D. Blanko

Clustered all 269 by Jaccard string similarity. Result: one connected component. One population, one version, zero mutations. The same WannaCry binary from 2017, running unmodified on machines that apparently nobody has patched or rebooted since before some people in this field started their careers.

All 269 samples share the same markers: mssecsvr.exe, tasksche.exe, launcher.dll, PE32 DLL at ~5.2 MB, Shannon entropy 6.8–7.4, and a PE compilation timestamp of May 11, 2017. The kill-switch domain still resolves. None of them executed.

269 delivery attempts in 72 hours. Different IPs, different sessions, different countries — but the same binary logic every time. MS17-010 is 9 years old. The patch has existed since March 2017. EternalBlue remains one of the most consistently observed exploitation patterns in honeypot data in 2026.

Detection: hunter_v1 for static PE analysis (IoC extraction, entropy, timestamp), hunter_v2 for Jaccard clustering and graph construction. Full report + both scripts: github.com/dblanko/honeypot-analysis Direct report: github.com/dblanko/honeypot-analysis/blob/main/dionaea/reports/wannacry_2026.md

This came out of a broader lab: Cowrie + OpenCanary + Dionaea + Telnethoney + Suricata running simultaneously on one VPS. Dionaea is the only sensor in that stack that captures full binaries — without it, 269 WannaCry delivery attempts would have been logged as "SMB connection, accept" and nothing more.

Also published on Medium: https://medium.com/@dblanko.security/a-wannacry-cluster-from-2017-still-active-in-2026-d02c1a1900e3

Redis: 55,634 events, 89% from one IP (Neterra Ltd, Bulgaria). Every password appeared exactly 748 times. 49,513 ÷ 748 = 66.2 passwords in the wordlist — the fractional result means the 67th cycle was interrupted mid-run. The wordlist included foobared — the example password from Redis documentation. This tool was built specifically for Redis.

Service breakdown: RDP: 485,752 events (89.1%) Redis: 55,634 events (10.2%) Everything else: <1% RDP dominates by volume. But the Redis data is analytically more interesting.

RDP top usernames: test (135,366), hello (33,268), 45 (29,024). hello fingerprints FreeRDP-based scanning tools. 45 — the first octets of the honeypot IP. The scanner derives login candidates from the target address itself. 50.8% of RDP events contained no username at all. Pure port scanning.

VNC: 60 events, 2 IPs. One scanner ran its entire wordlist in 2.5 seconds — 19:32:40 to 19:32:43 UTC. 563 IPs appeared exactly once. 14 IPs generated 10,000+ events each. Full dataset and analysis scripts: github.com/dblanko/honeypot-analysis Full post: sshlab.eu/blog/544908-events-in-20-days-opencanary-multi-service-honeypot-data-74cfe747 #honeypot #infosec #threatintelligence #redis #rdp

Six IPs from 185.156.73.0/24 generated 196,000+ events — 40% of all RDP traffic. Peak: every Sunday at 19:00 UTC. Events from different nodes interleave with millisecond precision — centralized scheduling or C2. One firewall rule blocking /24 eliminates 40% of RDP traffic.

Most executed command (3,499 times): uname -s -v -n -r -m — system fingerprinting. Second and third most common: cd ~; chattr -ia .ssh; lockr -ia .ssh SSH key injection. Remove immutable flags, wipe authorized_keys, replace with attacker's key. 2,587 sessions. The dominant post-login action in this dataset.

Most common successful login password: 3245gs5662d34 — 2,683 authentications. This is not a generic weak password. It is specific to SSH brute-force toolkits running coordinated credential-stuffing operations across millions of targets simultaneously. root — 13,480 successful logins by username. No other username came close.

