🔌 Honey Service Mesh Route

Deceptive Istio/Linkerd routes to honeypods.

What it is

A service-mesh route for a host or path that no real service calls, sending traffic to a decoy pod. Attackers inside a cluster probe internal services to find their next hop. Every request to the decoy route is recorded in the mesh access logs.

Implementation requirements

• Istio: a VirtualService route for a decoy host or path that sends traffic to a decoy pod (D012). Linkerd: an equivalent route using its HTTPRoute support
• Nothing legitimate calls the route, so every request to it is the signal
• Monitoring: mesh access logs (Envoy access logging in Istio) for the decoy route, or the decoy pod's own request log
• Safety: the decoy pod has no credentials and no egress beyond the collector; mutual TLS identity for the decoy service account grants access to nothing
• OPSEC: route names, headers and latency consistent with real services
• Rollback: Delete the route resource. Remove the decoy pod it targets.
• Upkeep: Re-check after mesh upgrades that routing and access logging still work. Monthly proof-of-life request.

Technologies

ATT&CK coverage 1

Evidence

• Decoy Network Resource (D3-DNR) — MITRE D3FEND standard
• Koney: A Cyber Deception Orchestration Framework for Kubernetes — Kahlhofer, M.; Golinelli, M.; Rass, S., arXiv:2504.02431 2025 preprint
• MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard