mariocandela

I run a honeypot infrastructure to study attack patterns. Last week, one of my Docker honeypots caught something interesting: an automated campaign exploiting CVE-2025-29927/CVE-2025-66478 in Next.js.

What made this case unusual was the attackers' operational security—or lack thereof. Their C2 server exposed a /stats endpoint with no authentication, giving me real-time visibility into their campaign metrics: 91,505 IPs scanned, 59,128 successful compromises, 64.6% success rate. The writeup covers:

Full attack chain (reconnaissance → exploitation → data exfiltration → persistence) C2 API architecture (4 endpoints, all unauthenticated) Data exfiltration pipeline (.env files, SSH keys, cloud credentials) Persistence mechanisms (systemd services, FRP tunnels, GOST proxies) Detection signatures (Suricata/Snort rules, YARA)

The attackers are harvesting credentials at industrial scale—roughly 300K credential sets per day at current pace. Their targeting appears indiscriminate (mode: random_ips), which suggests they're going for volume over precision. For those interested in the tooling: the honeypot that captured this is Beelzebub [0], an open-source project I've been maintaining for 3+ years. It uses LLMs to generate dynamic responses that keep attackers engaged longer, which helps capture more complete attack chains like this one. Happy to discuss the technical details, methodology, or anything about running deception infrastructure. [0] https://github.com/mariocandela/beelzebub

So I run research honeypots (Beelzebub) and caught something wild this week.

A threat actor is running a massive credential theft campaign against Next.js servers - I'm calling it "Operation PCPcat". The kicker? Their C2 infrastructure is completely exposed. Like, /stats endpoint showing live campaign metrics exposed. Amateur hour OpSec, but the operation itself is industrial-scale.

What they're doing:

Chaining CVE-2025-29927 + CVE-2025-66478 for RCE

Harvesting .env files, SSH keys, AWS creds, Docker configs, Git credentials

Dropping persistent backdoors

Everything flows through their open C2 - task queues, exfil data, the works

Happy to discuss in comments.

Through our honeypot (https://github.com/mariocandela/beelzebub), I’ve identified a major evolution of the RondoDox botnet, first reported by FortiGuard Labs in 2024.

The newly discovered RondoDox v2 shows a dramatic leap in sophistication and scale:

+650% increase in exploit vectors (75+ CVEs observed)

New C&C infrastructure on compromised residential IPs

16 architecture variants

Open attacker signature: bang2013@atomicmail[.]io

Targets expanded from DVRs and routers to enterprise systems

The full report includes:

- In-depth technical analysis (dropper, ELF binaries, XOR decoding)

- Full IOC list

- YARA and Snort/Suricata detection rules

- Discovery timeline and attribution insights

I've just published my analysis on RondoDox v2, and the numbers speak for themselves: +650% exploit vectors compared to v1 documented by FortiGuard Labs.

Key Findings: - 15+ exploitation vectors (from 2 CVEs to enterprise-grade attacks) - C&C on compromised residential IP (multiple AWS EC2) - 16 architectures supported with XOR obfuscation (key: 0x21) - Open attribution: [email protected]

What concerns me: The jump from consumer DVR/routers to enterprise targets demonstrates an aggressive expansion strategy. We're no longer talking about a "simple" DDoS botnet.

IOCs and detection rules: YARA, Snort/Suricata and complete IOC list available in the full post.

Awesome! Thank you for sharing

Yep I agree, or a "senior" malware vibe coder xD

thank you

thank you

Sorry the link is: https://beelzebub.ai/blog/how-advanced-malware-self-update-s...

Hi HN,

I built Beelzebub, an open-source framework for honeypots designed for those who want to safely collect and analyze attacks without sacrificing realism. TL;DR: low-code (YAML), multi-protocol (SSH/HTTP/TCP/MCP), LLM integration to simulate realistic system behavior while keeping a secure low-interaction architecture.

Why I built it ?

- High-interaction honeypots are realistic but risky and expensive to maintain.

