What OHIIHO sees, written up.
Reports from high-interaction honeypot deployments — campaigns observed live, TTPs extracted from autonomous agents, IOCs from global operations.
Briefs when a finding demands a longer argument: doctrine, digital sovereignty, the strategic grammar of autonomous tradecraft.
Two formats. No comments. No analytics. RSS at /index.xml.
We ran an internet-facing FortiGate honeypot for a month. It logged about 447,600 login attempts from about 34,600 IP addresses, and for three days we captured every submitted credential in cleartext. The corpus is not brute force: it is a stolen corpus of real corporate credentials being recycled, complete with FortiGate service accounts that exist only inside a device configuration backup. This is Part 1 of three: what FortiBleed actually is, and what the spray looks like from inside the device it targets.
The same stolen FortiBleed corpus is sprayed at one honeypot, in parallel, by roughly a dozen operator clusters across about 13 autonomous systems — and a synthetic heartbeat fired by twelve machines on three 'different' networks within the same minute proves part of that crowd is one operator wearing several masks. This is Part 2 of three: the marketplace, the orchestrated fleet, the victims named by their own stolen passwords, and the validate-and-leave fingerprint of an Initial Access Broker.
Half the FortiBleed sprayer IPs — including several that successfully validated the admin account — carry a threat score of zero and appear on no abuse feed at all. The only rule that catches 100% of them is a management-interface allowlist. This is Part 3 of three: the defenses that work, why standard SOC rules miss this spray, the ASN-level indicators, and the timeline gap that is the real lesson. With a companion Detection Brief.
SOC-ready companion to FortiBleed from the Target Side. The highest-signal detections for the credential-validation phase: off-allowlist admin auth, one source testing many usernames at a steady 24/7 cadence, a single success after a run of failures, and FortiGate service/cloud accounts appearing at the login prompt. TLP:CLEAR.
File manager webshell v2.2 with zero authentication and a runtime supply-chain dropper. Indonesian scene (zerobyte-id). No password, no session, no token — every function is open to any visitor. On every page load, fetches its own source from a hardcoded GitHub URL and writes it to the webroot.
The most deployed variant of the Alfa webshell family. Full-featured control panel with file manager, database browser, and CGI backdoor installer — and a hidden mail() beacon that reports every compromised host back to the kit author.
The kit's 'alfa3.php' is not a separate, older 'alfa3' family — it is an Alfa Shell V4 'Tesla' build, with the Hmei7 mail() surveillance beacon and create_function obfuscation. It is a distinct file from alfav4-tesla.php (different hash and size), not a byte-identical copy.
Gold standard compact webshell with anti-bot 404 evasion. Returns a fake 404 page to automated scanners while serving the real shell to interactive browsers. W0rm supply-chain infected in redistributed copies.
The original webshell — attributed to locus7s / Locus7 group. Ships with zero authentication by default and a cookie-driven PHP object injection that gives any visitor full control. The ancestor of the modern PHP shell ecosystem.
Misnamed config grabber — no brute-force logic exists despite the name. Malaysian scene (Donnazmi / AnonGhost, 2014). Default page load returns /etc/passwd without authentication. Stealth-404 evasion blocks search engine crawlers. Symlink grabber targets ~120 CMS and billing config paths.
Symlink-based config grabber from the Algerian scene (DamaneDz, 2013). Zero authentication. Creates a permissive directory with .htaccess override, then symlinks ~120 well-known CMS and billing config paths to harvest credentials across shared-hosting tenants.
Legitimate open-source database admin tool (DBKiss 1.11) with the most discreet W0rm supply-chain injection in the corpus. The backdoor hides inside a define() block and fires pre-auth at PHP parse time — before the application even starts.
Two minimal uploaders (~1.7 KB each) with byte-identical hidden mail() beacons to the kit author. Attributed to XPROADSHELL / BAZOOKA, distributed by 0XNIGHTSEC. The beacons fire on every page load, invisible to the operator. Half-broken obfuscation leaks two author handles from one file. Re-skin only difference between variants.
Indonesian-scene webshell with 10 outbound TLS-disabled connections, a W0rm supply-chain backdoor that fires on every unauthenticated visit, and trivially crackable MD5 auth. Every deployment is MITM-able and pre-auth exploitable simultaneously.
Indonesian-scene webshell with modern Bootstrap 4 dark UI, community-public default credentials, and eval(base64_decode()) obfuscated core. Built for the bigsecc hacker community — the most user-friendly shell in Tier 1.
Database email harvester from the Algerian scene. Two authors in one 8 KB file: SparkyDz (UI) and G-B (engine). Zero authentication. Walks every database, table, and column on the server, regex-matches email addresses, validates and deduplicates, then appends to file. Bulk mode accepts pasted lists of MySQL credentials.
Standalone web-based MySQL administration tool carrying a W0rm supply-chain backdoor. Pre-auth RCE via GET parameter fires before any panel authentication. Hardcoded panel credentials (tryag_vb/102030). A lightweight phpMyAdmin alternative poisoned by its own redistributor.
Full-featured webshell with embedded PHPMailer, a redistributor-injected JavaScript tracking beacon, and a hardcoded plaintext password. Turns every compromised server into a phishing platform while reporting the operator's activity to a third-party ad network.
Classic Russian webshell and one of the earliest full-featured PHP shells to circulate widely. Carries a W0rm supply-chain backdoor and a pre-auth local file inclusion on the very first line of source — the operator's tool is compromised before it even loads.
Minimal file uploader at 330 bytes — the smallest and cleanest tool in the corpus. Indonesian scene (GitHub rintod/toolol). No backdoor, no auth, no obfuscation, no beacon in the analyzed sample — the lowest observed supply-chain risk in the corpus. Used by Flash-X as stage-0 dropper to plant full shells after initial RCE.