prometheus

The Belarus-aligned threat actor known as Ghostwriter (aka UAC-0057 and UNC1151) has been observed using lures related to Prometheus, a Ukrainian online learning platform, to target government organizations in the country. The activity, per the Computer Emergency Response Team of Ukraine (CERT-UA), involves sending phishing emails to government entities using compromised accounts. It's been active since the spring of 2026. "Typically, the email contains a PDF attachment with a link that, when clicked, leads to the download of a ZIP archive containing a JavaScript file," the agency said in a Thursday report. The JavaScript file, dubbed OYSTERFRESH, is designed to display a decoy document as a distraction mechanism, while stealthily writing an obfuscated and encrypted payload called OYSTERBLUES to the Windows Registry, as well as downloading and launching OYSTERSHUCK, which is responsible for decoding OYSTERBLUES. OYSTERBLUES is equipped to harvest a wide range of system information, including computer name, user account, OS version, time of the last OS boot, and a list of running processes. The collected data is sent to a command-and-control (C2) server over an HTTP POST request. It then awaits further responses containing next-stage JavaScript code, which is executed using the eval() function. The final payload is assessed to be Cobalt Strike, an adversary simulation framework that's widely abused for post-exploitation activities. "To reduce the likelihood of this cyber threat being exploited, it is advisable to apply known basic approaches to reducing the attack surface, specifically by restricting the ability to run wscript.exe for standard user accounts," CERT-UA said. The disclosure comes as Ukraine's National Security and Defense Council revealed Russia's use of artificial intelligence (AI) tools like OpenAI ChatGPT and Google Gemini to scout targets and embed the technology into malware to generate malicious commands at runtime, while calling out Kremlin-backed hacking groups for carry out cyber attacks focused on obtaining intelligence and ensuring a long-term presence in compromised networks for follow-on exploitation, including to support influence operations. "The main vectors of initial penetration in 2025 were social engineering, exploitation of vulnerabilities, use of compromised RDP and VPN accounts, attacks on supply chains, and the use of unlicensed software that already contains built-in backdoors at the installation stage," the Council said. "Attackers focused on stealing sensitive information, intercepting communications, and tracking the location of targets." In a related development, details have emerged about a pro-Kremlin propaganda campaign that hijacked real Bluesky users' accounts to post fake content since 2024. Hijacked accounts included journalists and professors. The activity has been attributed to a Moscow-based company called Social Design Agency, which is linked to a campaign known as Matryoshka. In some of these cases, Bluesky has taken the step of suspending the accounts until the owners initiate a reset.

Coroot: Open-source observability and APM tool Coroot is an open-source observability and application performance monitoring tool. The core software, published in Go and accompanied by companion repositories such as coroot-node-agent, focuses on collecting telemetry data across systems. It uses extended Berkeley Packet Filter (eBPF) technology to gather metrics and trace inter-service communications without manual instrumentation of application code. Coroot collects standard observability signals that engineering teams rely on. The software aggregates metrics, logs, traces, and continuous profiling data and makes them available in dashboards and structured views. Users can track service health, follow request paths through service maps, and examine performance profiles down to CPU and memory behavior over time. An eBPF-based agent is central to this model. It runs on nodes to expose container metrics in the Prometheus format and trace container TCP events, giving visibility into network behavior across environments. Coroot also has predefined inspections that scan telemetry data and summarize conditions such as service level objective (SLO) compliance and common failure patterns. Coroot’s visibility model aims to reduce manual instrumentation work by leveraging kernel-level data collection. That reflects broader trends in cloud native operations where teams balance signal coverage with ease of setup. Observability vendors and projects in open source communities continue to explore approaches that reduce configuration burden while addressing reliability needs. Coroot is available for free on GitHub. Must read: 40 open-source tools redefining how security teams secure the stack Firmware scanning time, cost, and where teams run EMBA Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

