Blog

Most people treat Monero like it’s a black box. They assume once they hit "send", it’s all invisible. Anonymous. Untouchable.But Monero’s privacy guarantees start at the protocol level - not the network level. And that’s where most people get exposed.We built a tool to show how.🔥 Enter <a data-mce-href="https://github.com/covertsecurity/xmrpot" href="https://github.com/covertsecurity/xmrpot" target="_blank" rel="noopener">XMRPot</a> -&nbsp; a honeypot proxy designed to look like a public Monero remote node.Except it’s not.<ul><li>It doesn’t mine. </li><li>It doesn’t broadcast honestly. </li><li>It doesn’t care about helping the network.</li></ul>What it does do is log every connection that comes through:<ul><li>IP address</li><li>Endpoint requested</li><li>Raw POST data</li><li>Response returned</li><li>Timestamps</li></ul>All of it - Base 64 encoded and archived. In short: it’s a silent observer.<h3>🎯 What Does It Do?</h3>XMRPot acts as a fake Monero node that forwards requests to a real upstream node while recording everything in the middle.It exposes two hidden routes (secured via UUID):<ol><li>/monitor/ - dumps all logged request data </li><li>/statistics/ - returns summarized analytics:</li></ol><ul><li>Total requests. </li><li>Unique IP's. </li><li>Per-route usage breakdown. </li><li>No authentication. No complexity. Just spin it up and watch.</li></ul><h3>🧠 How It Works (Technical Breakdown)</h3><ol><li>Proxy Handling</li></ol><ul><li style="list-style-type: none;" data-mce-style="list-style-type: none;"><ul><li>It proxies any whitelisted Monero RPC endpoint to an upstream node. </li><li>It supports both GET and POST methods. </li><li>Unsupported routes return 404. </li></ul></li></ul>2. Logging<ul><li style="list-style-type: none;" data-mce-style="list-style-type: none;"><ul><li>IP (Via X-Forwarded-For or remote address).</li><li>Requested endpoint.</li><li>Sent data.</li><li>Received data.</li><li>Status code.</li><li>Timestamp.</li></ul></li></ul>Logs are stored in a flat "request_log.json" file (JSON array of entries). All data is Base64 encoded to preserve binary payload integrity. 3. Monitoring and Statistics<ul><li style="list-style-type: none;" data-mce-style="list-style-type: none;"><ul><li>/monitor/ - Dumps full log of actions. </li><li>/statistics/ - see below...<ul><li>Unique IP count.</li><li>Request counts per route.</li><li>Total request volume.</li><li>Deployment.</li></ul></li></ul></li></ul>4. Runing the Tool<ul><li style="list-style-type: none;" data-mce-style="list-style-type: none;"><ul><li>Run with: "python3 xmrpot.py" and that's it.</li><li>Listens on <a href="http://0.0.0.0:18081" data-mce-href="http://0.0.0.0:18081">0.0.0.0:18081</a> by default. </li><li>You get a randomized UUID for accessing sensitive routes on startup.</li></ul></li></ul><h3>🧨 Why This Matters</h3>Monero’s protocol is strong - no question.But the network layer is full of holes. If you connect to a malicious remote node (like this one), your metadata is exposed:<ul><li>Home IP's.</li><li>Timing correlation.</li><li>Potential to fingerprint wallet behavior.</li></ul>Most users never verify what node they’re talking to. They trust random ones. And trust, in a privacy system, is the biggest vulnerability.<h3>🔗 Source</h3>Tool source code: 👉&nbsp;<a href="https://github.com/covertsecurity/xmrpot" target="_blank" rel="noopener" data-mce-href="https://github.com/covertsecurity/xmrpot">github.com/covertsecurity/xmrpot</a> If you care about privacy, run your own node. If you're curious what people leak when they don’t pay attention - now you can watch.

Monero Isn’t Bulletproof: Meet XMRPot - The Honeypot Proxy for Passive Surveillance

Ransomware Data Breach Protection Cyber Security Email Phishing Encrypted Technology, Digital Information Protected Secured

