SSH LLM Honeypot caught a real threat actor

A detailed guide on how an SSH LLM honeypot successfully trapped a real threat actor who downloaded and attempted to execute malicious binaries. The honeypot, Beelzebub, was configured with an OpenAI key and analyzed the actions of the attacker, including their attempts to connect the server to a botnet via a Perl script. The post also includes steps to configure and run the honeypot using Docker, and discusses the information gathered from the threat actor's activities, as well as actions taken to mitigate the threat.