Wiz Open-Sources HoneyBee to Automate Cloud Honeypot Deployment
Summary
Wiz introduced HoneyBee, an open-source tool that generates intentionally misconfigured Docker environments for honeypots, testing detections, and research. Wiz says its honeypots observed attackers exploiting exposed JDWP and weak PostgreSQL credentials.
Key points
- HoneyBee generates insecure Dockerfiles and Compose manifests for cloud-deployed applications, with Nuclei templates for validating misconfigurations.
- The tool supports easy deployment and reset, AI-generated misconfigurations, and optional tcpdump network monitoring.
- Wiz says it used HoneyBee honeypots to observe exposed JDWP exploitation leading to a customized XMRig miner, including persistence via systemd services and cron jobs.
- In another honeypot investigation, Wiz observed attackers using weak PostgreSQL credentials to deploy a fileless XMRig variant.
- Wiz says the observations informed improvements to its misconfiguration-risk and behavioral detections.
- The project is available at github[.]com/yaaras/honeybee.
Article Details
- Event Type
- Open-source release of HoneyBee, a tool for automating the deployment of intentionally misconfigured honeypots for security research.
- Impact
- HoneyBee helps security teams test detections and observe attacker behavior in isolated decoy environments. Wiz says its honeypots enabled research into exposed JDWP exploitation that deployed a customized XMRig cryptominer, and a PostgreSQL campaign in which attackers used weak credentials to deploy a fileless XMRig variant. The resulting observations informed improvements to Wiz's detection capabilities.
MITRE ATT&CK
Malware
Vendors
Products
Dockerstorage services, and web apps, and automatically generates intentionally insecure Dockerfiles and Docker Compose manifests. These are designed to mimic the types of mistakes we see in real environments, fromPostgreSQLTo see what this looks like in practice, here’s a docker-compose.yaml file HoneyBee generated for a PostgreSQL instance with no password:Wiz CSPMof cloud environments. Each honeypot is also equipped with tcpdump, Wiz Sensor, and integrated with Wiz CSPM and Wiz Defend. This allows us to capture both network activity and security alerts in real time, whileWiz Defendenvironments. Each honeypot is also equipped with tcpdump, Wiz Sensor, and integrated with Wiz CSPM and Wiz Defend. This allows us to capture both network activity and security alerts in real time, while relying on WizWiz Sensorhoneypots across different types of cloud environments. Each honeypot is also equipped with tcpdump, Wiz Sensor, and integrated with Wiz CSPM and Wiz Defend. This allows us to capture both network activity and