Week in review: Exploited zero-day in Cisco email security appliances, Kali Linux 2025.4 released Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: How researchers are teaching AI agents to ask for permission the right way People are starting to hand more decisions to AI agents, from booking trips to sorting digital files. The idea sounds simple. Tell the agent what you want, then let it work through the steps. The hard part is what the agent does with personal data along the way. A new research study digs into this problem, and asks a basic question. How should an AI agent know when to use someone’s data without asking every time? Ro’s CISO on managing data flows in telehealth In this Help Net Security interview, Scott Bachand, CIO/CISO at Ro, discusses how telehealth reshapes the flow of patient data and what that means for security. He explains why organizations must strengthen data classification and visibility as systems and vendors multiply. He also outlines how regulations and new technologies are driving a more adaptive approach to protecting patient information. Why vulnerability reports stall inside shared hosting companies Security teams keep sending vulnerability notifications, and the same pattern keeps repeating. Many alerts land, few lead to fixes. A new qualitative study digs into what happens after those reports arrive and explains why remediation so often stops short. Attackers are exploiting auth bypass vulnerability on FortiGate firewalls (CVE-2025-59718) Attackers are exploiting a recently revealed vulnerability (CVE-2025-59718) to bypass authentication on Fortinet’s FortiGate firewalls, and are leveraging the achieved access to export their system configuration files, Arctic Wolf researchers warned on Tuesday. Exploited SonicWall zero-day patched (CVE-2025-40602) SonicWall has patched a local privilege escalation vulnerability (CVE-2025-40602) affecting its Secure Mobile Access (SMA) 1000 appliances and is urging customers to apply the provided hotfix, as the flaw has been exploited by attackers. Cisco email security appliances rooted and backdoored via still unpatched zero-day A suspected Chinese-nexus threat group has been compromising Cisco email security devices and planting backdoors and log-purging tools on them since at least late November 2025, Cisco Talos researchers have shared. The soft underbelly of space isn’t in orbit, it’s on the ground In this Help Net Security interview, Øystein Thorvaldsen, CISO at KSAT, discusses how adversaries view the ground segment as the practical way to reach space systems and why stations remain a focal point for security efforts. He notes that many risks stem from supply chain gaps and legacy infrastructure that supports critical missions. He also explains how KSAT works to keep latency low while maintaining security across global operations. AI isn’t one system, and your threat model shouldn’t be either In this Help Net Security interview, Naor Penso, CISO at Cerebras Systems, explains how to threat model modern AI stacks without treating them as a single risk. He discusses why partitioning AI systems by function and impact matters, how to frame threat modeling for business leaders, and which assumptions break down as AI becomes core infrastructure. Kali Linux 2025.4: New tools and “quality-of-life” improvements OffSec has released Kali Linux 2025.4, a new version of its widely used penetration testing and digital forensics platform. Most of the changes are related to appearance and usability. Update your Apple devices to fix actively exploited vulnerabilities! (CVE-2025-14174, CVE-2025-43529) Apple has issued security updates with fixes for two WebKit vulnerabilities (CVE-2025-14174, CVE-2025-43529) that have been exploited as zero-days. Several days before the release of these updates, Google fixed CVE-2025-14174 in the desktop version of Chrome, though at the time the issue did not have a CVE number nor a description. SoundCloud breached, hit by DoS attacks Audio streaming service SoundCloud has suffered a breach and has been repeatedly hit by denial of service attacks, the company confirmed on Monday. In the days leading up to the confirmation, users accessing SoundCloud through VPNs reported connection failures and error messages. European police busts Ukraine scam call centers Law enforcement agencies from several European countries have arrested twelve persons suspected of being involved in scamming victims across Europe, Eurojust announced. The fraudsters used various scams, such as posing as police officers to withdraw money using their victims’ cards and details, or pretending that their victims’ bank accounts had been hacked. Microsoft 365 users targeted in device code phishing attacks Attackers are targeting Microsoft 365 users with device code authorization phishing, a technique that fools users into approving access tokens, Proofpoint warns. The method abuses Microsoft’s OAuth 2.0 device authorization grant flow by presenting users with device codes that, when entered, inadvertently grant attackers control of enterprise accounts. Crypto theft in 2025: North Korean hackers continue to dominate When they strike cryptocurrency-related targets, North Korean hacking groups are increasingly aiming for large services where a single breach can move serious money, a new Chainalysis report on crypto theft in 2025 revealed. Clipping Scripted Sparrow’s wings: Tracking a global phishing ring Between June 2024 and December 2025, Fortra analysts tracked a persistent business email compromise (BEC) operation that we have now classified as Scripted Sparrow. The group carries out well-crafted highly targeted phishing campaigns that masquerade as professional