Nomadic Honeypots: How To Create Actionable CTI

Nomadic Honeypots: How To Create Actionable CTI

Speakers: Laurent Oudot, Co-founder and CTO, TEHTRIS

Conference: HITB Amsterdam

YouTube: https://www.youtube.com/watch?v=4UOeo4Z476s

Overview

In an era where cyber threats evolve rapidly and attackers become increasingly sophisticated, traditional static defense mechanisms often fall short. Laurent Oudot, Co-founder and CTO of TEHTRIS, presented a compelling talk at HITB Amsterdam, introducing the concept of Nomadic Honeypots as a powerful new paradigm for generating actionable Cyber Threat Intelligence (CTI). This presentation challenged the conventional wisdom that honeypots are "noisy" and "not valuable," demonstrating how a dynamic, moving network of deceptive systems can actively engage attackers, gather critical intelligence, and enhance an organization's proactive defense posture.

Oudot's research-focused presentation delved into the strategic and technical intricacies of deploying and managing a global fleet of honeypots that constantly change their identity and location. The core idea is to overcome the limitations of static honeypots, which attackers often learn to identify and ignore over time. By adopting an automated moving target defense approach, TEHTRIS was able to create a continuous pipeline of unique threat intelligence, revealing attacker Tactics, Techniques, and Procedures (TTPs), weaponized exploits, and command-and-control (C2) infrastructure across more than 50 countries.

This talk is particularly significant for security professionals, incident responders, and CTI analysts seeking innovative ways to anticipate and counter advanced persistent threats. It highlights how strategic deception, combined with large-scale automation and sophisticated data analysis, can transform a seemingly passive defense tool into a potent weapon for intelligence gathering. The insights shared offer a practical roadmap for organizations looking to move beyond reactive security measures and establish a more proactive, intelligence-driven defense strategy, recognized even by industry analysts like Gartner as a future trend.

Background

▶ Watch: Introduction to Nomadic Honeypots concept (0:49)

Honeypots, at their essence, are decoy systems designed to mimic legitimate network services, applications, or devices, intended to lure and deceive attackers. Their primary purpose is twofold: to distract adversaries from real assets and to gather intelligence about their methods, tools, and motivations. Despite their long history in cybersecurity, honeypots have often been dismissed by some as overly noisy or providing limited value, especially when deployed as static, low-interaction systems.

Oudot began by reaffirming the fundamental value of honeypots, particularly for "white hats" engaged in ethical hacking and security research. He explained that honeypots allow organizations to identify hacking operations and gain predictive insights into potential attacks, aligning with the "Identify" and "Protect" functions of the NIST Cybersecurity Framework. For instance, a fake SSH server, while generating a lot of noise from brute-force attempts, can capture login credentials that, if found to work on an internal network, could signal a severe insider threat or a compromised external account. This early warning capability can significantly reduce the Mean Time To Detection (MTTD) and Mean Time To Respond (MTTR).

The presentation distinguished between two main types of honeypots:

• Low-interaction honeypots: These are lightweight systems that simulate specific services (e.g., a POP3 or Telnet server) by responding to requests with predefined, limited interactions. They are easy to deploy, generate statistics, and are generally safe as they don't offer real access to an operating system. An example provided was a simple Python script simulating a POP3 server on port 110, responding with "Okay" to any USER or PASS command. While not fully realistic, they provide basic data about scanning and initial probing.
• High-interaction honeypots: These involve sacrificing a real or virtualized system (e.g., a full Linux or Windows machine) and exposing it to the internet, inviting attackers to compromise it. The advantage is collecting rich, detailed information about attacker TTPs, including tools, exploits, and post-exploitation activities. However, they are inherently more dangerous, as a compromised system could potentially be used as a pivot point for further attacks if not properly isolated.

Strategic deployment is also critical. An exposed honeypot on the internet will gather extensive data on widespread scanning and opportunistic attacks, allowing for trend analysis and statistical insights into global threat landscapes. Conversely, an internal honeypot within a corporate network, or one placed in a DMZ, is designed to detect lateral movement, insider threats, or post-compromise activities by adversaries who have already breached the perimeter. While internal honeypots generate fewer logs, any interaction is highly significant, indicating a potential spy or an attacker performing reconnaissance.

