Security research, threat intelligence insights, and product updates.
Our SMB honeypot captured a PsExec-style attack in full: an authentication probe, 13 seconds of silence, then a 2.5-second blitz through IPC$, the svcctl named pipe, and the Service Control Manager. The payload is a four-layer LOLBin chain ending in msiexec pulling an MSI disguised as a PNG from three C2 servers. Total time on target: under 17 seconds.
Our HTTP honeypot captured a self-replicating exploit chain in the wild: 46 requests in 16 seconds, six different vulnerability families, and a payload designed to turn every compromised server into a new scanner. CGI shell injection, CVE-2024-4577, PHPUnit eval-stdin across 37 path variations, ThinkPHP RCE, pearcmd file inclusion, and a Docker API probe. Each exploit carries an MD5 verification canary. Each successful infection spawns a copy of itself. This is not a tool. It is a contagion.
We're opening our attack session database in public beta. Browse and search real SSH commands, HTTP exploits, MySQL injections, Docker escapes, and more, captured by our globally distributed honeypot network. Every session is curated, annotated with behavioral analysis and matched attack primitives, and free to access.