services firms to mislead finance teams into transferring money to fraudsters’ accounts. More than half of public vulnerabilities bypass leading WAFs Miggo Security has released a new report that examines how web application firewalls are used across real-world security programs. The research outlines the role WAFs play as foundational infrastructure and evaluates their effectiveness against critical vulnerabilities, CVEs, and AI-driven threats. How exposure management changes cyber defense In this Help Net Security video, Larry Slusser, VP of Strategy at SixMap, explains why endpoint detection and response is only part of the security story. Drawing on his work as an incident responder, engagement manager, and ransomware negotiator, he describes EDR as the armed guard that reacts after an intruder crosses the line. What types of compliance should your password manager support? Lost credentials and weak authentication controls still sit at the center of many security incidents. IT leaders and CISOs know this problem well. They also know that regulators watch how organizations protect passwords, track access, and document security decisions. That is why password managers have become part of compliance conversations rather than optional add ons. AI might be the answer for better phishing resilience Phishing is still a go-to tactic for attackers, which is why even small gains in user training are worth noticing. A recent research project from the University of Bari looked at whether LLMs can produce training that helps people spot suspicious emails with better accuracy. Banks built rules for yesterday’s crime and RegTech is trying to fix that Criminals are moving money across borders faster, and financial institutions are feeling the squeeze. Compliance teams feel this strain every day as they try to keep up with schemes that shift through accounts, intermediaries, and digital channels. A new academic review of regulatory technology, or RegTech, shows how this pressure is reshaping compliance work and why research in this field is gaining new weight. Should AI access be treated as a civil right across generations? AI use is expanding faster than the infrastructure that supports it, and that gap is starting to matter for security, resilience, and access. A new position paper argues that access to AI should be treated as an intergenerational civil right, rather than a service shaped mainly by market forces. Privacy risks sit inside the ads that fill your social media feed Regulatory limits on explicit targeting have not stopped algorithmic profiling on the web. Ad optimization systems still adapt which ads appear based on users’ private attributes. At the same time, multimodal LLMs have lowered the barrier for turning these hidden signals into profiling tools. A new study examines this risk and asks how outside parties could use these signals to infer private attributes from ad exposure alone. LLMs work better together in smart contract audits Smart contract bugs continue to drain real money from blockchain systems, even after years of tooling and research. A new academic study suggests that large language models can spot more of those flaws when they work in coordinated groups instead of alone. Manufacturing is becoming a test bed for ransomware shifts Manufacturing leaders may feel that ransomware risk has settled, but new data shows the threat is shifting in ways that require attention, according to a Sophos report. A global survey of 332 IT and security leaders outlines how attackers are adjusting tactics and how organizations are absorbing the impact of those changes. Europe’s DMA raises new security worries for mobile ecosystems Mobile security has long depended on tight control over how apps and services interact with a device. A new paper from the Center for Cybersecurity Policy and Law warns that this control may weaken as the European Union’s Digital Markets Act pushes mobile platforms to open core functions to outside developers. Prometheus: Open-source metrics and monitoring systems and services Prometheus is an open-source monitoring and alerting system built for environments where services change often and failures can spread fast. For security teams and DevOps engineers, it has become a common way to track system behavior, spot early warning signs, and understand what is happening across large sets of workloads. What Cloudflare’s 2025 internet review says about attacks, outages, and traffic shifts The internet stayed busy, brittle, and under constant pressure in 2025. Cloudflare’s annual Radar Year in Review offers a wide view of how traffic moved, where attacks clustered, and what failed when systems were stressed. Passwordless is finally happening, and users barely notice Security teams know the strain that comes from tightening authentication controls while keeping users productive. A new report from Okta suggests this strain is easing. Stronger authentication methods are gaining traction, and many of them let users move through sign in flows with less effort than before. The report indicates that the long held belief that better security slows people down is becoming less relevant as these methods improve both protection and usability. Product showcase: GlassWire mobile firewall for Android GlassWire is a