make an ssh honeypot (in docker) that is extremely limited in speed/bandwidth. Have only one small binary in the home folder called "PASSWORD_STORAGE" that has no execute permissions. Hopefully someone will download the binary to their own machine an execute it. Instead of a benign file, "PASSWORD_STORAGE"should be a disk encryptor/drive wiper.