Pablo Seoane · Pentester & Security Researcher

Weekly Threat Intelligence Report — T-Pot Honeypot (Aug 2–9, 2026)

Mon, 10 Aug 2026 00:00:00 +0000

Fifth weekly report from the T-Pot honeypot, period August 2–9, 2026. Volume rises to ~2,814,000 events. The residential ConPot botnet reaches its third consecutive week with now-global reach (NTT DOCOMO, Wind Tre, Bouygues Telecom joining the already known Comcast, AT&T, Charter). RDPHoneypot nearly matches its historical maximum driven by a new actor: Datacamp Limited. Cowrie sees a cryptocurrency credential wave and a new malware family named iran for the first time. And the Adbhoney campaign tracked since the first report — 110→228→287→102 downloads — closes definitively.

Period analyzed: August 2–9, 2026 Source: T-Pot (multi-honeypot + ELK Stack) — publicly internet-exposed instance Classification: Portfolio use / TLP:CLEAR Previous reports: Jul 7–11 · Jul 12–18 · Jul 19–25 · Jul 26–Aug 2

Weekly Threat Intelligence Report — T-Pot Honeypot (Jul 26 – Aug 2, 2026)

Mon, 03 Aug 2026 00:00:00 +0000

Fourth weekly report from the T-Pot honeypot, period July 26 – August 2, 2026. With four weeks of accumulated data, patterns stop being anecdotal and become trends: the residential SNMP botnet on ConPot is confirmed for a second consecutive week (Comcast, AT&T, Verizon, Charter with not a single VPS in the top 10), IP 91.199.133.133 catalogued in ThreatFox as a Mirai Katana C2 reappears serving payloads in Cowrie, Redtail adds RISC-V architecture, and the brute force campaign against Turkish ERP software in Dionaea is confirmed with a second week of consistent data.

Period analyzed: July 26 – August 2, 2026 Source: T-Pot (multi-honeypot + ELK Stack) — publicly internet-exposed instance Classification: Portfolio use / TLP:CLEAR Previous reports: Jul 7–11 · Jul 12–18 · Jul 19–25

Weekly Threat Intelligence Report — T-Pot Honeypot (Jul 19–25, 2026)

Sun, 26 Jul 2026 00:00:00 +0000

Third weekly report from the T-Pot honeypot, period July 19–25, 2026. Total volume drops to ~1,820,000 events (half of last week), but the relevant data isn’t the total — it’s the composition: ConPot spikes x27 with origin in residential ISPs (Comcast, AT&T, Virgin Media, Free SAS) — the signature of a domestic router botnet attacking SNMP, a qualitatively different actor from anything seen so far. Meanwhile, Flyservers S.A. collapses on RDP, the same Adbhoney payload is in its third week of growth, and Dionaea detects brute force specifically targeting Turkish accounting software over MSSQL.

Period analyzed: July 19–25, 2026 Source: T-Pot (multi-honeypot + ELK Stack) — publicly internet-exposed instance Classification: Portfolio use / TLP:CLEAR Previous reports: Jul 7–11 · Jul 12–18

Weekly Threat Intelligence Report — T-Pot Honeypot (Jul 12–18, 2026)

Sun, 19 Jul 2026 00:00:00 +0000

Second weekly report from the T-Pot honeypot, period July 12–18, 2026. Total volume spikes to ~3,213,000 events (x3.2 compared to the previous week), but growth is not uniform: it’s almost entirely explained by two sensors — RDPHoneypot x20.7 with Flyservers S.A. as the dominant source, and Sentrypeer x9.3 with a target shift toward UK numbering. Recurring actors are confirmed across multiple sensors, and a new loader compiled for unusual architectures (loongarch64, m68k) is identified.