- Low-interaction honeypots are safe but attackers can spot them easily. Beelzebub tries to strike a balance: it leverages LLMs to generate convincing, dynamic responses while running on a fully controlled backend.

What it offers today:

- Low-code configuration via YAML, modular and easily extensible.

- LLM integration (OpenAI or local models) to create honeypots that talk back like real systems.

- Multi-protocol support: SSH, HTTP, TCP, and MCP (useful for catching prompt-injection attempts against LLM agents).

- Ready for production with Docker, Kubernetes, and integrations with observability stacks (Prometheus, ELK).

Why give it a star and an upvote:

- An upvote here helps more defenders and researchers discover it.

- A star on GitHub helps the project grow (visibility, contributors, integrations). If you try it and like it, please the repo and share your feedback!

Thanks for reading, if you’d like me to post a case study or benchmark showing how it performs against real-world attacks, let me know!

I'm sorry about Coderabbit's reputation, it's really a great project!

Hey folks

Imagine your AI agent getting hijacked by a prompt-injection attack without you knowing. I'm the founder and maintainer of Beelzebub, an open-source project that hides "honeypot" functions inside your agent using MCP. If the model calls them... BEEP! You get an instant compromise alert, with detailed logs for quick investigations.

Zero false positives: Only real calls trigger the alarm.

Plug-and-play telemetry for tools like Grafana or ELK Stack.

Guard-rails fine-tuning: Every real attack strengthens the guard-rails with human input.

Read the full write-up → https://beelzebub-honeypot.com/blog/securing-ai-agents-with-...

What do you think? Is it a smart defense against AI attacks, or just flashy theater? Share feedback, improvement ideas, or memes.

I'm all ears!

Hello everyone

I wanted to share a project I've been working on that I think you'll find really interesting. It's called Beelzebub, an open-source honeypot framework that uses LLMs to create incredibly realistic and dynamic deception environments.

By integrating LLMs, it can mimic entire operating systems and interact with attackers in a super convincing way. Imagine an SSH honeypot where the LLM provides plausible responses to commands, even though nothing is actually executed on a real system.

The goal is to keep attackers engaged for as long as possible, diverting them from your real systems and collecting valuable, real-world data on their tactics, techniques, and procedures. We've even had success capturing real threat actors with it!

I'd love for you to try it out, give it a star on GitHub, and maybe even contribute! Your feedback, especially from an LLM-centric perspective, would be incredibly valuable as we continue to develop it.

Let me know what you think in the comments! Do you have ideas for new LLM-powered honeypot features?

Thanks for your time!

Hello everyone I wanted to share a project I've been working on that I think you'll find really interesting. It's called Beelzebub, an open-source honeypot framework that uses LLMs to create incredibly realistic and dynamic deception environments.

By integrating LLMs, it can mimic entire operating systems and interact with attackers in a super convincing way. Imagine an SSH honeypot where the LLM provides plausible responses to commands, even though nothing is actually executed on a real system.

The goal is to keep attackers engaged for as long as possible, diverting them from your real systems and collecting valuable, real-world data on their tactics, techniques, and procedures. We've even had success capturing real threat actors with it!

I'd love for you to try it out, give it a star on GitHub, and maybe even contribute! Your feedback, especially from an LLM-centric perspective, would be incredibly valuable as we continue to develop it.

You can find the project here: https://github.com/mariocandela/beelzebub

Let me know what you think in the comments! Do you have ideas for new LLM-powered honeypot features?

Thanks for your time!

GitHub:https://github.com/mariocandela/beelzebub

Research using beelzebub on public network: - https://beelzebub-honeypot.com/blog/how-cybercriminals-make-...

- https://beelzebub-honeypot.com/blog/ssh-llm-honeypot-caught-...

A curated list of awesome Steam Deck software, resources and more.

Hello,

In this use case, OpenAI GPT-3 act as linux terminal

How to build a highly effective Honeypot with Beelzebub and ChatGPT

Public template Java Spring Microservice with OpenAPI and MongoDB