Despite these benefits, Oudot highlighted a critical limitation of traditional, static honeypots. Attackers, especially sophisticated groups, often maintain databases of scanned targets. Once a honeypot is identified and compromised, its value often decreases over time for that specific group. They might "cache" the target's status, leading to a reduced "firepower" or interest in subsequent interactions, thereby limiting the long-term intelligence yield. This observation formed the impetus for the TEHTRIS research into a more dynamic approach.

Key Findings

▶ Watch: Automating target movement: the Nomadic Honeypot strategy (15:09)

The central discovery and contribution of Oudot's talk was the development and successful implementation of Nomadic Honeypots, a concept designed to counteract the diminishing return of static honeypots. The core problem identified was that advanced threat actors, like those associated with the "Vulcan files" mentioned in the talk, are "lazy or smart" (as Oudot put it) and maintain databases of scanned resources, refreshing them infrequently (e.g., once a week). This means a static honeypot, once discovered, loses its appeal and long-term intelligence-gathering potential for a specific adversary group.

The solution proposed and implemented by TEHTRIS was to introduce the concept of an automated moving target. Instead of maintaining a fixed presence, a nomadic honeypot operates in a continuous cycle:

1. Discovery: The honeypot is deployed and discovered by attackers.
2. Interaction & Intelligence Gathering: Attackers engage with the honeypot, allowing TEHTRIS to gather weapons, TTPs, and behavioral insights.
3. Recycling & Movement: Once sufficient intelligence is collected from a particular engagement, the honeypot is "recycled"—destroyed, its IP address changed, and a new instance deployed in a different location or country.

Oudot vividly compared this strategy to "Sarah Connor with your honeypot and the Terminators hunting you over the internet," emphasizing the constant movement to evade persistent adversaries. This Automated Moving Target Defense (AMTD) creates a "fog of war" for attackers, rendering their cached intelligence obsolete and forcing them to repeatedly expend resources on discovery and initial access. This dramatically increases the cost for attackers, as they cannot rely on static target lists.

The scale of TEHTRIS's deployment was impressive: over 1,300 honeypots deployed across 50+ countries, primarily in North America, Europe, and Asia. This extensive network, enabled by cloud infrastructure, allowed for rapid deployment, recycling, and relocation of honeypots, sometimes multiple times a day or week. This massive-scale, dynamic approach generated a "strong pipeline of intel," almost automatically producing valuable CTI.

A significant validation of this research came from Gartner, which published a document on AMTD applied to honeypots, predicting it as a future concept in cybersecurity. This external recognition underscored the foresight and innovation behind the nomadic honeypot strategy, suggesting it could be applied to various layers of IT infrastructure, from applications and protocols to operating systems and even hardware. The shift from a passive defensive stance to a proactive, ever-changing posture was highlighted as a "game-changing" proposal for the future of cybersecurity.

Technical Deep Dive

▶ Watch: Analyzing a Linux crypto miner using Discord for C2 (37:50)

The implementation of nomadic honeypots leverages cloud infrastructure for its inherent flexibility and scalability. The ability to rapidly provision, configure, and tear down virtual machines across diverse geographic locations is fundamental to the moving target defense strategy. TEHTRIS's global fleet of over 1,300 honeypots demonstrates this capability, covering regions from North America to South Asia and Europe.

Data Collection and Analysis Pipeline:

At the heart of the CTI generation is a robust data collection and analysis pipeline. TEHTRIS integrated its own suite of security tools, including:

• TEHTRIS XDR (Extended Detection and Response): For comprehensive visibility and correlation across various security layers.
• TEHTRIS EDR (Endpoint Detection and Response): Deployed on high-interaction honeypots (Windows or Linux) to capture detailed process execution, file system changes, and network connections, providing TTPs against attackers.
• TEHTRIS SIM (Security Information and Event Management): To aggregate and analyze logs from all honeypots, enabling correlation of events and identification of attack patterns.
• DNS Firewall and Network Traffic Analysis: To monitor and record network communications, including C2 traffic.
• SOAR (Security Orchestration, Automation, and Response): To automate responses, such as dynamically updating external firewalls with malicious IP addresses identified by honeypots, as demonstrated in the DDoS mitigation example.

A critical challenge with a large-scale honeypot network is the sheer volume of "noise." To manage this, the system focuses on identifying "what is new"—anomalies and previously unseen attack patterns—rather than getting bogged down in repetitive, known malicious activities.

