🛣️ BGP Route Injection

Fake BGP routes leading to monitored honey-nets.

→ Explore in ATT&CK matrix (1 mappings) Deployment detail

⚠ Active measure — legal review required

This technique acts on infrastructure you do not own. Depending on jurisdiction it may constitute unauthorised access or interference, and it cannot reliably distinguish a hostile actor from a misconfigured legitimate one. Documented for completeness; obtain legal sign-off before any deployment.

What it is

Announce fake internal BGP routes for non-existent network segments. Any traffic routed to these segments is inherently malicious (no legitimate traffic should ever go there). All traffic is captured and analyzed.

Implementation requirements

BGP-capable router infrastructure
Unused IP address blocks
Full packet capture infrastructure on honey routes
Careful coordination with network ops to avoid routing disruptions
Safety: originate only prefixes your organisation holds, with matching RPKI ROAs and IRR route objects. Never announce a more-specific prefix of space you do not hold; that is a route hijack, not a decoy
Safety: keep announcements internal (iBGP, or tagged no-export) unless your upstream providers have agreed in writing. Apply max-prefix limits and outbound prefix filters so a mistake cannot leak routes
Legal: traffic drawn to a honey route can include third-party data. Agree retention, privacy and disclosure terms with counsel before deployment
Rollback: withdraw the announcement. Rehearse the withdrawal, and confirm with your upstream providers how long it takes to propagate
Upkeep: Keep RPKI and IRR records current and re-check prefix filters after every router change. Rehearse the withdrawal quarterly.

Technologies

Network

ATT&CK coverage 1

Technique	Tactic	Status	Confidence	Tier
T1046 Network Service Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) A Virtual Honeypot Framework — Honeyd simulates hosts on unallocated addresses and deceives network scanning and fingerprinting tools. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1046 to its Lures activity. Koney: A Cyber Deception Orchestration Framework for Kubernetes — (D029) Koney uses service meshes and eBPF to add traps to containerised applications; probing a trap is logged.

Evidence

MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
The UCSD Network Telescope — CAIDA, UC San Diego practitioner

Research basis: Extension of DNS sinkholing research — "SoK: P2PWNED - Modeling and Evaluating the Resilience of Peer-to-Peer Botnets."