Caught this week
The files attackers left on our honeypot sensors in the last 7 days, and what we learned from each. This page is built from our sensors' own records and updates every hour.
The last 24 hours
To 15 Oct 2026, 16:00 UTC, from 7 sensors in Asia, Europe and North America.
- 38,722times attackers connected
- 1,476different addresses
- 36,515login attempts
- 891,745commands typed once inside
Files caught in the last 7 days: 23
Newest first. Each file is run on a sealed test machine with no network, so we can see what it changes before we write a cure. The bars are the file's fingerprint (SHA-256), so you can match it against your own files.
- Cure tested on this sample
We wrote a cure, proved it on this exact file, and shipped it. (1) - Studied on a sealed machine
Run on the sealed machine; what it set up is listed. Not every file does something we can see there. (8) - Caught, not yet studied
Kept safely and queued for the sealed machine. (14)
-
Central EuropeShell scriptNot matched to a known family yet
What it set up on our sealed test machine:
/tmp/SSH
Studied on a sealed machineSHA-256 1edd4abf7697ba476871ed5e199a9b5d53810f4ff34327e8dba3722fc50d397a -
Central EuropeNot yet examinedCaught, not yet studiedSHA-256 441b8499dd241ba234473d0047e04999f52ff080a448144fdd9d4fbf6b78c4d5
-
Central EuropeNot yet examinedCaught, not yet studiedSHA-256 512bb398687fd626e03a1d477238c017ae011619a180c968784a0b89a058740f
-
Central EuropeLinux program (MIPS)Not matched to a known family yetStudied on a sealed machineSHA-256 6e1f47c56dd30a42d0664361dd94bd1741df6c9c9e2290dc260f56e14281572a
-
Sweden (Stockholm)Not yet examinedCaught, not yet studiedSHA-256 0dc95fb4077cce0bff19aa1a77109d059dff6503bbf6c1b0dd2f41fc0a4c88e7
-
Sweden (Stockholm)Shell scriptNot matched to a known family yet
What it set up on our sealed test machine:
/tmp/busybox/tmp/robben
Studied on a sealed machineSHA-256 29b9e559fcfd59c54f49b366b8ae6982bf8262a5ab3401e31da72f6a3e826808 -
Sweden (Stockholm)Not yet examinedCaught, not yet studiedSHA-256 c96cf8ce66abd86013abd1e0052663681b6d57a5b0920274cea85b3060759aaa
-
South AsiaNot yet examinedCaught, not yet studiedSHA-256 6d1fe6ab3cd04ca5d1ab790339ee2b6577553bc042af3b7587ece0c195267c9b
-
Netherlands (Amsterdam)Not yet examinedCaught, not yet studiedSHA-256 ba9c9d9d361d7df77a94b04aa66b7ae34c9d92b38e620ceeccc95058ea1c08a9
-
US West (San Jose)Text fileNot matched to a known family yetStudied on a sealed machineSHA-256 00b6f15c2274420217ed3098a9f5f00545bf1793d7a324fd18a7809cbbf5b12b
-
US West (San Jose)SSH key fileNot matched to a known family yetStudied on a sealed machineSHA-256 43728fbfb98bb39ff61a2db0fc2905bd6937997062b05b9ab8b186fdee18c09a
-
Central EuropeNot yet examinedCaught, not yet studiedSHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2
-
US EastNot yet examinedCaught, not yet studiedSHA-256 121744bba063912b2217e57f3303ea54f0bddf02c139e713527207dd2eafe5a4
-
US EastNot yet examinedCaught, not yet studiedSHA-256 520ed89c5c0533749a280c1a0716afd8119db1cb94a88aece868fd8ff705eef1
-
US EastShell scriptNot matched to a known family yetStudied on a sealed machineSHA-256 7b8cd695424f9b004b459ce886d92e9a24f38957dc9071510ab669a7cb89c417
-
US EastShell scriptNot matched to a known family yetStudied on a sealed machineSHA-256 b965f772177c2e79bff3739cdffa544d357e16441bdd833428aae067fe52dd65
-
US EastNot yet examinedCaught, not yet studiedSHA-256 d691f14c582da2018aa60954c365cfc4bf63fac58b281636ece6f415a4720d4a
-
US EastNot yet examinedCaught, not yet studiedSHA-256 dc87aeac1008620a4587df7d0cb91ec55e55e675f994b988476258fe117d537c
-
US West (San Jose)Not yet examinedCaught, not yet studiedSHA-256 af77b643964afd794460d28ab8a11b0ec8790cd5463abfde126613a4f3bccd32
-
US West (San Jose)Linux program (64-bit x86)Identified as Mirai
What it set up on our sealed test machine:
/etc/cron.d/netupd: @reboot root /bin/sh /var/tmp/.sys_recovery.sh &/etc/init.d/sys_daemon/etc/systemd/system/netd.service/var/tmp/.MGdneGj7/var/tmp/.sys_recovery.shrunning program /root/_sample (deleted)running program /usr/bin/dash
Cure tested on this sampleSHA-256 3674a103804cac96027fe1cf62aaab4948c1d547d1c885542177a263103b4260 -
US West (San Jose)Not yet examinedCaught, not yet studiedSHA-256 39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96
-
US West (San Jose)Linux program (64-bit x86)Not matched to a known family yet
What it set up on our sealed test machine:
/etc/rc.local/var/spool/cron/crontabs/root: @reboot /var/cache/.khelper &running program /var/cache/libcow.so
Studied on a sealed machineSHA-256 cc0e9d0184c0b930381446b6891769a35711b38c6a57303482e3115f921d4edc -
Japan (Tokyo)Not yet examinedCaught, not yet studiedSHA-256 35b1e72dc1201d2ffaa82f24043f53ef0f52c4f86be9abe6d23fa52f91383468
What we never publish: the malware files themselves, the addresses they were downloaded from, the addresses attacks came from, or anything that identifies our sensors. The fingerprint lets you check a file without anyone having to share it.