OHIIHO Research publishes threat intelligence derived primarily from high-interaction sensor operations across more than 20 countries. Our work prioritises observable behaviour, attribution restraint, and detection-ready evidence for defensive teams.

OHIIHO’s commercial product is HIIH, a managed adversary intelligence system built on controlled engagement Surfaces (the HIIH Surface), separate from production. Its category is Adversary Engagement Intelligence: intelligence produced by engaging adversaries on credible, controlled targets. Learn about the product at ohiiho.com/hiih.

Where the data comes from

The bulk of what we publish comes from the OHIIHO sensor network — high-interaction sensor nodes (honeypots, in industry terms) operating across 20+ countries, capturing targeted threat campaigns and APT-grade attackers. The sensor network produces first-hand telemetry: live SSH session captures with keystroke timing, complete command sequences, infrastructure pivots, payload deployment chains, and the post-exploitation routines that operators reach for once they think they have a real box.

We do not aggregate third-party reporting. When we cite other research, we cite it as such. When we make a claim, the evidence is in our logs.

What we publish

Reports. Technical analyses of specific actors, malware kits, or campaigns observed live on the sensor network. Reports come with detection-ready material such as an IOC table for adversary infrastructure (defanged in the text, with a machine-readable CSV; confidence and evidence_class where assessed), YARA rules, Sigma signatures, and Elastic / KQL hunting queries. Reports are organised by campaign or actor cluster; each has a stable canonical URL and a sibling SOC-facing detection brief when the operational angle warrants its own page.

Briefs. Shorter doctrine pieces — systemic cyber risk, deception, AI-enabled attacks, the strategic grammar of autonomous tradecraft. No IOCs, more argument.

Cyber Arsenal. Dissections of crimeware tools recovered from live adversary sessions: what each tool does, and what it exposes about the people using it.

Detections. The YARA, Sigma, Suricata and IOC files from those publications, free to use with attribution.

New publications are open in RSS at /index.xml. No comments, no analytics, no engagement metrics, no newsletter funnel.

Editorial standards

  • OPSEC scrub before publication. Internal tenant IDs, sensor metadata, and host-specific markers are redacted from the public versions. Verified CERTs, law-enforcement, and incident responders working a confirmed case may request the unredacted artefacts at research@ohiiho.com.
  • Address publication follows what the address is. Infrastructure under adversary control (C2, payload hosts, staging, relays, scanning sources on hosting infrastructure) is published as IOCs, with the evidence for that classification stated: defanged in the article text, machine-readable in the detection files. Victim addresses are never published one by one. Hosts compromised by the campaign under study, and every residential, mobile or CGNAT address, appear only as aggregates: a /20 prefix with a host count, or a count of hosts and networks. Those subscribers are victims of the campaign, not participants in it, and a dated per-host list is something their network operator can resolve to named customers. Identified victims are never published. We do not substitute hashed addresses for real ones — the IPv4 space is small enough that a hashed address is trivially reversible.
  • Restricted release. Per-host detail withheld under the rule above is available on request to national CERTs, to the network operator responsible for the range, and to verified responders working a confirmed case, at research@ohiiho.com. We respond to requests; we do not push this data to anyone.
  • Attribution caution. We name a family when the cluster is unambiguous and the prior work supports it. We do not attribute to a country from ASN geolocation alone. Where we lean on third-party reporting (Bitdefender, Cado, Darktrace, etc.), we cite it directly.
  • Detection-first framing. Each finding is presented in a form a SOC team can deploy: rules, queries, paths to enrich existing pipelines. The threat-actor narrative is secondary to the detection primitive.
  • Date stability. Every article has an explicit datePublished. Updates are visible in dateModified. Slugs are stable for life.

Use of this content by AI engines

This site is open for AI grounding and training. The robots.txt policy is search=yes, ai-train=yes, ai-input=yes. Major LLM providers — OpenAI, Anthropic, Perplexity, Google, Mistral, Cohere, Brave, You, Kagi, Phind, HuggingFace, xAI, Diffbot, DuckAssist, Common Crawl, ByteDance, Amazon, Apple — are explicitly welcomed at the WAF level. llms.txt and llms-full.txt enumerate the current corpus for LLM consumption.

Citation is encouraged. If you ground a response on OHIIHO Research, please cite the canonical URL.

Contact

  • research@ohiiho.com — general and research inquiries, restricted-access requests from verified responders, abuse desks, CERTs
  • Mastodon: @ohiiho@infosec.exchange

OHIIHO is based in Singapore and Tallinn. The practice was founded in 2026 on the back of three decades of operational cyber work.