When attackers tunnel covert channels through trusted infrastructure - like Cloudflare protected DNS-over-HTTPS or multimedia platforms - they bypass even the most hardened Fortinet and Checkpoint deployments.The result?✅ No alerts. ✅ No visibility. ✅ No suspicion - just normal-looking traffic.Here’s a curated list of tools and techniques that make this possible. Each leverages covert channel methods - some obscure, some highly advanced - to exfiltrate data or communicate with C2 infrastructure right under defenders’ noses.<h3>🔧 Kernel &amp; Driver-Level Covert Channels</h3>1. 🧬 cat-soup &nbsp; ➡️ eBPF-based Linux rootkit. Exfiltrates via kernel-level system call hijacking. &nbsp; GitHub: https://github.com/chumachok/cat-soup2. 🕓 NTPTunnel &nbsp; ➡️ Tunnels C2 over Network Time Protocol (NTP) messages. Low visibility. &nbsp; GitHub: https://github.com/ricklahaye/NTPTunnel3. 📡 NetworkCovertChannels &nbsp; ➡️ Protocol-hopping, protocol-switching, and active warden evasion techniques. Research-grade suite. &nbsp; GitHub: https://github.com/cdpxe/NetworkCovertChannels/tree/master<h3>🧬 Protocol Steganography</h3>4. 📜 x509 &nbsp; ➡️ Encodes data in TLS certificates (X.509 extensions). Invisible during HTTPS handshakes. &nbsp; GitHub: https://github.com/ProbieK/x5095. 🌐 IPv6-Attacks-and-Covert-Channels &nbsp; ➡️ Covert data in IPv6 extension headers, flow labels, and options. &nbsp; GitHub: https://github.com/n3m351d4/IPv6-Attacks-and-Covert-Channels6. 📘 IPv6teal &nbsp; ➡️ Exfiltration using IPv6 Destination Options and Hop-by-Hop headers. &nbsp; GitHub: https://github.com/christophetd/IPv6teal7. 🧬 DNSExfiltrator &nbsp; ➡️ Hides data in DNS requests (labels, TTLs, responses). Works with DNS-over-HTTPS. &nbsp; GitHub: https://github.com/Arno0x/DNSExfiltrator8. 🌐 WebDavDelivery &nbsp; ➡️ Uses HTTP WebDAV methods (PROPFIND) to deliver payloads via XML fields. &nbsp; GitHub: https://github.com/Arno0x/WebDavDelivery9. 📡 pingtransfer &nbsp; ➡️ Covert ICMP tunnel. Hides payloads in ping echo/reply packets. &nbsp; GitHub: https://github.com/yilmi/pingtransfer10. 🔧 Simple Packet Sender &nbsp; ➡️ Craft custom raw packets. Great for prototyping covert headers or timing channels. &nbsp; Website: https://sites.google.com/site/simplepacketsender/<h3>📶 Wireless &amp; Network Tunneling</h3>11. 📡 GhostTunnel-Go &nbsp; ➡️ Covert Wi-Fi C2 using 802.11 management frames. Cross-platform. &nbsp; GitHub: https://github.com/AmyangXYZ/GhostTunnel-Go12. 👻 GhostTunnel (C/C++) &nbsp; ➡️ Native implementation for stealthy layer-2 exfiltration over Wi-Fi. &nbsp; GitHub: https://github.com/PegasusLab/GhostTunnel13. 📶 WiFi_CCC &nbsp; ➡️ Chat-style covert channel using SSID beacon timing. &nbsp; GitHub: https://github.com/yadox666/WiFi_CCC/tree/master14. 🔁 WiFi_Reconnection_CovertChannel &nbsp; ➡️ Encodes bits via reconnection timing to APs. &nbsp; GitHub: https://github.com/NIoSaT/WiFi_Reconnection_CovertChannel<h3>🎧 Cloud &amp; Multimedia Channels</h3>15. 🎥 covert-tube &nbsp; ➡️ Encodes C2 data in YouTube video descriptions, metadata, or frames. &nbsp; GitHub: https://github.com/ricardojoserf/covert-tube16. 🎵 Pileus &nbsp; ➡️ SoundCloud-based C2 using steganography in audio tracks. &nbsp; GitHub: https://github.com/Bojak4616/Pileus<h3>🛡️ Detection &amp; Research</h3>17. 🔍 nefias &nbsp; ➡️ Network anomaly detection engine focused on detecting covert and stego channels. &nbsp; GitHub: https://github.com/cdpxe/nefias18. 📚 Research – “Covert Channels in IPv6” (Lucena et al.) &nbsp; ➡️ Landmark academic paper on IPv6 covert channel design. &nbsp; PDF: https://link.springer.com/content/pdf/10.1007/11767831_10.pdf19. 📚 ACM Covert Channel Paper &nbsp; ➡️ Early formalization of covert channel classification. &nbsp; PDF: <a href="https://dl.acm.org/doi/pdf/10.1145/2018436.2018518" data-mce-href="https://dl.acm.org/doi/pdf/10.1145/2018436.2018518">https://dl.acm.org/doi/pdf/10.1145/2018436.2018518</a> <h3>⚔️ Defensive Takeaways</h3><ul><li>🔁 Covert channels span all OSI layers: From layer 2 (Wi-Fi beacons) to layer 7 (TLS x509, DNS).</li><li>☁️ Trusted cloud services are abused: DNS-over-HTTPS, YouTube, SoundCloud, etc.</li><li>📊 Anomaly-based detection works: Tools like nefias use statistical header and timing analysis.</li><li>🧼 Protocol normalization: Strip or rewrite optional headers to disrupt steganographic channels.</li></ul>

Mastering Covert Channels to Become Invisible

Image of obscured secret computer hacker programmer youth wearing hoodie with dark programming computer code background, concept for cyber war hacking technology, encryption coding, Internet crime, software programming, digital data analysis

