This talk walks through how a $20 piece of cloud infrastructure became a fully functional threat intelligence pipeline. Starting with a simple honeypot, we capture an inbound attack, pivot back against the attacker's infrastructure using a reverse scan, discover an open staging server, and walk away with something most researchers only dream of — the actual source code behind the malware. No enterprise budget. No team. No expensive tooling. Just cheap infrastructure, some curiosity, and attackers with terrible opsec. We'll walk through the full attack chain in reverse — from the initial hit on the honeypot, through the pivot and enumeration of attacker infrastructure, to pulling the payload and source code from their own server. We'll then crack open both the binary in IDA Pro and the source code side by side, showing exactly what this bot was built to do and what the attacker left behind for anyone willing to look. The key takeaway is simple — you don't need a SOC, a threat intel platform, or a six figure budget to find real malware in the wild. Sometimes the attackers do half the work for you.