Field reports and open-source tooling.
Original research from the specialists who run our client engagements: the monthly Mirage honeypot field reports and the open-source tools we build and use in the field.
RSS feedField reports & tooling
J@IL-GPT: an infostealer in a fake ChatGPT tool
A fake ChatGPT 4.5 tool distributed through DarkForums and GitHub contains a Windows infostealer. Its MSI and EXE packages conceal identical collection code, a browser-injection DLL, encrypted uploads and a conditional persistence branch.
UpdraftPlus: PHP backdoor delivery attempts via CVE-2026-10795
A forged UpdraftPlus management request delivered a PHP backdoor to a Mirage decoy on 6 September. The retained campaign contains 20 plugin-upload attempts and 76 requests checking exact payload paths. Static analysis identifies command execution, file management and upload functions in the complete recovered sample.
GHOSTWORKER: a stealth UniFi gateway implant that phones home over Google's DNS
During a black-box assessment of the client's external network perimeter, the OffSeq team identified an internet-facing UniFi Dream Machine Pro and exploited a critical vulnerability disclosed by Ubiquiti in May 2026 and rated CVSS 10.0. In the post-exploitation phase we found the gateway had already been compromised: two unauthorized administrator accounts impersonating "tech support," together with a root-level implant we track as GHOSTWORKER. Deployed as /bin/unifi_updater, it survives reboots, masquerades as a [kworker] kernel thread, and establishes command-and-control over DNS-over-HTTPS using Google's public resolver. It also carries an embedded certificate dating to 2020, referencing infrastructure hosted within a Dutch network registered to "Linfosys."
The honeypot that gets robbed: a fifth of all honeypot traffic is toll fraud, not intrusion
The first two reports were about getting in – the exploit, the password. This one is about an attacker who does not care about your data at all. He wants your dial tone. Point a fake Asterisk PBX at the internet and roughly a fifth of everything that lands on it is not an intrusion attempt; it is toll fraud – millions of SIP messages whose goal is to make our honeypot place expensive international calls that someone else profits from and someone else pays for. The honeypot does not get breached. It gets billed.
A password is a fingerprint: what the internet's brute force is really typing
The honeypot genre has a favourite story: point a fake SSH server at the internet, watch the world guess root/123456, publish the list. It is a true story about one door. Our fleet speaks thirteen credential protocols, and over 44 days it drew 81,065 distinct source addresses and 12.2 million login attempts – enough to see that "brute force" is not one thing. It is a dozen separate campaigns, each carrying a purpose-built dictionary, and the password an attacker types is a fingerprint of the device it expects to find. The loudest campaign is not against SSH servers at all.
A connection is not an exploit: what 27 days of honeypot traffic actually contained
Honeypot reports trade in enormous, frightening numbers. Across 27 days our sensor fleet logged 5.4 million events carrying a CVE label – and 99.9% of them were doorknob-rattling: brute-force logins and port scans against deliberately vulnerable-looking services, not exploitation. Strip the noise and the real signal is small and sharp: 3,572 actual exploit payloads, a hand-picked set of web vulnerabilities from 2017 to 2024, and exactly one human being – a botnet operator typing an eight-year-old SSH key by hand.
threat-finder – open-source runtime CVE scanner
threat-finder is an open-source, Rust command-line scanner from OffSeq that finds CVEs in the software actually running on a host — not what a manifest claims — and ranks them by how network-reachable each affected service is, so operators fix what an attacker can actually touch first.