Insights and Research

Practical notes on AI and retail technology, and write-ups of the attacks our honeypots capture

Featured Articles

All Articles

Behind the 404s: what an IoT botnet's loader was hiding
Threat Research

Behind the 404s: what an IoT botnet's loader was hiding

A botnet server answered our honeypot with error pages for a day. Then it served its loader. What the bot did next, and why the loader looked familiar.

Threat ResearchCybersecurityMirai
KSI Digital
6 min
A Mirai botnet that hides its servers in plain DNS
Threat Research

A Mirai botnet that hides its servers in plain DNS

A Mirai kit on our honeypot keeps its server addresses in DNS, XOR-encoded. Sandboxes miss it. How we decoded it offline and confirmed both servers.

Threat ResearchCybersecurityMirai
KSI Digital
6 min
A Linux backdoor that takes its orders from a Telegram bot
Threat Research

A Linux backdoor that takes its orders from a Telegram bot

A Telnet installer on our honeypot staged a Go backdoor built for eight CPU architectures. It reads its server address from a Telegram chat. How to spot it.

Threat ResearchCybersecurityBackdoor
KSI Digital
6 min
PerlBot Dred: finding the missing C2 of an IRC DDoS bot
Threat Research

PerlBot Dred: finding the missing C2 of an IRC DDoS bot

A Perl IRC flood bot landed in our SSH honeypot. The sample was known, but its IRC control server was on no public feed. We found it and reported it.

Threat ResearchCybersecurityBotnet
KSI Digital
5 min
RedTail: one reused SSH key links two delivery routes
Threat Research

RedTail: one reused SSH key links two delivery routes

RedTail, a Linux cryptomining botnet, hit our WordPress bait and our SSH honeypot a day apart. One embedded SSH key ties both routes to one operator.

Threat ResearchCybersecurityBotnet
KSI Digital
5 min
XorDDoS: the 15th C2 domain the public list was missing
Threat Research

XorDDoS: the 15th C2 domain the public list was missing

A XorDDoS sample from our SSH honeypot looks up 15 command-and-control domains. Fourteen were already on ThreatFox. We reported the one that was not.

Threat ResearchCybersecurityBotnet
KSI Digital
5 min
AI in Retail: From Buzzword to Business Essential in 2023
Artificial Intelligence

AI in Retail: From Buzzword to Business Essential in 2023

AI has moved from experimental to essential. How Indonesian retailers use AI for demand forecasting, personalization, and pricing optimization.

AIMachine LearningRetail Innovation
KSI Digital
10 min