Specific Attack Campaigns and Intelligence Gathered:

The nomadic honeypot network yielded a rich tapestry of CTI, including:

1. Global Attack Trends:

• Top Attack Types: Predominantly SSH brute-force attempts and VoIP-related attacks, but also resurgence of older exploits and new CVEs.
• Top Source Countries (by IP geolocation, March 2023): The US was the primary source, followed by Netherlands and Germany. Oudot clarified that this reflects infrastructure size and privacy laws (e.g., Germany's raw privacy respect leading to log disappearance, making it attractive for attackers).
• Web Honeypot Requests: Frequent attempts related to the Mirai botnet, targeting various architectures (ARM, Intel), indicating continuous efforts to compromise IoT devices.

1. Exploitation of Old Vulnerabilities:

• A significant campaign was observed targeting an old PHP 5 buffer overflow issue via query string hacking attempts. This suggested that attackers either improved old exploits or found renewed interest in them, highlighting the long tail of vulnerability exploitation.

1. DDoS Attack Patterns:

• Honeypots were instrumental in observing DDoS campaigns, particularly those targeting Denmark and the US. Integrating honeypot logs with XDR/SOAR allowed for the automated blacklisting of attacking IP addresses, including compromised IoT devices.

1. Iran-Linked C2 Operations:

• Through continuous movement across millions of IP addresses, TEHTRIS honeypots stumbled upon a C2 server potentially linked to Iran. This C2 was observed commanding backdoors on iPhone and Android devices. Key indicators included specific version strings, UTC+3.5 timestamps (Tehran time zone), and the use of fake hostnames in HTTP 1.1 Host headers. The discovery of these fake domains allowed TEHTRIS to monitor their registration status, providing further intelligence. The complexity of this data required advanced algorithms to sift through massive datasets and identify these subtle anomalies.

1. PHPMyAdmin Attacks (March 2023):

• A massive surge in attacks targeting PHPMyAdmin with specific payloads was detected, primarily affecting Portugal, Poland, Czech Republic, and Spain. A striking finding was the correlation between this observed activity (50% from China, 22% from other Asian countries) and discussions on Chinese underground hacking forums about the specific PHP flaw being exploited. This directly linked observed attacks to real-world hacker communities.

1. VMware ESXi Ransomware:

• Honeypots provided early warning for a VMware ESXi ransomware campaign in mid-January. Initial scans (targeting TCP port 427) were observed, followed by actual attacks two weeks later, culminating in a large campaign. The ability to detect reconnaissance activity before the full-scale attack is a prime example of proactive CTI.

1. US Midterm Elections:

• As part of the Cyber Threat Alliance, TEHTRIS shared intelligence on 63 malicious IP addresses targeting US midterm election infrastructure. While only 13 of these matched TEHTRIS's honeypot observations, it demonstrated the value of collaborative CTI and confirmed that honeypots could detect highly targeted, politically motivated attacks.

1. Dycode Crypto Miner Campaign:

• A sophisticated Linux crypto miner campaign, named Dycode, was identified. Attackers would gain initial access to Linux servers, then wait 1-2 weeks before deploying the miner, but only if the compromised box had "enough capacity." If not, the robot would move on to find another target. Crucially, the C2 communication for this miner used Discord infrastructure, highlighting how attackers leverage common, often unblocked services to evade detection.

Technical Advice for Implementation:

Oudot provided practical guidance for implementing honeypots:

• Choose Your Defensive Weapon: Utilize open-source honeypot solutions (e.g., from "awesome lists") for various services like Telnet, SSH, web servers, or databases.
• Outbound Traffic Control: This is paramount. A high-interaction honeypot must strictly limit its outbound traffic to prevent attackers from using it as a launchpad for further attacks (e.g., against whitehouse.gov). Techniques like netfilter, NFT, or IPtables with the limits module can be used to control packet rates and destinations.
• Legal and Ethical Considerations:
• GDPR: Recording hacker commands and IP addresses raises questions about data privacy, though Oudot humorously noted no spies had yet invoked GDPR.
• Entrapment: In some jurisdictions, setting up a trap that induces criminal activity could be legally problematic.
• Manpower: Prioritize securing core infrastructure before deploying honeypots, as they require dedicated resources for analysis.
• Protocol Selection: Telnet, despite being old, is valuable for cleartext traffic analysis, aiding in the creation of Network Intrusion Detection System (NIDS) signatures.
• Personality Management: Regularly change the honeypot's perceived identity (e.g., hostname, default accounts) to prevent attackers from recognizing it as part of a research operation.
• Deep Monitoring: For high-interaction honeypots, consider deploying custom kernel modules to hook system calls (e.g., sys_execve on Linux) and gather comprehensive execution data, potentially even hiding the module from lsmod.
• Active Defense (Optional/Illegal): While legally contentious, options like "poison gifts" (PDFs with beacons) or even counter-attack concepts were mentioned as theoretical possibilities in some contexts.

