DefusedCyber

One day after a working exploit went public, we watched a fully automated SSRF-to-RCE chain sweep our Cisco CUCM sensors - SSRF, a rogue Apache Axis service, a two-stage webshell, and a root foothold, all fronted by Tor. We break down the tradecraft.

A walk through CVE-2026-41940 cPanel exploitation observed in our honeypots - from forged sessions to SSH key persistence and account takeover.

We tracked CVE-2026-3055 from preliminary signals through reconnaissance to mass exploitation - 13 days of honeypot telemetry showing how attackers prepare before public exploit code exists.

A February 2026 campaign used a internal JSP path and in-memory Java class loaders to quietly seed persistent access across Ivanti EPMM deployments - then walked away. We break down the tradecraft.

We

Combining honeypots with emergent vulnerability intelligence to discover attack trends before the public.

Discover how NIST SP 800-160 promotes deception for building cyber resilience through a systems engineering view point.

This blog post explores three less standard use cases for cyber deception.

Defused cloud decoys help discover an online cryptomining turf war. Explore how deception technologies broaden defender intelligence about adversary motivations.

Cyber deception and honeypots are related concepts, but often used interchangeably. This blog post points out the differences between the two.