free network monitoring and security application for Windows and Android. It lets you see how your system communicates over the internet and local network. The Windows version also offers a Premium tier with advanced features, while the Android app focuses on monitoring and control. By combining visual network activity with simple controls, GlassWire helps you understand what’s happening behind the scenes and take action when something looks out of the ordinary. AI breaks the old security playbook AI has moved into enterprise operations faster than many security programs expected. It is embedded in workflows, physical systems, and core infrastructure. Some AI tools reach hundreds of millions of users each week. Inference costs have fallen 280 fold, but overall spending is still rising because usage keeps growing. Zabbix: Open-source IT and OT observability solution Zabbix is an open source monitoring platform designed to track the availability, performance, and integrity of IT environments. It monitors networks along with servers, virtual machines, applications, services, databases, websites, and cloud resources. What cybersecurity leaders are reading to stay ahead If you’re looking for holiday gift ideas, books remain one of the simplest ways to spark curiosity and support someone’s growth. Whether the person on your list is exploring cybersecurity, AI, engineering, or career development, these titles offer something useful for readers at every stage of their professional journey. Group Policy abuse reveals China-aligned espionage group targeting governments ESET Research has identified a previously undocumented China-aligned advanced persistent threat group that uses Windows Group Policy to deploy malware and move through victim networks. The group, tracked as LongNosedGoblin, has targeted government institutions in Southeast Asia and Japan with a toolset built for long-term surveillance. Identity risk is changing faster than most security teams expect Security leaders are starting to see a shift in digital identity risk. Fraud activity is becoming coordinated, automated, and self-improving. Synthetic personas, credential replay, and high speed onboarding attempts now operate through shared infrastructures that behave less like scattered threats and more like systems that learn as they run, according to a report by AU10TIX. Product showcase: NAKIVO v11.1 advances MSP service delivery with secure multi-tenant management NAKIVO Backup & Replication v11.1 brings a host of benefits to MSPs and their clients. It eliminates the need for client-side port configuration, enhances security with encrypted multi-platform support, and introduces automated failover capabilities. These features are designed specifically for managed service providers, offering them a more efficient and secure way to protect client infrastructure. Cybersecurity jobs available right now: December 16, 2025 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: December 19, 2025 Here’s a look at the most interesting products from the past week, featuring releases from Apiiro, Astra Security, Push Security, Trellix, and XM Cyber.

Prometheus: Open-source metrics and monitoring systems and services Prometheus is an open-source monitoring and alerting system built for environments where services change often and failures can spread fast. For security teams and DevOps engineers, it has become a common way to track system behavior, spot early warning signs, and understand what is happening across large sets of workloads. The project began at SoundCloud and is now hosted by the Cloud Native Computing Foundation, where it sits alongside Kubernetes and other core cloud-native tools. Prometheus is designed around a simple idea, collect metrics from systems, store them locally, and make them easy to query and alert on. A metrics model built for scale Prometheus uses a time series data model. Every metric is stored with a name and a set of labels that describe the source. Labels can include details such as service name, instance, region, or role. This structure lets teams slice and group data without redefining metrics every time infrastructure changes. Metrics are numeric and sampled at regular intervals. That makes them suitable for tracking system health indicators like CPU usage, memory pressure, request rates, and error counts. For security teams, the same model can support signals such as authentication failures, unusual traffic spikes, or service restarts. Prometheus stores data locally on disk. The design avoids a dependency on remote storage during collection, which helps keep monitoring available during outages or network issues. Long-term storage can be added through remote write integrations when needed. Pull-based collection and service discovery One of the defining features is its pull-based approach to data collection. Prometheus scrapes metrics from targets over HTTP at defined intervals. Each target exposes a metrics endpoint, often at a standard path. This model fits dynamic environments. Prometheus includes service discovery mechanisms for platforms like Kubernetes, cloud providers, and virtual machine fleets. Targets can appear and disappear without manual updates to configuration files. Security teams benefit from this approach when monitoring