Field notes on deception, fraud and CVEs
Practical writing on catching attacks, detecting fraud at the front door, and reading real-world exploitation.
4EverAble2Shell is already mining Monero on live N-central servers
Axis RCE to root to XMRig: 21 real N-central servers were mining for this operator by 12:50 UTC.
Inside SOÛL SOCIETY: automated exploitation, AI agent orders and a Telegram drug platform
An exposed attack server held an exploitation panel, a Go scanner, credential tooling, standing orders for AI agents, evidence files on named targets and a licensed Telegram drug-shop platform. How the operation worked and who it went after.
Typed by hand: how a Danfoss refrigeration controller is taken over
A published change log shows user 1's password rewritten, then the store renamed HACKED BY JUDRUD. On our Danfoss decoys, the people who came typed the factory password into a browser.
ARTEX learns to spot honeypots: dissecting an AI pentest agent's decoy detector
An ARTEX fork's design doc, signature engine and planner rules show how an autonomous attack agent fingerprints decoys, what it stops doing once it suspects one, and how it resists traps built for AI agents.
An operator used the pentestcode AI agent against 25 mid-size and large European companies and reports breaching 10 of them
Two exposed servers held the operator's prompt, the agent's logs and nine engagement reports claiming 168 compromised hosts and 1,256 credentials at hosting providers, marketplaces, a bank and a telecom.
PHP2Shell one week on: inside two operators' exploit labs
An AI agent's lab notes show PHP2Shell RCE on ten PHP builds, including unpatched 8.0 and 8.1; a second kit targets 8.4.26 sites. Seven exposed hosts, recovered from 22 October.
PHP2Shell in the wild: confirmed RCE, probing, and exposed attacker infrastructure
Independent sensors confirmed PHP2Shell shells; huntback adds pre-patch probes, a miner dropper and the exploit kits and files found on exposed hosts, including both source IPs.
Beyond the backup server: inside an AhsayCBS cryptomining playbook
Recovered operator notes show a miner campaign trying to spread from AhsayCBS web shells to neighbouring Windows hosts: 87 footholds tried, one neighbour reached.
PHP2Shell probes reached decoys hours before the security release
PHP2Shell probes hit Huntback decoys 5 hours before PHP's patch; 30 hours after it, a new source was delivering a RedTail-style cryptominer installer.
Searching for the Nuclear Control Room: an intrusion workbench built to find SCADA and PLC intel
Two small batch files on an exposed Windows workbench searched files, browser history and shortcuts for SCADA, PLC, substation and Pakistan energy and nuclear terms.
WEB_RAT is still alive: SalatStealer's active panel, rotating C2 and TON fallback
A 990-byte catch-all page led to the live WEB_RAT panel, a certificate-linked C2 cluster, and a TON blockchain dead drop that survives takedowns.
A Week After Censys: Coruna Infrastructure Moved, and Its Staging Host Exposed a Second Offensive Workspace
A week after Censys mapped the DarkSword/Coruna delivery infrastructure, the same staging host (47.102.192.23) turned up a 484-artifact offensive workbench, database and CI/CD looting, SSH pivoting, malware and AI-pentest corpora, and its Coruna delivery config reappeared on new IPs.
The botnet crew that served its own /root
An open directory served a botnet operator's /root: successive Telnet brute-force builds, an ADB loader using residential SOCKS5 proxies, a shared payload backend at 23.95.228.20, and bot-upgrade notes, one integrated device-recruitment pipeline.
Ten days inside CVE-2026-88771: anatomy of a NetScaler exploitation wave
1,069 exploitation attempts from 30 source IPs over ten days, de-conflicted into more than ten distinct operators: out-of-band provers, config-credential theft across ten IPs, a self-hosted implant, tunnel droppers, a PHP web shell, and a log-channel C2 that never calls out.
One server, three crypto crimes: wallet scanning, cryptojacking and pool brute-forcing
One exposed control server ran three crypto rackets at once: a distributed wallet-key scanner on hijacked Hadoop clusters, a GPU cryptojacking fleet, and a mining-pool credential brute-forcer.
When the pentester is a fleet of AI agents: inside an autonomous vuln-hunting rig
An open directory revealed an offensive operation run by a fleet of AI agents: Claude Code workers, a custom OOB interaction logger, SAST taint configs and nuclei, hunting bugs at machine speed.
Operation Open Ledger: an AI-assembled crew exfiltrating ERP data from Spanish SMBs
A Russian-speaking, AI-assembled crew left its server open: a Business Central exfiltration pipeline, a six-product exploit kit, a full AD arsenal, a Sliver C2, and 15 GB stolen from Spanish SMBs.
Hunting a ShinyHunters-linked phishing cluster from one IOC
One flagged host, a shared JARM and a // SH page title, and a whole cluster of phishing panels on bulletproof hosting falls out of the pivot graph, next to a recovered crypto-stealer.
How to detect VPN and proxy users at signup
A practical guide to spotting VPN, proxy, Tor and datacenter traffic at login and signup, and what to do with it.
CVE-2024-4577 explained: the PHP-CGI RCE attackers keep spraying
What CVE-2024-4577 is, why it matters, how attackers exploit it in the wild, and how to tell if you are being targeted.
Why honeypots catch attacks with zero false positives
Deception flips the security signal-to-noise problem. Any interaction with a decoy is hostile, so there is nothing to triage away.
How to detect Tor exit nodes at login
Tor anonymises the source of a login. Here is how to detect exit nodes reliably and decide what to do about them.
A GreyNoise alternative built on your own decoys
Internet-noise feeds tell you an IP is scanning the internet. First-party decoys tell you how you are being attacked, and let you hunt back.