What Hit My Honeypot in a Week ?

Over seven days, my Linux honeypot recorded 108,114 sessions, 21,038 commands, and 15 unique payloads. What first looked like routine Mirai-era noise led to a coordinated RedTail/XMRig deployment involving SSH scanning, rival-miner cleanup, and persistence.

Onurcan Genç 3 min read
What Hit My Honeypot in a Week ?
"From credential spraying and BusyBox probes to a coordinated, multi-architecture cryptomining deployment."

My field report based on raw authentication, command, session, and payload telemetry.

Figure 1: A honeypot Weekly Telemetry Data

Shape of the week

Daily session counts on the left, hourly distribution on the right (UTC). In conclusion, Automated bots do not sleep, but campaigns still have a rhythm.

Figure 2: Daily Session Attempts & Distribution Bar Graph

Credential attempts

I intentionally put a mask on passwords. Bots replay credentials harvested elsewhere. Some of these may be real leaked passwords.

Figure 3: Tried user:pass Combinations
Mirai overlap: I identified 46 of the attempted pairs match credentials from the leaked Mirai source code's 60 defaults. These pairs account for 22.2% of all login attempts (39,496 tries). Most of the traffic is not a new attack and it's copies of a decade-old codebase still circulating, each one probing for a specific camera or DVR firmware's factory password.

Commands run inside my honeypot

260 IPs reached a shell (19.9% of all sources). The rest tried credentials and left.

Figure 4: Command Categories & Commands

Payloads downloaded

The honeypot stores files but never executes them (even attacker attempts, simply it is in honeypot).

I identified:

  • 15 unique files
  • 1,125 download attempts.
Figure 5: Malicious File Download Attempt

Who were connecting

Based on retrieved data, geography and network owner from a local MaxMind database; reputation tags from public lists observed. None of this triggers any action. They were simply context ,so nothing more.

Figure 6: Captured Traffic, Session and their Providers
Figure 7: The Attempts made by different clients. Ex: SSH for OpenSSH client and Scanner frameworks indicating fuzzing tools on web.

642 sources (49%) already appear on at least one public blocklist. It does not mean they should be blocked a listing is information, not a verdict.

Figure 8: Sounds Interesting, I had traffics from Turk Telekom as provider as well.

MITRE ATT&CK coverage

Every technique derives from a concrete command or login attempt recorded in my honeypot. We can categorize them as

Rule-based and deterministic: if there is no evidence, the technique is not listed. In my case, most of the trials were false positive ,but I tried to add most identical & real ones.

Figure 9: MITRE Attack Mapping
Figure 10: MITRE Attack Mapping 2

Unobserved tactics (4)

  • Reconnaissance,
  • Resource Development,
  • Collection,
  • Exfiltration.

It was not a detection gap because my honeypot holds nothing worth stealing, so collection and exfiltration never begin. Reconnaissance and resource development happen on the attacker's side, without touching me. From my point of view, the gap shows that thanks to Honeypot, how far an attack can progress inside the honeypot before hitting a dead end.

Read more