{"id":9649,"date":"2026-01-05T10:03:55","date_gmt":"2026-01-05T10:03:55","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/05\/hackers-trapped-in-resecuritys-honeypot-during-targeted-attack-on-employee-network\/"},"modified":"2026-01-05T10:03:55","modified_gmt":"2026-01-05T10:03:55","slug":"hackers-trapped-in-resecuritys-honeypot-during-targeted-attack-on-employee-network","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/05\/hackers-trapped-in-resecuritys-honeypot-during-targeted-attack-on-employee-network\/","title":{"rendered":"Hackers Trapped in Resecurity\u2019s Honeypot During Targeted Attack on Employee Network"},"content":{"rendered":"

Hackers Trapped in Resecurity\u2019s Honeypot During Targeted Attack on Employee Network
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Resecurity deploys synthetic data honeypots<\/a> to outsmart threat actors, turning reconnaissance into actionable intelligence. A recent operation not only trapped an Egyptian-linked hacker but also duped the ShinyHunters group into false breach claims.\u200b<\/p>\n

Resecurity has refined deception technologies for counterintelligence, mimicking enterprise environments to lure threat actors into controlled traps.<\/p>\n

These build on traditional honeypots, misconfigured services, or dummy resources that passively log intruders, now powered by AI-generated synthetic data that resemble real-world patterns without exposing proprietary information. Previously breached data from dark web sources enhances realism, fooling even advanced actors who validate targets.\u200b<\/p>\n

On November 21, 2025, Resecurity\u2019s DFIR team spotted a threat actor scanning public-facing services after targeting a low-privilege employee. Indicators included IPs like 156.193.212.244 and 102.41.112.148 (Egypt), plus VPNs 45.129.56.148 (Mullvad) and 185.253.118.70.<\/p>\n

Responders deployed a honeytrap in an emulated app with synthetic datasets: 28,000 consumer records (usernames, emails, fake PII from combo lists) and 190,000 Stripe-like payment transactions generated via tools like SDV, MOSTLY AI, and Faker. A bait account, \u201cMark Kelly,\u201d was planted on Russian Marketplace to draw attackers.\u200b<\/p>\n

\n
\"Hackers
records from Honeypot<\/figcaption><\/figure>\n<\/div>\n

The actor logged into the honeytrap, prompting over 188,000 requests from December 12-24 to scrape data via custom automation and residential proxies.<\/p>\n

This yielded \u201cabuse data\u201d on tactics, infrastructure, and OPSEC<\/a> slips, real IPs leaked during proxy failures. Resecurity blocked proxies, forcing the reuse of known hosts, and shared findings with law enforcement, culminating in a foreign subpoena.<\/p>\n

Isolated decoys like Office 365, VPNs, and a decommissioned Mattermost instance with 2023 fake chatter (six groups, AI-generated via OpenAI) proved ideal for high-value mimicry without risk.\u200b<\/p>\n

ShinyHunters Caught in Update<\/strong><\/h2>\n

A January 3, 2026, update revealed ShinyHunters previously profiled by Resecurity fell into the same trap, boasting Telegram \u201cfull access\u201d to \u201c[honeytrap].b.idp.resecurity.com\u201d and fake systems.<\/p>\n

\n
\"Hackers
Telegram group update<\/figcaption><\/figure>\n<\/div>\n

Screenshots showed dummy Mattermost for \u201cMark Kelly,\u201d non-existent domains like \u201cresecure.com,\u201d bcrypt-hashed API tokens from duplicate tester accounts, and useless old logs.<\/p>\n

The group acknowledged disruptions caused by Resecurity\u2019s tactics; social engineering identified links to jwh*****y433@gmail.com, a US phone number, and a Yahoo account registered during the activity.\u200b<\/p>\n

\"\"<\/figure>\n

This validates cyber deception\u2019s power for threat hunting and investigations, generating IOCs\/IOAs from controlled engagements. Compliance with privacy laws remains key. <\/p>\n

Resecurity\u2019s logs and prior ShinyHunters expos\u00e9s suggest retaliation backfired into self-incrimination. Enterprises can replicate via monitored decoys in non-production environments, enhancing proactive defense against financially motivated threat actors.\u200b<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post Hackers Trapped in Resecurity\u2019s Honeypot During Targeted Attack on Employee Network<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Guru Baran
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Hackers Trapped in Resecurity\u2019s Honeypot During Targeted Attack on Employee Network Resecurity deploys synthetic data honeypots to outsmart threat actors, turning reconnaissance into actionable intelligence. A recent operation not only trapped an Egyptian-linked hacker but also duped the ShinyHunters group into false breach claims.\u200b Resecurity has refined deception technologies for counterintelligence, mimicking enterprise environments to […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63],"tags":[130],"class_list":["post-9649","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9649"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9649"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9649\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}