29 unique payload SHA256 hashes captured. One campaign delivered the same binary from three different source IPs — coordinated infrastructure, not independent actors. Full report + analysis scripts + corporate honeyfs setup: github.com/dblanko/honeypot-analysis Full post: sshlab.eu/blog/what-52000-ssh-sessions-look-like-cowrie-honeypot-data-b4115c78 #honeypot #cowrie #infosec #ssh #threatintelligence

73% of sessions lasted 1–5 seconds. Automated tools, not humans. The exception: one SFTP session uploading redtail.arm8, redtail.i686, redtail.x86_64, and setup.sh — 97 commands. One human operator, identifiable by behaviour, among 52,000 automated connections. Peak attack hour: 05:00 UTC — consistent across the full dataset.

HASSH fingerprints identified three distinct families: 16443846 — Go-scanner / SSH-2.0-Go (253 sessions) 03a80b21 — mdrfckr / libssh_0.11.1 (77 sessions): SSH backdoor a7a87fbe — Gafgyt loader (19 sessions): DDoS botnet mdrfckr is identifiable by three simultaneous markers: HASSH fingerprint + chattr -ia .ssh + key injection. Same tool, 77 different source IPs.

Also published on Medium: https://medium.com/@dblanko.security/what-52-000-ssh-sessions-look-like-cowrie-honeypot-data-aac6d4a1fe65

Infrastructure breakdown: VPN/hosting: 128,592 events Residential/unknown: 104,551 Tor: 1,382 One anomaly in the credential data: a 169-character binary string containing admin.$cmd — a MongoDB injection attempt routed through a Telnet connection. Not a router scanner. Something else entirely.

Top countries by event volume: 🇸🇬 Singapore: 70,625 🇵🇰 Pakistan: 33,439 🇺🇸 United States: 24,875 🇨🇳 China: 20,252 🇧🇷 Brazil: 17,146 Singapore at the top reflects VPS infrastructure concentration (DigitalOcean, Vultr, Linode) — not Singaporean actors. 49% of all events from identifiable hosting infrastructure. 40% from residential IPs — compromised home routers that are themselves part of botnets.

The single most executed command — 35,783 times: echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A" Decoded: auth_ok IoT botnet authentication probe. Confirm the device accepted login, log it as compromised, move on. Automated. No human involved. 35,783 times.

Also published on Medium: https://medium.com/@dblanko.security/260-000-telnet-connections-in-72-hours-iot-honeypot-data-77b001527047

The Telnet port in 2026 is not a relic. Three simultaneous populations: IoT botnets with hex-encoded auth probes, router scanners with device-specific credential lists, occasional human operators. All three attracted by one honeypot emulating a BusyBox router. Full report + analysis scripts: github.com/dblanko/honeypot-analysis Full post: sshlab.eu/blog/260000-telnet-connections-in-72-hours-iot-honeypot-data-59e3b901 #honeypot #iot #telnet #infosec #threatintelligence #mirai

One session from Germany: ls, whoami, wget http://example.com/test exit. Three credentials attempted first. Then manual exploration. This is the behavioural signature of a human operator — distinguishable from 260,000 automated connections by command diversity and timing. A Russian-origin IP submitted gpon, linuxshell, 7ujMko0admin, smcadmin — router-specific default credentials for GPON fiber routers. Not looking for Linux servers. Looking for specific embedded devices.

Top alert: ET INFO RDP - Response To External Host — 40,492 times. More significant: ET EXPLOIT Possible ETERNALBLUE Probe MS17-010 — 47 times. The same SMB sessions that delivered 269 WannaCry payloads to Dionaea triggered this signature simultaneously. Two sensors, two layers, same event.

Top SMB scanners by event count: 181.174.229.52 — 6,426 events 223.100.68.193 — 5,198 189.151.28.7 — 4,463 41.226.181.214 — 4,063 All four triggering EternalBlue signatures. 19,331 SMB1_COMMAND_NEGOTIATE_PROTOCOL events in one day.

Published in InfoSec Write-ups on Medium: https://medium.com/bugbountywriteup/544-908-events-in-20-days-opencanary-multi-service-honeypot-data-8ea9a7a78607

Also published on Medium: https://medium.com/@dblanko.security/544-908-events-in-20-days-opencanary-multi-service-honeypot-data-8ea9a7a78607