beelzebub

I run a honeypot infrastructure to study attack patterns. Last week, one of my Docker honeypots caught something interesting: an automated campaign exploiting CVE-2025-29927/CVE-2025-66478 in Next.js. What made this case unusual was the attackers' operational security—or lack thereof. Their C2 server exposed a /stats endpoint with no authentication, giving me real-time visibility into their campaign metrics: 91,505 IPs scanned, 59,128 successful compromises, 64.6% success rate. The writeup covers: Full attack chain (reconnaissance → exploitation → data exfiltration → persistence) C2 API architecture (4 endpoints, all unauthenticated) Data exfiltration pipeline (.env files, SSH keys, cloud credentials) Persistence mechanisms (systemd services, FRP tunnels, GOST proxies) Detection signatures (Suricata/Snort rules, YARA) The attackers are ha

Through our honeypot (https://github.com/mariocandela/beelzebub), I’ve identified a major evolution of the RondoDox botnet, first reported by FortiGuard Labs in 2024. The newly discovered RondoDox v2 shows a dramatic leap in sophistication and scale: +650% increase in exploit vectors (75+ CVEs observed) New C&C infrastructure on compromised residential IPs 16 architecture variants Open attacker signature: bang2013@atomicmail[.]io Targets expanded from DVRs and routers to enterprise systems The full report includes: - In-depth technical analysis (dropper, ELF binaries, XOR decoding) - Full IOC list - YARA and Snort/Suricata detection rules - Discovery timeline and attribution insights

We’re open-sourcing a simple way to add “canary tools” to AI agents via MCP honeypots. These are functions your agent should never call during normal operation. If a canary is invoked, you get a high-fidelity signal of prompt-injection, tool hijacking, or lateralization—no heuristics, no extra model calls. What it is: - Go framework exposing decoy tools over MCP that look legitimate (names/params/descriptions), return safe dummy output, and emit telemetry when invoked. - Runs alongside your real tools; ship events to stdout/webhook or your pipeline (Prometheus/Grafana, ELK). Why it helps: Agent logs show what happened; canaries mark what must not happen. A single tripwire is an immediate, low-noise indicator of compromise. Real-world relevance (Nx attack): Recent reporting on the Nx npm supply-chain incident (“s1ngularity”) shows maliciou

Hello everyone I wanted to share a project I've been working on that I think you'll find really interesting. It's called Beelzebub, an open-source honeypot framework that uses LLMs to create incredibly realistic and dynamic deception environments. By integrating LLMs, it can mimic entire operating systems and interact with attackers in a super convincing way. Imagine an SSH honeypot where the LLM provides plausible responses to commands, even though nothing is actually executed on a real system. The goal is to keep attackers engaged for as long as possible, diverting them from your real systems and collecting valuable, real-world data on their tactics, techniques, and procedures. We've even had success capturing real threat actors with it! I'd love for you to try it out, give it a star on GitHub, and maybe even contribute! Your feedback,

Hello everyone I wanted to share a project I've been working on that I think you'll find really interesting. It's called Beelzebub, an open-source honeypot framework that uses LLMs to create incredibly realistic and dynamic deception environments. By integrating LLMs, it can mimic entire operating systems and interact with attackers in a super convincing way. Imagine an SSH honeypot where the LLM provides plausible responses to commands, even though nothing is actually executed on a real system. The goal is to keep attackers engaged for as long as possible, diverting them from your real systems and collecting valuable, real-world data on their tactics, techniques, and procedures. We've even had success capturing real threat actors with it! I'd love for you to try it out, give it a star on GitHub, and maybe even contribute! Your feedback,

GitHub:https://github.com/mariocandela/beelzebub Research using beelzebub on public network: - https://beelzebub-honeypot.com/blog/how-cybercriminals-make-... - https://beelzebub-honeypot.com/blog/ssh-llm-honeypot-caught-...

Hello everyone I wanted to share a project I've been working on that I think you'll find really interesting. It's called Beelzebub, an open-source honeypot framework that uses LLMs to create incredibly realistic and dynamic deception environments. By integrating LLMs, it can mimic entire operating systems and interact with attackers in a super convincing way. Imagine an SSH honeypot where the LLM provides plausible responses to commands, even though nothing is actually executed on a real system. The goal is to keep attackers engaged for as long as possible, diverting them from your real systems and collecting valuable, real-world data on their tactics, techniques, and procedures. We've even had success capturing real threat actors with it! I'd love for you to try it out, give it a star on GitHub, and maybe even contribute! Your feedback,