Period analyzed: July 12–18, 2026 Source: T-Pot (multi-honeypot + ELK Stack) — publicly internet-exposed instance Classification: Portfolio use / TLP:CLEAR Previous report: week of July 7–11, 2026

HTB Walkthrough: GoodGames

Thu, 16 Jul 2026 00:00:00 +0000

Walkthrough of GoodGames on Hack The Box. Easy difficulty machine running Linux. The chain starts with a SQL Injection on the login form that allows both authentication bypass and database dumping. A cracked MD5 hash grants access to an internal Flask admin panel where the username field is vulnerable to SSTI with Jinja2, giving RCE as root inside a Docker container. Exiting to the real host combines credential reuse via SSH with a classic container escape: the user’s home directory is mounted as a volume, and without user namespace remapping the container’s root can plant a SUID bit on bash that is effective on the host.

HackTheBox Linux Easy

HTB Walkthrough: Sau

Mon, 13 Jul 2026 00:00:00 +0000

Walkthrough of Sau on Hack The Box. Easy difficulty machine running Linux. An SSRF in Request Baskets v1.2.1 (CVE-2023-27163) lets us pivot to Maltrail v0.53, a malicious traffic detection service accessible only from localhost. Maltrail has an unauthenticated RCE in its login endpoint that gives us a shell as puma. Escalation to root exploits CVE-2023-26604: systemctl status run via sudo invokes less as a pager inheriting root privileges, which we escape with !/bin/bash.

HackTheBox Linux Easy

Weekly Threat Intelligence Report — T-Pot Honeypot (Jul 7–11, 2026)

Sun, 12 Jul 2026 00:00:00 +0000

First weekly report from the T-Pot honeypot. During the week of July 7–11, 2026, approximately 1,011,000 attack events were recorded across 10 active sensors. Top findings: multi-architecture Redtail malware captured in Cowrie, a complete Android infection chain in Adbhoney (Rebirth → UFO miner → Trinity botnet), active scanning of exposed AI services (Ollama, Gradio, Streamlit), and probing of the IEC-104 protocol used in European electrical substations.

Period analyzed: July 7–11, 2026 Source: T-Pot (multi-honeypot + ELK Stack) — publicly internet-exposed instance Classification: Portfolio use / TLP:CLEAR

I Captured a Rebirth Botnet Sample in My Honeypot: Here's What I Pieced Together

Thu, 09 Jul 2026 00:00:00 +0000

While reviewing traffic from my T-Pot honeypot I found something more interesting than the typical SSH brute-force attempt: a complete infection chain, captured live, that turned out to be a variant of the Rebirth botnet, from the Mirai/Gafgyt family. This post covers exactly what I captured, how I pieced it together to identify it, and what the security community says about this family — making clear throughout what is my direct observation and what is third-party research.

What I Captured (this part is mine)
#

The honeypot that recorded this was Adbhoney, one of T-Pot’s sensors that simulates the ADB (Android Debug Bridge) protocol — Android’s remote debugging system, which when exposed to the internet without authentication is a trivial entry point for automated bots.

I Set Up a Honeypot and I'm Going to Report What I See Every Week

Wed, 08 Jul 2026 00:00:00 +0000

I’m going to intentionally expose a server to the internet so it gets attacked — and then write about it here, every week. No simulations or lab data: real malicious traffic, from the real internet, against a server that does nothing but wait for someone to try to break in.

What This Is
#

This blog documents what a honeypot — a decoy system designed to look vulnerable and attract attacks — detects in real time, week by week.

HTB Walkthrough: CCTV

Mon, 22 Jun 2026 00:00:00 +0000

Walkthrough of CCTV on Hack The Box. Medium difficulty machine running Linux. ZoneMinder exposed with default credentials is vulnerable to CVE-2024-51482, a blind SQL Injection that lets us extract bcrypt hashes and gain SSH access. Once inside, motionEye runs as root with its API signing key exposed in a readable configuration file — a combination that exploits CVE-2025-60787 to inject a command into a capture filename and set SUID on /bin/bash.

