Container Vulnerability Management
In this blog post I want to explain how I manage my containers and how I keep them up to date in my homelab, my cloud infrastructure and the other environments that I maintain.
security
Redtail's Long Runner
Since May, malware hosts have shown up in my honeypot logs, gotten hit once, and disappeared. One host broke that pattern: 217[.]60[.]195[.]113, tied to the Redtail cryptomining botnet, kept getting hit by infected bots for 22.5 days.
MDRFCKR - a (almost) decade old botnet
Between May 3 and June 3, 2026, a threat actor operating under the handle "mdrfckr" conducted a sustained SSH credential-stuffing campaign against my internet-facing SSH honeypots. The campaign deployed 3,929 successful authentication events from 1,702 unique source IPs across 32+ countries. Upon gaining access, the attacker deployed a persistent SSH public key bearing the "mdrfckr" comment - a classic botnet recruitment / persistence mechanism.