Towards agnostic Operational Technology (OT) honeypot fingerprinting

Honeypots are versatile cyber-deception tools used to detect and analyze malicious activity across various environments, including operational technology (OT) systems that support critical infrastructure. Their effectiveness, however, depends on remaining undetectable to increasingly sophisticated attackers who employ fingerprinting techniques. This work introduces Aletheia, a framework for fingerprinting OT honeypots agnostically, by reversing the TCP/IP stack. We conduct an Internet-wide scan targeting the Modbus and S7comm protocols, identifying approximately 6 million responsive IPv4 addresses. Applying only a subset of our methodology, we uncover around 7,000 potential honeypot instances—including custom implementations—demonstrating, even at this preliminary stage, how our holistic framework combines established techniques with novel fingerprinting methods to reveal previously unidentified honeypots.