HackTheBox Linux Medium

HTB Walkthrough: Jerry

Sat, 13 Jun 2026 00:00:00 +0000

Walkthrough of Jerry on Hack The Box. Easy difficulty machine running Windows Server 2012 R2. Apache Tomcat 7.0.88 exposed with default credentials in the Manager. We use them to deploy a malicious WAR that delivers remote code execution directly as NT AUTHORITY\SYSTEM — no privilege escalation needed.

HackTheBox Windows Easy

HTB Walkthrough: NetMon

Sat, 13 Jun 2026 00:00:00 +0000

Walkthrough of NetMon on Hack The Box. Easy difficulty machine running Windows Server 2016. Anonymous FTP exposes the Windows root filesystem, allowing us to read a PRTG configuration backup with cleartext credentials. With admin panel access we exploit CVE-2018-9276, a command injection in PRTG’s notification system that executes code as NT AUTHORITY\SYSTEM.

HackTheBox Windows Easy

HTB Walkthrough: Devel

Fri, 12 Jun 2026 00:00:00 +0000

Walkthrough of Devel on Hack The Box. Easy difficulty machine running Windows 7 x86. Anonymous FTP shares the root directory with the IIS webroot, letting us upload an ASPX webshell and gain remote code execution. We escalate to NT AUTHORITY\SYSTEM by exploiting MS10-015 (KiTrap0D), a flaw in the Windows x86 kernel.

HackTheBox Windows Easy

HTB Walkthrough: Facts

Tue, 09 Jun 2026 00:00:00 +0000

Walkthrough of Facts on Hack The Box. Easy difficulty machine running Linux (Ubuntu 25.04). We exploit a Mass Assignment in Camaleon CMS to escalate our role to administrator without knowing any password, abuse a Path Traversal in the AWS uploader to read system files and extract an encrypted SSH key, crack the passphrase with John the Ripper, and escalate to root by abusing sudo NOPASSWD permissions over facter with a malicious custom Ruby fact.

HackTheBox Linux Easy

HTB Walkthrough: Kobold

Mon, 01 Jun 2026 00:00:00 +0000

Walkthrough of Kobold on Hack The Box. Easy difficulty machine running Linux. Exploitation goes through CVE-2026-23744, an unauthenticated RCE in MCPJam Inspector 1.4.2: the /api/mcp/connect endpoint passes the command field directly to child_process.spawn() without any validation. Privilege escalation to root exploits the fact that user ben belongs to the operator group, which has permissions over the Docker socket — accessible via sg docker without needing to log out. With access to the Docker daemon, we mount the host filesystem and get root with chroot.

HackTheBox Linux Easy

HTB Walkthrough: Cap

Tue, 14 Apr 2026 00:00:00 +0000

Walkthrough of Cap on Hack The Box. Easy difficulty machine running Linux (Ubuntu 20.04 LTS). We exploit an IDOR on a network capture download endpoint to obtain cleartext FTP credentials, gain SSH access by reusing the password, and escalate to root by abusing the cap_setuid capability assigned to the Python 3.8 binary.

HackTheBox Linux Easy

HTB Walkthrough: Principal

Tue, 14 Apr 2026 00:00:00 +0000

Step-by-step walkthrough of Principal on Hack The Box. Medium difficulty machine running Linux (Ubuntu 24.04 LTS). We chain a JWT authentication bypass via CVE-2026-29000, credential extraction from an admin dashboard, and privilege escalation to root by forging an SSH certificate with the server’s private CA key.

HackTheBox Linux Medium

HTB Walkthrough: DevArea

Sun, 29 Mar 2026 00:00:00 +0000

Walkthrough of DevArea on Hack The Box. Medium difficulty machine running Linux Ubuntu. A Java SOAP service downloaded via anonymous FTP turns out to be Apache CXF 3.2.14, vulnerable to CVE-2022-46364 (XOP Include LFI). We use the flaw to read Hoverfly credentials from the systemd configuration and get RCE through the Middleware system. Root escalation exploits PATH Hijacking in a script executed with sudo.

