Reconnaissance behavior in honeypot systems: An analysis of offender’s online mobility

This study analyzes the objective behavior of users who registered on a simulated cybercrime-as-a-service web shop, designed and operated by researchers. The platform sold access to compromised systems (i.e. bots) and incorporated a common marketing tactic found in such illicit marketplaces: users were permitted to test the advertised bots for 10 minutes via Secure Shell (SSH) or Remote Desktop Protocol (RDP). This study focuses on user behavior within the RDP sessions. All user activity was monitored and video recorded, which allowed us to extract valuable insights into potential cybercriminal behavior within a controlled environment.