ephemeral workloads such as containers or short-lived jobs. Visibility does not depend on agents pushing data to a central point, which can reduce complexity and limit the risk of blind spots. PromQL gives teams direct answers Prometheus includes its own query language called PromQL. The language is designed to work directly with time series data. Queries can filter metrics by label, calculate rates, aggregate values, and compare current behavior with historical baselines. PromQL is used across the Prometheus ecosystem. Dashboards, alerts, and ad hoc investigations rely on the same query language. That consistency helps teams share queries and understand each other’s work. For incident response, PromQL supports fast exploration. Teams can ask focused questions such as which services are seeing rising error rates or which nodes are under memory pressure right now. Alerting tied to behavior, not static rules Prometheus includes an alerting system that evaluates PromQL expressions over time. Alerts fire when conditions hold true for a defined duration. This reduces noise from brief spikes or transient issues. Alerts describe symptoms rather than events. A rule might watch for sustained increases in failed login attempts or sudden drops in service availability. Alertmanager, a companion component, handles grouping, routing, and notification delivery. This approach aligns with how security and operations teams work during incidents. Alerts point to patterns that need attention instead of individual log entries. An ecosystem that grows with the platform Prometheus has a large ecosystem of exporters that expose metrics from databases, operating systems, network devices, and applications. Many security tools and infrastructure platforms provide Prometheus-compatible endpoints by default. The project documentation emphasizes simplicity and composability. Prometheus does one job, collect and query metrics. Visualization tools like Grafana and long-term storage systems can be added without changing the core design. Prometheus is available for free on GitHub. Must read: 40 open-source tools redefining how security teams secure the stack OpenGuardrails: A new open-source model aims to make AI safer for real-world use Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

A new hacking competition called Zeroday Cloud, focused on open-source cloud and AI tools, announced a total prize pool of $4.5 million in bug bounties for researchers that submit exploits for various targets. The contest is launched by the research arm of cloud security company Wiz in partnership with Google Cloud, AWS, and Microsoft, and is scheduled for December 10 and 11 at the Black Hat Europe conference in London, UK. Zeroday Cloud has six separate categories researchers can participate in, with bug bounties between $10,000 and $300,000: AI – Ollama ($25k), Vllm ($25k), Nvidia Container Toolkit ($40k) Kubernetes and Cloud-Native – Kubernetes API Server ($80k), Kubelet Server ($40k), Grafana ($10k auth RCE, $40k pre-auth RCE), Prometheus ($40k), Fluent Bit ($10k) Containers and Virtualization – Docker ($40 user-provided image, $60k arbitrary image), Containerd ($40 user-provided image, $60k arbitrary image), Linux Kernel ($30k container escape on Ubuntu) Web Servers – nginx ($300k), Apache Tomcat ($100k), Envoy ($50k), Caddy ($50k) Databases – Redis ($25k auth RCE, $100k pre-auth RCE), PostgreSQL ($20k auth RCE, $100k pre-auth RCE), MariaDB ($20k auth RCE, $100k pre-auth RCE) DevOps & Automation – Apache Airflow ($40k), Jenkins ($40k), GitLab CE ($40k) The rules of the competition say that submitted exploits should result in complete compromise of the target. Wiz explains that this means "a full Container/VM Escape for the Virtualization category, and a 0-click Remote Code Execution (RCE) vulnerability for other targets." The organizers also provide the conditions for each target, as well as the instructions and technical resources (Docker container with target on default configuration) security researchers can use to test their exploits. Researchers who register through the HackerOne platform and complete their ID verification and Tax Forms by November 20, are free to submit exploits for as many targets as they like, but they are limited to only one entry per target. Submitters of approved exploits will be invited to demonstrate them live during the event, either alone or in a team of up to five members. People residing in embargoed or sanctioned countries such as Russia, China, Iran, North Korea, Cuba, Sudan, Syria, Libya, Lebanon, and also the regions of Crimea and Donetsk, are restricted from participating in the Zeroday Cloud contest. The complete rules for the zeroday.cloud hacking competition are available here. The announcement for the event, however, did not resonate well with the organizers of the Pwn2Own hacking competitions that have been going with great success for several years. In a public post, Trend Micro called out Wiz for copying the rules for Pwn2Own Ireland. Juan Pablo Castro, Director of Cybersecurity Strategy & Technology at Trend Micro, said that Gemini's output when comparing the rules for the two events were a "word-for-word" copy. Wiz responded with a defusing statement, admitting that the Pwn2Own rulebook was "a trusted, mature framework by which we were inspired." Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Nel mondo della sicurezza informatica, prevenire un attacco è spesso più importante che rilevarlo o mitigarne i danni. Per anticipare le mosse dei criminali digitali è essenziale conoscerne strategie e tecniche, così da poterle contrastare in tempo. Gli honeypot nascono proprio con questo scopo: sono sistemi “esca” che simulano ambienti reali per attirare i cybercriminali e studiarne comportamenti e obiettivi in un contesto controllato e sicuro. Tra le soluzioni più innovative in questo ambito spicca Beelzebub, un framework open-source ideato da Mario Candela, che integra l’intelligenza artificiale (IA) nei tradizionali honeypot. Grazie all’uso dei Large Language Models (LLM), Beelzebub permette di creare honeypot ad alta interazione in modo semplice e scalabile, offrendo un potente strumento per osservare, analizzare e anticipare attacchi informatici. In questo articolo analizziamo nel dettaglio cos’è Beelzebub, come funziona e quali vantaggi offre. Cos’è un honeypot? In sicurezza informatica, un honeypot – termine inglese che significa letteralmente “barattolo di miele” – è un sistema, ad esempio un server, progettato come trappola per attirare attacchi informatici. Si presenta come un bersaglio facile da colpire per i cybercriminali e sfrutta i loro tentativi di intrusione per ottenere informazioni su di loro e sul modo in cui operano, distraendoli inoltre da altri bersagli più rilevanti. Le informazioni raccolte possono poi essere sfruttate per rafforzare i sistemi di difesa e quindi prevenire attacchi a sistemi critici. Per renderli più “appetibili”, gli honeypot vengono costruiti attorno vulnerabilità di sicurezza. Ad esempio, possono avere porte di rete che rispondono alle scansioni, oppure lasciare aperti determinati servizi per invogliare l’aggressore a entrare nell’ambiente isolato invece che nella rete aziendale reale. All’interno di un honeypot vi sono dati creati per sembrare riservati, così come informazioni “sensibili”, al fine di convincere l’aggressore di aver ottenuto accesso ad un sistema critico per l’azienda. Gli honeypot si possono differenziare in base alla complessità del sistema: Un honeypot ad alta interazione è progettato per indurre i cybercriminali ad investire il più tempo possibile all’interno del honeypot. Ciò permette di avere più tempo per analizzare le strategie utilizzate dall’aggressore e i suoi obbiettivi. Offrono molte informazioni, ma richiedono maggiori risorse e un monitoraggio costante. Un honeypot di media interazione imita un’applicazione vera e propria, ma non ha un sistema operativo. Il loro scopo principale è guadagnare tempo, consentendo all’organizzazione di reagire rapidamente a un attacco in corso. Un honeypot a bassa interazione richiede meno risorse e raccoglie meno informazioni riguardo le strategie utilizzare dall’attaccante. Se da un lato, un honeypot a bassa interazione è relativamente semplice da implementare, dall’altro, al suo interno non ci sono dati “riservati” che possano interessare l’attaccante. Beelzebub è un framework open-source che utilizza Large Langues Models (LLMs) per simulare honeypot ad alta interazione in modo completamente autonomo. In particolare, l’intelligenza artificiale (IA) agisce come un terminale Linux e funziona come un honeypot ad alta interazione lato front-end, ma operando come un honeypot a bassa interazione lato back-end. La virtualizzazione di queste honeypot tramite LLM elimina la necessità di una supervisione continua da parte di umani. Beelzebub è inoltre entrata a far parte del programma NVIDA Inception, l’iniziativa dedicata alle startup innovative che operano nei campi dell’intelligenza artificiale (IA), offrendo loro risorse tecniche, formazione, visibilità sul mercato e accesso al network di NVIDIA e dei suoi partner. Funzionalità Beelzebub mette a disposizione numerose funzionalità: Supporto multi-protocollo: gestisce diversi protocolli di rete, tra cui TCP (Transmission Control Protocol), HTTP (Hypertext Transfer Protocol), HTTPS (Hypertext Transfer Protocol Secure), SSH (Secure Shell) e MCP (Model Context Protocol). Configurazione semplice: è possibile creare un honeypot senza scrivere codice, definendo le configurazioni in un semplice file YAML. Distribuzione flessibile: supporta diversi ambienti di distribuzione, come Docker, Kubernetes (tramite Helm) e il compilatore Go, adattandosi sia a sistemi locali che a infrastrutture cloud. Integrazione con ELK Stack: consente di visualizzare i dati in tempo reale tramite Kibana, facilitando l’analisi degli eventi raccolti. Monitoraggio con Prometheus: grazie al supporto per OpenMetrics, è possibile raccogliere e analizzare metriche dell’honeypot e creare dashboard personalizzate su Grafana. Integrazione con RabbitMQ: il broker di messaggistica permette di collegare Beelzebub a sistemi esterni per notifiche o automazioni. Conclusione La sua semplicità di configurazione, l’integrazione con strumenti di monitoraggio e la distribuzione flessibile lo rendono uno strumento estremamente utile per chi si occupa di difesa informatica. Noi della redazione di 8Bit non possiamo che complimentarci con Mario Candela per la realizzazione di questo framework e, più in generale, per il suo costante supporto alla community.