The "Morpheus Trick" (Fake Reality):

A particularly ingenious deception technique shared was the "Morpheus Trick." This involves manipulating the honeypot's environment to create a false reality for the attacker. By using Source Network Address Translation (SNAT) rules on the gateway, an attacker's connection to the honeypot can be made to appear as if it originated from a different, pre-selected IP address (e.g., a known Chinese or Russian attacker IP). When the attacker then runs commands like w, who, or netstat, they see themselves connected alongside these "elite" hackers. This trick:

• Encourages interaction: Attackers might try to communicate with the perceived co-occupants.
• Facilitates profiling: Interactions can reveal human fingerprints (language, TTPs), aiding attribution.
• Allows infiltration: Researchers can engage in "talk" commands, posing as fellow hackers to gather further intelligence.

Demo / Proof of Concept

▶ Watch: Understanding legal and ethical issues with honeypots (41:20)

While the talk didn't feature a live code demonstration, Laurent Oudot illustrated the core concepts with practical examples and the highly innovative "Morpheus Trick." The most basic demonstration of a low-interaction honeypot was a simple Python script, generated by ChatGPT, for a fake POP3 service on TCP port 110. This script exemplified how minimal code can simulate a service, respond to commands like USER and PASS with "Okay," and log interactions, albeit without true functionality. This serves as a quick, easy way to gather initial reconnaissance data.

However, the most compelling "proof of concept" presented was the "Morpheus Trick"—a sophisticated deception mechanism employed within the high-interaction nomadic honeypot framework. This technique demonstrates how to manipulate an attacker's perception of the compromised environment:

1. Gateway Configuration: A high-interaction honeypot is deployed with a gateway in front of it. This gateway is crucial for controlling inbound and, more importantly, outbound traffic.
2. SNAT Rule Implementation: Using Linux netfilter tools like IPtables or NFT, a specific Source Network Address Translation (SNAT) rule is configured. This rule identifies the researcher's own IP address (the "green IP address") connecting to the honeypot.
3. IP Address Spoofing: When the researcher connects, the SNAT rule rewrites the source IP of their connection to a pre-chosen, known malicious IP address (e.g., from a major attacking country like China or Russia).
4. Attacker's Perspective: An attacker who has compromised the honeypot and is logged in will execute standard reconnaissance commands like w (show who is logged on and what they are doing), who, or netstat.
5. False Reality: The output of these commands will show the attacker's own connection alongside the researcher's connection, but the researcher's connection will appear to originate from the spoofed, malicious IP address. The attacker is led to believe they are sharing the compromised machine with other high-profile hackers.

This ingenious method is not just a theoretical concept; Oudot stated that TEHTRIS actively uses it. By creating this "dream world," they can:

• Encourage Interaction: Attackers, believing they are among peers or rival groups, might attempt to communicate or probe further.
• Profile Adversaries: These interactions can yield valuable "human fingerprints," such as language nuances, preferred tools, or specific TTPs, which can aid in attribution, even if attackers attempt to mask their identity.
• Infiltrate Groups: In some cases, TEHTRIS researchers have initiated "talk" command discussions with attackers, posing as fellow hackers to gather deeper intelligence and potentially infiltrate hacking groups.

This "Morpheus Trick" effectively turns the honeypot into an active deception platform, going beyond passive data collection to actively influence attacker behavior and extract more profound CTI.

