Security researchers created a high-fidelity Cowrie honeypot that masqueraded as a powerful machine-learning server containing four NVIDIA H100 GPUs, 128 AMD EPYC 7763 cores, one terabyte of RAM, and 31.5 TB of storage. The goal was to let real-world SSH bots connect and reveal their post-compromise behavior instead of simply logging failed login attempts.
After rejecting an LLM-based fake SSH daemon, the team chose the mature Cowrie Python honeypot because it reliably records every command, file download, and session. They kept the real sshd listening only for their own addresses and used nftables to redirect all other traffic on port 22 into the honeypot. A custom StickyAuth authorization class forced bots to perform between two and five failed attempts before granting access, then permanently bound the successful credential pair to that source IP.
The filesystem was built from a real Debian 12 installation via mmdebstrap and populated with believable artifacts: running training processes, checkpoint files in /data/models, and fake cloud credentials in /opt/ml/.env. The researchers also fixed three realism gaps that would have exposed the trap to automated scripts: added support for the -i flag in grep, corrected binary paths after /bin became a symlink to /usr/bin, and synchronized the hostname returned by the hostname command with /etc/hostname.
Within the first twelve-and-a-half hours the honeypot attracted 1,846 connections from 126 distinct addresses. One hundred seventy-five logins succeeded from 70 IPs, and 102 of those sessions contained commands. A single Go-language scanner accounted for 1,198 connections, while a 59-address botnet associated with the Outlaw group performed the most elaborate activity. After logging in, these bots deleted .ssh directories, installed their own key containing the signature mdrfckr, changed the root password, terminated competing miners, inspected hardware, and scheduled a cron job that fetched the dota3 archive containing an IRC-controlled backdoor and its own SSH brute-forcer.
Six additional addresses behaved more like reconnaissance tools; one repeatedly queried GPU status and returned 38 times, apparently interested in the simulated H100 cards. No actual miner was deployed on the honeypot during the observation window.
The team also deployed a separate service that fed each Cowrie session to a free large-language model and forwarded concise explanations plus full terminal recordings to Telegram, allowing analysts to review attacker intent without manually replaying every log.
