The second pull from the honeynet surfaced a 2017-era WannaCry launcher delivered through DoublePulsar, more than 14,000 EternalBlue sessions from two hosts, and an attacker who planted an SSH key to reach back out to their own infrastructure.
Day one of running a honeynet produced two malware samples in twelve hours. Neither cared about the ICS disguise. Both came in through default and predictable credentials on SSH and Telnet.
SLEEPWALKER carries no command-and-control infrastructure and generates no outbound traffic on its own. That design puts it outside most of what a network-centric detection stack is tuned to catch, and moves the detection burden onto host integrity and configuration state.
A preprint published on 10 August 2026 demonstrated instructions propagating between AI agents through ordinary messages. The propagation is interesting. Which file the payload had to land in is more useful.