Skip to content

ATDE 2.0.0 — Threat Disruption Platform

Choose a tag to compare

View all tags
@theworker02 theworker02 released this 24 Sep 22:42
· 14 commits to main since this release
v2.0.0
7b09eb6

ATDE 2.0.0 — Threat Disruption Platform

Autonomous Threat Disruption Engine — defensive catch + graduated disruption for infrastructure you own.

This is the first public tagged release of the ATDE 2.0 line: a ten-surface bait mesh, policy-driven containment, campaign intelligence, SIEM/TIP exports, fleet ban sync, and an acquisition-ready IP packet.

Headline

Deploy one catch-node → scanners hit decoys → every hit is fingerprinted (with MITRE ATT&CK), campaign-clustered, and escalated through a graduated policy (observe → tarpit → local ban → cloud → abuse pack) — still zero hack-back.

What's new in 2.0.0

Bait mesh (10 surfaces)

Port Surface
8080 Atlas Control Plane (HTTP honeypot)
2222 SSH password-burn
6379 Redis protocol bait
2323 Telnet login bait
3306 MySQL greeting / auth bait
2121 FTP login bait
2525 SMTP AUTH bait
9200 Elasticsearch probe bait
27017 MongoDB probe bait
8443 Deception L7 API

Disruption core

  • Graduated policy engine (internal/policy) — severity + hit-count tiers
  • Local-first containment — Linux ipset / Windows netsh, fail-soft Cloudflare / AWS WAFv2
  • Fleet ban sync — owned-node pull list at GET /v1/fleet/bans
  • Adaptive tarpit on owned decoy listeners

Intelligence & export

  • Campaign correlator — GET /v1/campaigns
  • MITRE ATT&CK technique tags on fingerprints / dossiers
  • Exports: Abuse Markdown · STIX 2.1 · ECS JSONL · CEF · MISP
  • Operator console + OpenAPI catch API (/v1/openapi.json)
  • OpenPGP owner email alerts + webhook notifier

Packaging & diligence

  • Catch-node Compose (deployments/catch-node.yml)
  • Full JetStream mesh Compose (optional)
  • Acquisition brief, Schedule A, short-form TRANSFER.md, valuation thesis, SKUs, demo evidence
  • GETTING-THE-RIGHTS.md — three-step acquirer close

Quick start

git clone https://github.com/theworker02/blind-botnet.git
cd blind-botnet
cp .env.example .env
# recommended: ATDE_OPS_TOKEN=long-random-secret
docker compose -f deployments/catch-node.yml up -d --build
bash scripts/verify-catch.sh
# console: http://YOUR_IP:9091/console  (lock 9091 to your admin IP)

Lab without public hits:

go run ./cmd/atde -mode seed-demo
go run ./cmd/atde -mode caught

Legal / non-goals

ATDE is defensive only on owned infrastructure:

  • No stolen Telegram/webhook token flooding
  • No third-party botnet DHT attacks
  • No offensive action against hosts you do not own

See docs/LEGAL.md and ADR-0003.

Docs for operators & acquirers

Doc Purpose
RELEASE.md Release overview
docs/CATCH.md Deploy → bait → record playbook
acquisition.md Acquisition brief
GETTING-THE-RIGHTS.md IP transfer in 3 steps
CHANGELOG.md Full changelog
SECURITY.md Supported versions / disclosure

Checksums / version

  • Semver: 2.0.0 (atde -version)
  • License: Apache-2.0
  • Module: github.com/theworker02/blind-botnet

Sponsor: @theworker02 · thanks.dev/u/gh/theworker02

Assets 2
Loading