What OHIIHO sees, written up.
Reports from HIIH Surfaces and high-interaction sensors worldwide — campaigns observed live, TTPs extracted from autonomous agents, IOCs from global operations.
Briefs when a finding demands a longer argument: doctrine, digital sovereignty, the strategic grammar of autonomous tradecraft. The Cyber Arsenal dissects the crimeware operators leave behind; Detections gathers the YARA, Sigma, Suricata and IOC files, ready to deploy.
Four sections. No comments. No analytics. RSS at /index.xml.
Four sections, one evidence base.
Recently published.
"Hydra Bot v5": A Redis Stager Designed to Deploy a P2PInfect Client and Miner
Analysis of an in-the-wild Redis deployment chain: artifacts for four known Redis abuse patterns delivered in 4.4 seconds, a stager not found in public datasets designed to deploy a P2PInfect-linked ELF and an apparent miner, and campaign infrastructure exposed through a hostname guard.
SuricataYARASigmaIOC 17 min readCrimeware Has an Attack Surface. We Catalogue It.
Standard threat-intelligence indexes malware by hash and family. Our Cyber Arsenal indexes the other thing — the vulnerabilities of the malware itself: the pre-auth RCE, the broken cookie validation, and the backdoors that the tools' own distributors wired into them. Over 40% of the commodity webshells and grabbers we catalogued are harvesting the operators who deploy them.
4 min readFortiBleed from the Target Side: What Stops Them [3/3]
Half the FortiBleed sprayer IPs — including several that received a success response — carry a threat score of zero and appear on no abuse feed at all. The only rule that catches 100% of them is a management-interface allowlist. This is Part 3 of three: the defenses that work, why standard SOC rules miss this spray, the ASN-level indicators, and the timeline gap that is the real lesson. With a companion Detection Brief.
IOC 12 min readFortiBleed from the Target Side: The Ecosystem [2/3]
The same stolen FortiBleed corpus is sprayed at one of our sensors, in parallel, by roughly a dozen operator clusters across about 13 autonomous systems — and a synthetic heartbeat fired by twelve machines on three 'different' networks within the same minute proves part of that crowd is one operator wearing several masks. This is Part 2 of three: the marketplace, the orchestrated fleet, the victims named by their own stolen passwords, and the validate-and-leave fingerprint of an Initial Access Broker.
27 min readFortiBleed from the Target Side: The Corpus [1/3]
We ran an internet-facing FortiGate honeypot for a month. It logged about 447,600 login attempts from about 34,600 IP addresses, and for three days we captured every submitted credential in cleartext. The corpus is not brute force: it is a stolen corpus of real corporate credentials being recycled, complete with FortiGate service accounts that exist only inside a device configuration backup. This is Part 1 of three: what FortiBleed actually is, and what the spray looks like from inside the device it targets.
IOC 19 min readFortiBleed Credential-Validation Spray: Detection Brief
SOC-ready companion to FortiBleed from the Target Side. The highest-signal detections for the credential-validation phase: off-allowlist admin auth, one source testing many usernames at a steady 24/7 cadence, a single success after a run of failures, and FortiGate service/cloud accounts appearing at the login prompt. TLP:CLEAR.
IOC 4 min readResidential Broadband Botnet Uses AsyncSSH to Validate Credentials Across Four Regions
88 compromised residential broadband hosts — all on two Vietnamese ISPs — ran a coordinated SSH credential-validation campaign across four geographically distributed sensor regions over seven days. The same HASSH fingerprint, the same Python SSH library, zero successful logins: this is infrastructure reconnaissance, not exploitation.
IOC 8 min readIt Built the Business: Source Excerpts [2/2]
Redacted excerpts from the tooling behind the case: repeatable VM provisioning, port-mapped remote access, customer-abuse controls, fleet monitoring with an interactive viewer, attempts to weaken Windows application control, and the build loop that produced it. Selected and generalized; the full source, indicators, and attribution stay restricted.
11 min read