I know companies, governments, and other organizations create honeypots (ex: SQLi pages, Open Access Points, Open Ports, etc.) to lure in the bad guys. Are there any examples of the bad guys creating honeypots?
'Good guys' have to limit their actions to things that are 'good,' in order to remain 'good guys.'
'Bad guys' have no such restriction. They can get away with creating honeypots, telling the truth occasionally, and even saving puppies, and as long as they still do at least some 'bad' stuff occasionally, they are still 'bad guys.'
That's a bit sarcastic, but there's some truth to it. I think 'bad guys' do pretty much everything. It's a less restrictive title. Also, 'bad guys' don't exclusively go after 'good guys.' Honeypots can be used to gather information in order to exploit other 'bad guys.'
I know companies, governments, and other organizations create honeypots (ex: SQLi pages, Open Access Points, Open Ports, etc.) to lure in the bad guys...Are there any examples of the bad guys creating honeypots?
What constitutes a malicious honeypot is going to be a nebulous definition.
It's illegal to go probing around other people's systems. For anybody in the "good" category to remain there, they won't be doing the sorts of activities that would land them in a honeypot.
That being said, I don't see common criminals going to the trouble, but APT actors are definitely doing a lot of counter-intelligence using similar techniques.
I have to keep yelling at analysts not to investigate suspicious endpoints from our corporate network-- if an attacker sends us some malware and then during investigation they see a flurry of queries to their infrastructure from an IP directly attributable to us, they know who we are, that the malware reached us and that this particular attack didn't work...so they iterate and try again until they perfect it to the point where we don't detect the intrusion.
By virtue of the fact that we directly acknowledged them and their attack, we've landed ourselves in a procedural honeypot.