Security research, threat intelligence insights, and product updates.
We observed a Redis exploitation bot in its natural habitat: an unprotected instance on port 6379. What followed was a textbook cron injection, captured in full by our honeypot network. INFO recon, 6.5 seconds of stillness, then 25 commands in 11 seconds. A parasitoid wasp in digital form.
Our honeypot sensors emulate exposed Docker daemons and record everything attackers do. We pulled a 24-hour snapshot: 3,964 events from 144 IPs, container escapes via nsenter, SSH key backdoors locked with chattr, a self-replicating worm from 100 IPs, and cron persistence — all before anyone touched the application layer.