HoneyDB Agent 2.10.0 adds a family of plugins that emulate the services attackers look for on blockchain and cryptocurrency infrastructure: exposed node RPC APIs, wallets, miner management interfaces and validator tooling. Attackers who probe these services tend to reveal their own wallet addresses, mining pools and credentials, which makes the captured events useful threat intelligence for crypto and blockchain teams.

New plugins

  • Ethereum: EVMRPC_tcp (Geth, Erigon, Nethermind, Anvil, Hardhat and Ganache personas), BeaconAPI_tcp (beacon node, keymanager, Web3Signer, engine API)

  • Bitcoin family: BitcoinRPC_tcp (Bitcoin, Litecoin, Dogecoin, Dash, Bitcoin Cash, Zcash), BitcoinP2P_tcp, Electrum_tcp, LND_tcp

  • Other chains: SolanaRPC_tcp, SubstrateRPC_tcp (Polkadot and Kusama), MoneroRPC_tcp

  • Mining and infrastructure: CgminerAPI_tcp, ClaymoreAPI_tcp, XMRigAPI_tcp, Docker_tcp, IPFS_tcp

Also in this release:

  • Crypto node persona for SSH_tcp and Telnet_tcp: sessions present as an Ethereum, Solana or Bitcoin node, with lure key files and node processes to find.

  • New HTTP_tcp personas (BTCPay Server, LNbits, Antminer web UI) and digest authentication capture.

  • Mining and dropper indicators (pools, wallets, miners, download URLs) are now extracted from Kubernetes_tcp and Redis_tcp payloads as well.

  • Agent configuration: a new optional state_dir setting, and a persisted default TLS certificate (RSA-2048) for services that use tls = Yes.

Getting started:

  • All new plugins ship disabled. Set enabled = Yes on the service sections you want, in services.conf.

  • They are intended for agents with an Internet-facing address.

  • Each plugin has its own configuration and INFO event reference in the Plugins documentation (https://honeydb.io/docs/plugins.html).