It's not just the bad guys that can hack - our team recently uncovered the real IP address of the server hosting Medusa Locker's blog and negotiation site, by exploiting a vulnerability in their blog.Medusa Locker primarily targets healthcare, education, and manufacturing sectors, with hundreds of reported attacks since its emergence in 2019. The group operates a Tor-based leak site to pressure victims, where they publish stolen data from organizations that refuse to pay.🧨 After uncovering a high severity vulnerability in Medusa Locker's ransomware blog - we successfully escalated and obtained the true IP address of their hidden host.<figure id="figure-zqtyjya97nm9he3na9"><img id="zqtyjya97nm9he3na9" src="https://cdn.durable.co/blocks/13Ynvsk7ytP0IEZxB7LWDLnK7gGuviseWhZ8S5TLHUl4NHfF0YtXODvjtQKEjs1h.png" alt="" title="" class="object-cover bg-gray-100 " style="aspect-ratio: 16/9; object-position: 0% 50%;" data-corners="default" data-aspect="16:9" data-caption="Figure 1 - Censys results and real site exposed." data-positionX="0%" data-positionY="50%" data-fullWidth="false"/><figcaption class="body-normal text-gray-500 mt-2">Figure 1 - Censys results and real site exposed.</figcaption></figure>📍 Our analysis reveals that the server is located in Saint Petersburg, Russia, hosted by Selectel, one of the largest Russian providers, known for accepting payments in Bitcoin and Litecoin.⏳ 𝘍𝘰𝘭𝘭𝘰𝘸 𝘰𝘶𝘳 𝘱𝘢𝘨𝘦 𝘵𝘰 𝘴𝘵𝘢𝘺 𝘶𝘱𝘥𝘢𝘵𝘦𝘥 𝘧𝘰𝘳 𝘮𝘰𝘳𝘦 𝘦𝘹𝘱𝘰𝘴𝘦𝘴, 𝘢𝘯𝘥 𝘵𝘰 𝘣𝘦 𝘵𝘩𝘦 𝘧𝘪𝘳𝘴𝘵 𝘵𝘰 𝘬𝘯𝘰𝘸 𝘢𝘣𝘰𝘶𝘵 𝘰𝘶𝘳 𝘶𝘱𝘤𝘰𝘮𝘪𝘯𝘨 𝘢𝘥𝘷𝘢𝘯𝘤𝘦𝘥 𝘥𝘢𝘳𝘬 𝘸𝘦𝘣 𝘪𝘯𝘵𝘦𝘭𝘭𝘪𝘨𝘦𝘯𝘤𝘦 𝘤𝘰𝘶𝘳𝘴𝘦!

Deanonymizing Medusa Ransomware's Onion Site

Computer hacker and computer software in the dark

Our team has conducted threat intelligence in the dark web space and identified a technique used to expose the real IP addresses, behind Cloudflare protected sites using authenticated origin pulls.⛓️‍ One of the first targets is "darknetlinks[.]info" - a link collection for dark web forums, marketplaces, exchanges and others.Our investigation showed that the site is using Cloudflare services to protect on a DNS-level, and on a server-level using authenticated origin pulls (AOP), to restrict server traffic only to Cloudflare servers.🗝️ Conducting certificate intelligence using Censys, our team identified their origin certificate with the fingerprint "02a43b2d77464a269fc32fccf79699dea82569215c37134331f7aaba54d63052" and one host "146[.]19[.]143[.]203" server, which serves their dark web link collection.<figure id="figure-wmnuqqlxrm9h7k6p7"><img id="wmnuqqlxrm9h7k6p7" src="https://cdn.durable.co/blocks/27sue0oWpm8N6fqwxpd7tOq4RjiesIn5pSEwHeS1HlJ1aCzhpJd1CceFWhINllND.jpg" alt="" title="" class="object-cover bg-gray-100 " style="aspect-ratio: 16/9; object-position: 0% 0%;" data-corners="default" data-aspect="16:9" data-caption="Figure 1 - Censys Results for 146[.]19[.]143[.]203." data-positionX="0%" data-positionY="0%" data-fullWidth="false"/><figcaption class="body-normal text-gray-500 mt-2">Figure 1 - Censys Results for 146[.]19[.]143[.]203.</figcaption></figure>🛡️ The technique and exposed target are part of Covert Security's upcoming CS-ADWI (Advanced Dark Web Intelligence) course, featuring topics such as...<ul><li>Monero transaction deanonymization through honeypot nodes.</li><li>Hidden service deanonymization on the dark web.</li><li>Deanonymization of Cloudflare protected services on the clear web.</li></ul>🎉 𝘚𝘵𝘢𝘺 𝘵𝘶𝘯𝘦𝘥 𝘧𝘰𝘳 𝘮𝘰𝘳𝘦 𝘶𝘱𝘥𝘢𝘵𝘦𝘴 𝘢𝘯𝘥 𝘦𝘹𝘱𝘰𝘴𝘦𝘴, 𝘢𝘴 𝘰𝘶𝘳 𝘥𝘢𝘳𝘬 𝘸𝘦𝘣 𝘳𝘦𝘴𝘦𝘢𝘳𝘤𝘩 𝘦𝘹𝘱𝘢𝘯𝘥𝘴.

Blog

Monero Isn’t Bulletproof: Meet XMRPot - The Honeypot Prox...

Mastering Covert Channels to Become Invisible

Deanonymizing Medusa Ransomware's Onion Site

Exposing the IP Address of a Dark Web Link Collection