Defensive Implications

▶ Watch: Q&A: SCADA system attacks and internal network findings (61:40)

The insights derived from the nomadic honeypot research offer several critical implications for cybersecurity defenders:

1. Proactive CTI Generation: Organizations can move beyond reactive security by deploying nomadic honeypots to generate unique, first-hand threat intelligence. This intelligence provides a view of attacker TTPs, tools, and infrastructure that is directly relevant to the organization's threat landscape.
2. Early Warning System: The ability to detect reconnaissance activities (e.g., VMware ESXi TCP 427 scans) before a full-scale attack allows defenders to anticipate campaigns and harden their legitimate systems proactively. This significantly reduces the window of opportunity for attackers.
3. Automated Moving Target Defense (AMTD) Adoption: The success of nomadic honeypots validates AMTD as a viable and effective strategy. Defenders should explore how to implement dynamic changes to their infrastructure (e.g., IP addresses, service configurations, even virtual hardware) to increase the cost and complexity for persistent attackers.
4. Enhanced Lateral Movement Detection: Internal and DMZ-based honeypots remain crucial for detecting lateral movement within a compromised network. Any interaction with these decoys signals a high-confidence alert, indicating an active breach or insider threat that bypasses perimeter defenses.
5. Dynamic DDoS Mitigation: Integrating honeypot intelligence with security orchestration and automation (SOAR) platforms can enable real-time blacklisting of malicious IP addresses identified during DDoS attacks. This allows for automated and rapid response to large-scale volumetric attacks.
6. Strict Outbound Traffic Filtering: Any deceptive system, whether a honeypot or a sandboxed environment, must have stringent outbound traffic controls. This prevents attackers from using the decoy as a pivot point for further attacks, protecting the organization from legal repercussions and maintaining its reputation.
7. Leveraging Existing Security Stacks: The talk demonstrated how existing security tools like XDR, EDR, SIEM, and SOAR can be integrated to process, analyze, and act upon honeypot data, maximizing the return on investment for deployed security technologies. The focus should be on algorithms that detect "what is new" to manage data volume.
8. Community Collaboration: Participating in threat intelligence sharing initiatives, such as the Cyber Threat Alliance, amplifies the collective defensive posture. Sharing honeypot-derived indicators of compromise (IOCs) and TTPs helps disrupt C2 infrastructures and increases the attrition rate for attackers.
9. Understanding Attacker Psychology: The "Morpheus Trick" highlights the value of psychological deception. Defenders can explore creative ways to manipulate attacker perceptions, encouraging them to reveal more about their operations and identities.
10. Prioritizing Fundamentals: While honeypots are valuable, Oudot reminded defenders to first focus on hardening core infrastructure (e.g., Active Directory) before deploying advanced deception technologies. Honeypots are an enhancement, not a replacement, for fundamental security hygiene.

Key Takeaways

• Nomadic Honeypots Overcome Static Limitations: By constantly changing IP addresses and locations across global cloud infrastructure, nomadic honeypots bypass attackers' cached target lists, maintaining sustained engagement and intelligence gathering that static honeypots cannot.
• Massive-Scale CTI Generation: Deploying over 1,300 honeypots in 50+ countries creates a continuous, automated pipeline of actionable Cyber Threat Intelligence, offering "weather predictions" of attack campaigns and revealing new TTPs.
• Automated Moving Target Defense (AMTD) is the Future: Gartner recognizes AMTD as an emerging strategic concept. The research validates its effectiveness in creating a "fog of war" for adversaries, increasing the cost and complexity of their operations.
• Control Outbound Traffic and Address Legal/Ethical Concerns: Strict outbound filtering on honeypots is crucial to prevent them from being weaponized by attackers. Legal considerations like GDPR and entrapment must also be carefully evaluated.
• Creative Deception Enhances Intelligence: Techniques like the "Morpheus Trick," which manipulates an attacker's perception of the compromised environment, can encourage interaction, reveal human fingerprints, and aid in adversary profiling and attribution.
• Honeypots Provide Early Warning and TTP Insights: They detect reconnaissance activities before full-scale attacks (e.g., VMware ESXi scans) and capture detailed TTPs, C2 infrastructure (e.g., Iran-linked backdoors, Discord-based crypto miners), and exploit trends (e.g., old PHP vulnerabilities, Mirai botnet attempts).

About the Speaker(s)

Laurent Oudot is the Co-founder and CTO of TEHTRIS, a cybersecurity company. With a distinguished career spanning over 20 to 30 years in cybersecurity, Oudot is a seasoned ethical hacker. His extensive experience includes identifying numerous security vulnerabilities in various devices and applications, notably being among the first to "break" the BlackBerry, iPad, and iPhone. In his role as CTO, he focuses on cutting-edge research and development, as demonstrated by his presentation on nomadic honeypots, which he emphasized was about research findings rather than product promotion for TEHTRIS's XDR solutions. His talk underscored his deep technical expertise and passion for innovative defensive strategies.