I followed its command servers and ended up inside an operation that has been running since 2015 — one I'd had in my hands from day one.https://blog.efespain.com/en/chapter-2/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-2/In Chapter 1 the C2 stayed encrypted inside the binary. Here I open it with Ghidra and it comes out whole — but on the way, everything else this critter carries turns up too: how it disguises itself as a system process, how it kills the competition using the very trail that gives it away, and how it lies about its own address when its command centre tells it to.https://blog.efespain.com/en/chapter-1/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-1/I keep a honeypot in some corner of the network. Most of it is noise: scanners that look and leave. Until one got in, decided it was the administrator, and pushed its critter up through the service door.