Have I missed 99% of the content or is this purely to raise awarness? There is no description of the honeypot. Did the person running it manage to intercept any root kits, if yes what were they?<p>I remember years ago there was this vnc vulnerability that allowed one to login without a password. At the time I was doing "it support" for various small businesses in West Yorkshire, UK. All of my regulars had firewalls with (site to site) vpn for remote access, but often I'd get new clients I never saw before asking to fix something. When that vulnerability came out I was getting calls from such new customers daily about "their system is slow", "our email is not going out" (in these days even small businesses used to run their own email servers). Every single "new customer" I had during next few weeks was "hacked" by the vnc bug. It seems whoever used to do IT for them left vnc accessible from the Internet (not even limiting the source IPs on the firewall). Every single time the root kits I found had outputs in Chinese (it required changing windows cmds settings to even see it). Most were very basic, but they did manage to successfully kill the AV software and they all had their own storage drivers that hid certain folders unless I booted the system in the safe mode(tgese were mostly windows 2000/2003 sbs servers BTW). Frequently I'd find lists of other victims IPs on these systems and their scanning software. What was the goal of this campaign? Sending spam of course. As mentioned most clients only realised they were "hacked" when their system became horribly slow, or their outgoing email was cut off by their ISP blocking outgoing smtp traffic from their IPs following complaints. What was the spam? Viagra of course.... I saw lots of these. Many of these systems had personal data of people, I never noticed attempts to exfiltrate such data. The only time I dealt with proper attempt to steal money from a business account using the IT system was after a disgruntled it admin was fired.<p>This was almost 20 years ago. I'd love to find out how small network attackers try to "monetize" their victims today. Are they just searching for crypto, attempting "encrypting data" scams, or is there something more interesting? Curious minds want to know?