When FlashHole-style scouts and PHP probes share the same cloud prefix
Operation FlashHole showed Lazarus tooling that breaks past perimeter assumptions and keeps probing after operators expect containment. In the same window, critical PHP advisories such as CVE-2026-109618 and CVE-2026-109619 drove mass internet scanning from shared hosting and cloud ASNs. Those two patterns land on the same sensors: low- and medium-interaction honeypots facing the public edge.
Defenders who treat every honeypot hit as a permanent block candidate burn analyst time and freeze partner tenants. Defenders who wait for vendor reputation to catch up miss the hours when scout infrastructure is still cheap to quarantine. The operational middle path is to score each honeypot session against how long that IP or /24 has lived in the same ASN and how stable its RDNS and certificate history look, then promote only the durable signals into hunt and policy queues.
What your sensors should record on every interaction
Threat intelligence value comes from the join keys, not the volume of connection attempts. Configure each decoy so every session emits a fixed schema that your SIEM or lake can correlate without custom parsers per sensor.
- Network identity: source IP, reverse DNS, ASN, and the covering prefix length you will actually use for temporary policy (/32, /28, or /24).
- Service fingerprint: destination port, protocol, banner requested, and which decoy profile answered (fake SSH, WordPress login, PHP-FPM admin path, RDP splash).
- Payload artifacts: first request line or command, User-Agent or client version string, shell snippet hash, uploaded file SHA-256, and any callback hostname or IP the payload tries to reach.
- Timing: first seen, inter-request cadence, and whether the same source returns within 15 minutes, 4 hours, and 24 hours.
- Prefix tenure: how long that address or neighboring addresses in the same /24 have appeared in your edge allow logs, VPN auth, or mail flow over the prior 30 to 90 days.
TiDB-related breach reporting reinforced a cloud lesson many teams already feel in honeypot data: a clean reputation score on a shared prefix can flip overnight when a noisy tenant arrives. Prefix tenure from your own telemetry is the control that keeps autodrops from chasing that churn.
Separate scanner noise from campaign follow-through
Most honeypot volume is mass scanning. Campaign-quality intelligence appears when the same source or ASN moves from banner grab to exploit payload to outbound callback. Tag each session with a stage label your analysts already use in tickets: recon, exploit attempt, staging upload, callback.
AI-assisted planning, including tooling that helps actors design multi-step crime workflows, shows up as denser probing across several decoy types from one ASN family within a short window. You will see SSH brute attempts, PHP path fuzzing, and forged browser headers that resemble antidetect stacks in the same four-hour block. Treat that multi-service cadence as a higher priority enrichment job than a single-port flood from a known research scanner.
A practical enrichment loop for one shift
Run this loop when a new critical advisory lands or when APT chatter names a tool family your decoys can emulate.
- Open the last 6 to 24 hours of honeypot sessions for the exposed service that matches the advisory (for PHP CVEs, prioritize HTTP decoys that emulate vulnerable front controllers).
- Cluster sources by ASN and by /24, then compute hit count, unique decoy profiles touched, and whether any session included a payload hash or callback destination.
- Join clusters to prefix tenure. Sources with zero prior internal sightings and multi-decoy activity become temporary quarantine candidates. Sources with long partner tenure go to analyst review with a soft challenge or rate cap instead of a hard deny.
- Extract callback destinations and payload hashes into a same-day hunt list across proxy, DNS, and EDR. Lazarus-style follow-on activity often reuses those destinations after the initial scout wave.
- Publish a thin upstream note with TLP and owner: ASN, sample IPs, payload hash, decoy stage, and time window. Perfect attribution can wait; the early package is what peer defenders can act on.
Keep temporary blocks time-boxed. A 24- to 72-hour ASN or /24 hold while signatures and vendor scores update is enough to blunt scout waves without locking out rotating cloud tenants for weeks.
Immediate controls that consume honeypot intel
Map each intelligence product to a control your edge and SOC can execute without a new project.
- Edge: short TTL denies or rate caps on /32s with exploit payloads; /24 caps only when multiple /32s in the prefix show the same payload family.
- Auth and admin planes: raise MFA and lockout sensitivity for sources that hit decoy admin paths in the same window as real portal auth failures.
- Egress: watch for honeypot-learned callback hosts on workstation and server outbound DNS and TLS SNI before ransomware or secondary tooling stages.
- Mail and identity: if email bombing or signup floods coincide with honeypot scout waves from the same ASN, fuse those queues so containment tickets stay in one owner’s hands.
- Detection: retune IDS priority for signatures that match payload hashes your honeypots already captured, especially while commercial packs still lag the advisory.
Russia’s tightening of internet controls and similar jurisdictional shifts also change how long certain C2 and proxy ranges remain reachable. When honeypot callbacks point into regions with sudden path instability, prefer destination-based egress holds over source-only denies so you still catch implants that rotate front addresses.
Implementation details that keep intel usable
Instrument at least two decoy classes on separate hosts or containers: a low-interaction sensor for volume and timing, and a medium-interaction profile for the services you actually expose (SSH, web admin, remote support). Log to the same pipeline your firewall and identity events use so joins are cheap.
Store raw PCAPs or request bodies only for sessions that reach exploit or callback stage. That keeps storage bounded and makes legal and retention reviews tractable. Hash everything else.
Automate the enrichment, not the widest block. Scripts can attach ASN, RDNS, cert history, and tenure; humans still approve /24 or ASN actions that sit near partner cloud space. Document the approval path before the next exploit week so midnight calls do not invent policy under pressure.
Field checklist for the next advisory week
- Confirm honeypot profiles emulate the services named in the advisory within hours of disclosure.
- Require prefix tenure and multi-stage tags before any autodrop wider than /32.
- Push payload hashes and callback hosts into DNS, proxy, and EDR hunts the same shift.
- Time-box every honeypot-derived block and review tenure again before renewal.
- Assign an owner to each shared indicator package so morning ISAC digests do not age out unacted.
Honeypots earn their place in threat intelligence when they turn exploit-week scout traffic into timed, tenure-aware controls and hunt seeds. Score the hit, stamp the prefix history, and move the durable artifacts into policy while the wave is still forming.
