Library / sourced records

Resource library

Search by kind, technique, environment or critical readings. Each record states its source and review depth.

132published resources

Results

10 found

Case study2026

Cargo Theft Actor in a Persistent Decoy

Review: Public pageCritical reading

Proofpoint observed post-compromise activity for over a month in a Deception.Pro decoy environment; adversary behavior research, not a commercial effectiveness trial.

EndpointNetworkDecoyAdversary engagement

Proofpoint Threat Research

Paper2026

Refuerzo de estrategias de ciber engaño mediante comportamiento simulado de usuarios

Review: AbstractEditor contribution

Pacheco and Staino present BUDA as an approach to simulating fictitious-user activity and strengthening decoy credibility, aligned with MITRE Engage.

EndpointNetworkDecoyAdversary engagement

Federico Pacheco y Diego Staino

Case study2026

Trapping a Mustang Panda

Review: Public pageCritical reading

IBM X-Force and Deception.Pro recorded two incidents in simulated organizations, observing reconnaissance, malware deployment and fake-document exfiltration.

EndpointOT/ICSDecoyAdversary engagement

IBM X-Force

Open software2025

BUDA

Review: RepositoryEditor contribution

Experimental framework generating fictitious user profiles and activity for decoy environments; the repository documents narratives, profiles and language-model integration.

EndpointNetworkDecoyAdversary engagement

BASE4 SecurityCompare

Paper2020

Cyber Deception for Computer and Network Security: Survey and Challenges

Review: AbstractCritical reading

Survey of defensive deception models and techniques in networks, hosts and cryptographic mechanisms.

NetworkEndpointDecoy

Lu et al.

Paper2018

RansomTracer: Exploiting Cyber Deception for Ransomware Tracing

Review: Metadata

Bibliographic record on ransomware tracing through deception. The abstract and findings still require review.

EndpointDecoy

ZiHan Wang, Xu Wu

Open software2015

ghost-usb-honeypot

Review: Repository

Repository about capture of USB-propagated malware; documentation and maintenance require further review.

EndpointHoneypot

honeynetCompare

Product—

Deception.Pro

Review: Public pageCritical reading

Persistent instrumented environments for malware detonation and adversary observation, according to the platform description.

NetworkEndpointDecoyAdversary engagement

Deception.ProCompare

Case study—

Energy Company / Proofpoint Shadow

Review: Public pageCritical reading

Energy company Shadow adoption story published by Proofpoint; investigation-time reduction is a customer statement reported by the vendor.

EndpointIdentityDecoy

Proofpoint

Product—

Proofpoint Shadow

Review: Public pageCritical reading

Commercial identity protection component deploying endpoint deceptions to alert on lateral movement, according to Proofpoint.

EndpointIdentityDecoyHoneytoken

ProofpointCompare

Each record shows the source reviewed. Vendor claims and independent results are labeled separately.