Hackers Caught Inside Resecurity Honeypot After Targeting Employee Network

Cybersecurity firm Resecurity successfully lured threat actors using deception technology after hackers targeted its systems in November 2025.

The operation exposed the attacker’s infrastructure and prompted law enforcement involvement, demonstrating the effectiveness of synthetic data honeypots against financially motivated cybercriminals.

Initial Attack and Honeytrap Deployment

The incident began on November 21, 2025, when Resecurity’s DFIR team detected a threat actor probing publicly facing services and targeting an employee with limited access.

Investigators documented initial connections from Egyptian IP addresses (156.193.212.244 and 102.41.112.148) alongside VPN services.

Rather than blocking the intrusion, security teams deployed a honeytrap account containing synthetic data to monitor attacker behavior.

The trap used over 28,000 fake consumer records and 190,000 fabricated payment transactions built from publicly available Dark Web data.

This realistic-looking but worthless information included dummy Stripe payment records and generated email addresses from combo lists.

Resecurity also created a decommissioned Mattermost messaging environment with outdated 2023 logs to complete the deception.

The threat actor took the bait. Between December 12 and December 24, attackers made over 188,000 automated requests attempting to steal the synthetic data using residential IP proxies.

During this activity, connection failures resulted in multiple operational security issues, exposing the attacker’s actual IP addresses. Resecurity documented these errors and shared abuse data with law enforcement and ISPs.

ShinyHunters Group Falls into Trap

Following publication of the operation, the notorious ShinyHunters cybercrime group falsely claimed they had “compromised” Resecurity systems.

The group unknowingly accessed the honeytrap environment at “honeytrap.b.idp.resecurity.com” under the planted “Mark Kelly” account.

The screenshots they shared as proof actually confirmed they had fallen into the trap.

Resecurity investigators linked the activity to a US-based Gmail account through social engineering.

They recovered phone numbers via password reset functions. All intelligence has been provided to law enforcement for further investigation.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.