HackTheBox Linux Medium

HTB Walkthrough: Blue

Sat, 28 Mar 2026 00:00:00 +0000

Walkthrough of Blue on Hack The Box. Easy difficulty machine running Windows 7 SP1. The vector is the infamous EternalBlue exploit (MS17-010), a vulnerability in SMBv1 that compromises the Windows kernel and delivers direct access as NT AUTHORITY\SYSTEM with no credentials required.

HackTheBox Windows Easy

HTB Walkthrough: Lame

Sat, 28 Mar 2026 00:00:00 +0000

Walkthrough of Lame, one of the most classic machines on Hack The Box. Easy difficulty running Linux. The main vector is a remote code execution vulnerability in Samba 3.0.20 (CVE-2007-2447) that, through the way Samba processes usernames, executes arbitrary shell commands with the service’s privileges — in this case, root.

HackTheBox Linux Easy

HTB Walkthrough: WingData

Sat, 28 Mar 2026 00:00:00 +0000

Walkthrough of WingData on Hack The Box. Easy difficulty machine running Linux. RCE via CVE-2025-47812, a null-byte authentication bypass in Wing FTP Server that grants access to the admin panel and remote code execution. After cracking user credentials with hashcat (SHA-256 with salt), we escalate to root by exploiting a PATH_MAX bypass in Python’s tarfile module executed with sudo privileges.

HackTheBox Linux Easy

About Me

Tue, 24 Mar 2026 00:00:00 +0000

Based in Sada, Galicia. My path in technology started from the ground up — networks, systems, and programming. Today I channel all of that foundation into what I’m truly passionate about: offensive cybersecurity.

🎯 Professional Profile
#

Passionate about Ethical Hacking and Pentesting. I studied Robotics Engineering, but it was along that path that I discovered offensive cybersecurity and got hooked — so I decided to orient my entire career toward that field. I’m currently working toward the CPTS (Certified Penetration Testing Specialist) certification from Hack The Box.

Auditoría Interna - Infraestructura CorpX

Tue, 24 Mar 2026 00:00:00 +0000

Documento descriptivo de los hallazgos tras la auditoría de caja negra sobre la infraestructura perimetral de CorpX.

📋 Resumen Ejecutivo
#

Durante los días [Fechas], se llevó a cabo una auditoría de seguridad (Pentest) sobre la infraestructura de la empresa CorpX. El objetivo principal fue identificar, explotar y documentar vulnerabilidades en los sistemas expuestos a Internet.

Pablo Seoane · Pentester & Security Researcher

Weekly Threat Intelligence Report — T-Pot Honeypot (Aug 2–9, 2026)

Weekly Threat Intelligence Report — T-Pot Honeypot (Jul 26 – Aug 2, 2026)

Weekly Threat Intelligence Report — T-Pot Honeypot (Jul 19–25, 2026)

Weekly Threat Intelligence Report — T-Pot Honeypot (Jul 12–18, 2026)

HTB Walkthrough: GoodGames

HTB Walkthrough: Sau

Weekly Threat Intelligence Report — T-Pot Honeypot (Jul 7–11, 2026)

I Captured a Rebirth Botnet Sample in My Honeypot: Here's What I Pieced Together

What I Captured (this part is mine) #

I Set Up a Honeypot and I'm Going to Report What I See Every Week

What This Is #

HTB Walkthrough: CCTV

HTB Walkthrough: Jerry

HTB Walkthrough: NetMon

HTB Walkthrough: Devel

HTB Walkthrough: Facts

HTB Walkthrough: Kobold

HTB Walkthrough: Cap

HTB Walkthrough: Principal

HTB Walkthrough: DevArea

HTB Walkthrough: Blue

HTB Walkthrough: Lame

HTB Walkthrough: WingData

About Me

🎯 Professional Profile #

Auditoría Interna - Infraestructura CorpX

📋 Resumen Ejecutivo #

What I Captured (this part is mine)
#

What This Is
#

🎯 Professional Profile
#

📋 Resumen Ejecutivo
#