What do Ports Hear When Nobody's Listening? An Assessment of Automated Cybercrime [Guest Diary], (Wed, Jun 24th)

**Executive summary:** A SANS ISC intern's honeypot diary documents multiple active botnet campaigns (Terrabot, r00ts3c, RondoDox) scanning and exploiting consumer routers and enterprise services using known CVEs (including Log4Shell and ShadowRay), fileless payloads, and staged binaries, with telemetry showing hardcoded staging servers, user-agents, IP-based IoCs and operational patterns that reveal both sloppy commodity automation and more sophisticated, enterprise-capable infrastructure.