Blog

Security research, threat intelligence insights, and product updates.

March 16, 2026

The Plumber: An Uninvited SMB Service Call

Our SMB honeypot captured a PsExec-style attack in full: an authentication probe, 13 seconds of silence, then a 2.5-second blitz through IPC$, the svcctl named pipe, and the Service Control Manager. The payload is a four-layer LOLBin chain ending in msiexec pulling an MSI disguised as a PNG from three C2 servers. Total time on target: under 17 seconds.

honeypots behaviors threat intelligence psexec smb windows lateral movement mshta lolbin msiexec named pipe svcctl malware Behavioral Analysis

March 5, 2026

Introducing the Attack Session Database: Raw Honeypot Sessions, Searchable and Annotated

We're opening our attack session database in public beta. Browse and search real SSH commands, HTTP exploits, MySQL injections, Docker escapes, and more, captured by our globally distributed honeypot network. Every session is curated, annotated with behavioral analysis and matched attack primitives, and free to access.