IoT Deception Honeypot Network (MQTT) · Hacking Project

Deploy a realistic, instrumented MQTT deception fabric that captures, enriches, and analyzes adversary activity against IoT messaging infrastructure.

**The problem**
IoT and OT environments expose lightweight pub/sub protocols like MQTT, CoAP, and Modbus that frequently ship with weak authentication, no TLS, and permissive topic wildcards, making them prime targets for botnet recruitment (Mirai-class) and lateral movement. Defenders lack visibility into who is probing their broker fleet and what payloads adversaries attempt to publish. Traditional network sensors do not understand MQTT semantics (CONNECT, SUBSCRIBE, PUBLISH), so malicious topic enumeration and credential brute-forcing go unnoticed.

**What you'll build**
Build a distributed deception network of high- and low-interaction MQTT honeypots that emulate realistic broker behavior, fake device fleets, and vulnerable topics, capturing full protocol transcripts, credentials, and published payloads. Enrich captured indicators against threat intel feeds and forward structured events to a SIEM/ELK pipeline for hunting and detection engineering. Deploy across cloud and edge nodes to map attacker geography, tooling, and campaign patterns.

**Objective** — Deploy a realistic, instrumented MQTT deception fabric that captures, enriches, and analyzes adversary activity against IoT messaging infrastructure.

**Expected outcome** — A working multi-node MQTT honeypot with a SIEM dashboard, captured attack corpus (credentials, topics, payloads), and a threat-intel report of observed TTPs and IOCs.

**Difficulty** — Advanced — requires protocol-level emulation, distributed deployment, and detection-engineering maturity beyond a single-host honeypot.

**Primary category** — Threat Intelligence / Deception Technology; Secondary = SOC, Threat Hunting, IoT/OT Security

**Security domains** — Primary = Blue Team; Secondary = Threat Intelligence, Security Research, Incident Response, Purple Team

**Technical focus** — MQTT/CoAP protocol emulation, honeypot engineering (low/high interaction), deception grids, log pipeline/SIEM, IOC enrichment, botnet analysis, TLS interception, geo/ASN attribution

**Core technologies** — Languages: Python, Go, Bash; Frameworks/Libraries: paho-mqtt, Mosquitto, Eclipse Ditto, Cowrie/T-Pot patterns, Scapy; Security Tools: T-Pot, Dionaea, Suricata, Zeek, MISP; Cloud/Infra: Docker/Compose, Kubernetes, cloud VPS across regions, WireGuard mesh; AI/Data: ELK/OpenSearch, pandas, optional clustering for campaign grouping; Databases: Elasticsearch, PostgreSQL, Redis

**Where it's valued** — Manufacturing/OT, smart-home and consumer IoT vendors, telecom, critical infrastructure, MSSPs, threat-intel providers

**Careers it builds toward** — Threat Intelligence Analyst, Detection Engineer, SOC Analyst (Tier 2/3), Deception Engineer, IoT Security Researcher

**Framework alignment**
• MITRE ATT&CK: Reconnaissance — Active Scanning (T1595); Credential Access — Brute Force (T1110); Initial Access via valid accounts (T1078); ATT&CK for ICS — Network Connection Enumeration, Command-Line/Remote Services; Persistence via botnet C2 (T1071 Application Layer Protocol).
• NIST CSF 2.0: Detect (Continuous Monitoring, Adverse Event Analysis), Identify (asset/attack-surface awareness), Respond (analysis and reporting).
• OWASP: IoT Top 10 — I1 Weak/Guessable Passwords, I2 Insecure Network Services, I5 Insecure Data Transfer; API Top 10 API2 Broken Authentication (broker auth).
• CIS Controls v8: 8 Audit Log Management, 13 Network Monitoring and Defense, 1/2 Asset/Software Inventory (decoy fleet), 4 Secure Configuration.

**Innovation** — Improved Existing Solution — MQTT-aware deception is less commercially mature than SSH/HTTP honeypots, and a distributed, intel-enriched MQTT grid with campaign clustering has research and product angles. Scores: Innovation 7/10, Startup 6/10, Enterprise-Readiness 6/10, Patent = Possible.