#malware
2 articles
I Built a Honeypot Framework, Deployed It for 5 Days, and the Internet Showed Up With Malware and Opinions
119,001 events. 1,120 unique IPs. 16 malware samples. 822 terminal recordings. The same Chinese worm. The same cryptominer. A 29MB botnet propagation binary. And a tool I wrote to make sense of all of it.
·22 min readI Mass-Accepted SSH Logins for 48 Hours and Catalogued Everything That Walked In
38,208 events. 374 unique IPs. 12 malware samples. A self-propagating Chinese worm. A multi-architecture cryptominer. Two competing SSH backdoor campaigns. One very convincing fake server.
·18 min read