Dionaea Multi-Protocol Trap.

Monthly Threat Intel Report: November 2025

Executive Summary

Hold onto your keyboards, folks. The November action at the T-Pot Sydney honeypot was a veritable smorgasbord of dumb brute force attacks, primarily giving SMB services the evil eye—surprise, surprise. These lovely nuggets of malicious joy are more likely brought to us by the usual suspects: opportunistic scanners and crimeware, because clearly no one ever told them brute force doesn't make friends. Strap in, because we're peeling back the layers to expose the infrastructure and schemes behind these shenanigans.

Key Stats

• Timeframe: November 2025
• Sensor: Dionaea honeypot (T-Pot Sydney)
• Volume: Thousands of joyous attack attempts logged
• Standout ASNs: TOT Public Company Limited (TH), Data Communication Business Group (TW), Rostelecom (RU)
• Focus: SMB brute force on port 445

Campaign Narrative

So, what's the deal? Picture a legion of brain-dead zombies—except they're IP addresses. Mainly hanging out in botnets, they hammer away at SMB services with the tedious determination of a stoner microwaving a burrito at 2 AM. The pattern, an all-too-familiar dance, reeks of IoT botnets akin to our buddy Mirai. Forget highbrow state actors; this crew couldn't hack their way out of a paper bag, but they sure are persistent.

Infrastructure Details

We're dealing with a cocktail here. Residential IPs, some naughty little cloud instances, and good old bulletproof hosting all happily enabling these adventures:

• Bulletproof Hosts: TOT Public Company Limited in Thailand ought to take a bow for being such a frequent flyer in this hall of shame.
• Cloud Shenanigans: IPs from Amazon and Microsoft are sprinkled throughout like cyber sprinkles on this steaming pile—because who doesn’t love commuting nefarious traffic through Uncle Jeff’s cloud?
• Botnet Utopia: Rostelecom and PT Telekomunikasi Indonesia feature prominently in the 'let's use residential IPs as attack pivots' game, hinting at compromised devices galore.

Malware and Behaviour

Ah, brutish activities: mostly targeting SMB, with some rebellious attempts on MSSQL and FTP services. The attackers' ploys exhibit hallmarks of Mirai-style campaigns—botnets tapping into shabby credentials like a toddler in a candy store. It’s script-kiddie 101, and they’ve nailed it: sheer volume over skill.

Detection and Mitigation

Tired of seeing sweaty logs of failed brute force? Here’s how to slap these jokers back to the stone age:

• Firewall: Close ranks on port 445 unless it's absolutely needed. Seriously, why is this open?
• Monitoring: Keep sonar active for traffic to the highlighted ASNs and IPs.
• Hunting Queries: Create and watch for login attempts with repetitive failures—bots aren’t known for their finesse.
• User Education: The “are you using secure credentials?” talk—pixelated pamphlets optional.
• Cloud Vigilance: Watch your cloud environments like hawks; these aren’t benign puffs of rainbows and unicorns.

Closing Thoughts

Facing yet another tide of brute force brilliance has its perks—I guess. But as long as SMB services continue their reign as irresistible honeypots, these mindless onslaughts will persist. As defenders, we need to blockade these attempts and bolster our defenses, maintaining a blend of vigilance and sheer exasperation-infused humour. Onwards, into the digital night.