Campaign briefs and adversary profiles derived from the cowrAI distributed honeypot fleet — 36 nodes across 7 providers.
Each brief is derived from live honeypot data collected by the cowrAI fleet — 36 cowrie nodes running SSH, Telnet, and alt-protocol lures (soaplure, httplure, adbhoney, and others). All lure-captured payloads are automatically submitted to VirusTotal and tria.ge; confirmed samples are detonated in an isolated WARP-egress sandbox for behavioral analysis.
Reports include: IOC tables, MITRE ATT&CK mappings, Suricata detection rules, raw exploit payload captures, and C2 infrastructure profiling. Distribution frequency: as-observed (one brief per distinct campaign or threat actor).