Hot take: your detection stack is lying to you. Not because it's broken. Because it can only catch what it…
PETER D. — Cybersecurity / Threat Researcher / Breaker of All Things / Discovered a 563-Node Global Botnet
Hot take: your detection stack is lying to you.
Not because it's broken. Because it can only catch what it already knows.
I've spent the last year building a deception platform from scratch — honeypots, canary infrastructure, darknet presence, actor attribution chains. No budget. No team. Just a researcher who got tired of watching the same commodity noise get the same commodity response.
Detection is reactive. Deception is a trap.
The actors that scare me aren't the ones triggering your SIEM. They're the ones with AbuseIPDB scores of zero, using valid credentials, moving like a sysadmin. They pass every rule you wrote. Every signature. Every threshold. And nobody notices.
We found a 563-node global botnet — compromised government infrastructure, BEC monetization layer, 40+ countries — not from a single IP reputation hit. From SSH client fingerprints nobody was correlating. One field. That's it.
Lessons learned the hard way:
1. The unknown is where the value is. If it's already in a threat feed, someone else found it first. Hunt what nobody's looking for.
2. Volume is camouflage. 500+ nodes means no single IP crosses your alert threshold. The campaign is invisible at the IP level. You need behavioural correlation across time.
3. Responsible disclosure is lonely work. Filed with CISA, CCCS, ASD, NCSC, FBI. One agency responded same day. The rest — silence. The nodes are still running 48 days later.
4. Deception catches what detection misses. A canary file on a darknet forum that fires months later — that's attribution no EDR will ever give you.
5. Nobody wants to hear it until the business is on fire. I've sat in rooms where the conversation was about user feelings and exec optics while an undetected actor was already inside. I don't care about your users' feelings. I care about your business surviving. Users don't matter if there's no business left.
I'm not selling anything. I bleed blue. Defensive CTI, responsible disclosure, threat intelligence for protection — that's the work. Not breaking things for sport.
The industry keeps confusing offensive and defensive. Keeps sidelining the people who actually find the unknown threats. Keeps rewarding the checkbox and ignoring the hunter.
Hunt the unknown. That's where the real threats live.
#ThreatIntelligence #HoneypotResearch #DFIR #CyberSecurity #ThreatHunting #CTI
5 reactions · 8 comments
Topics: #threathunting, #dfir, #threatintelligence, #honeypotresearch, #cybersecurity, #cti
Comments
Trevor R.: Totally agree with you but I don’t think it’s an either or scenario. We still need engineers building out and applying detections based on what is known since the patch game is so weak in many places and the attack will work for a long time. Attackers don’t give up using a tool once they see we know about it. IMO, we should be doing both. Proactive and reactive.
PETER D.: Trevor Renner I love the discussion! You're not wrong — and I'd be a fool to say detection doesn't matter. But detection has to be EARNED. Default configs, untuned rules, every alert treated the same — that's not detection, that's noise. And a risk register with no action plan isn't security, it's a liability document. Detection works when it's worked on — tuned, understood, maintained like patchi
Trevor R.: Pete Desfigies absolutely. Using defaults just burns out analysts.
Everett D.: Show us what you're talking about. Text is nice but everyone is saying these things and with the advent of artificial intelligence, security professionals are whipping out these cutting-edge tools at breakneck speeds. Link me to this tool please!
PETER D.: Since you asked. Last 7 days. Real environment. Novel vs Known panel — majority of what hits us is novel, not in any feed. HASSH fingerprint correlation in the bottom right caught a 563-node global botnet. To be clear — I'm not here to sell anything. This is something I've been building for myself, out of frustration with the gaps I kept seeing in every engagement. Months of iteration, a lot of la