Dissection of crimeware tools recovered from monitored adversary sessions against OHIIHO high-interaction sensor infrastructure. Every sample catalogued here was collected from real adversary activity — deployed by real operators, during monitored sessions. These are not lab recreations or academic specimens.
What this means for your team
These tools are on your perimeter right now. If you run PHP hosting, shared infrastructure, or any internet-facing web application, the shells and grabbers in this catalogue are what operators drop after initial access. They are commodity — widely available, rarely updated, and deployed at scale by financially motivated actors.
Each fiche gives you three things you can act on today:
- Detection signatures — YARA rules to find these files on disk, and HTTP log patterns to spot them in your access logs.
- Vulnerability analysis — weaknesses in the tools themselves that you can leverage for containment, disruption, or attribution.
- Supply-chain intelligence — which tools are secretly backdoored by their own distributors, meaning the operator who compromised your host is simultaneously being compromised by their own supply chain.
Why these tools still matter
Most of the weapons in this catalogue are not new. Some have been circulating since 2007. That is precisely the point. These tools are still being deployed, still being traded, and still working — not because they are sophisticated, but because the operators who use them do not read the CVEs of their own tools. The crimeware supply chain runs on trust without verification: an operator downloads a “trusted” webshell, deploys it on a compromised server, and never checks whether the tool itself has been backdoored by its own author or redistributor.
What makes this catalogue different
Standard threat-intelligence catalogues index malware by hash, family, and detection signature. This catalogue indexes the vulnerabilities of the malware itself — the attack surface that the tool exposes to defenders, to rival operators, and to its own supply chain. Where applicable, findings are validated in controlled isolated environments. Public pages intentionally omit working exploit chains, live targets, and instructions for unauthorized access.
Key findings across the catalogue
Supply-chain parasitism is systematic, not exceptional. Over 40% of the tools catalogued carry a secondary backdoor injected by a redistributor (W0rm) or the original author (KeluargaHmei7). The operator deploying the tool is simultaneously being harvested by their own supply chain.
Zero-day class vulnerabilities exist in criminal toolkits. Several tools ship with exploitable pre-authentication RCE, logic errors in cookie validation, or disabled TLS on all outbound connections. These are not theoretical — they have been confirmed in isolated lab environments. Defenders can leverage these weaknesses for detection and containment.
Detection context is provided for each fiche. Each entry provides ATT&CK mapping, YARA rules, HTTP log indicators, and actionable guidance for SOC teams, detection engineers, CERTs, and incident responders.
How to use this catalogue
| If you are a… | Start with… |
|---|---|
| SOC analyst triaging a PHP compromise | Search by hash (SHA-256 in each fiche) or scan with the provided YARA rules. The “Detection Surface” section gives you access-log patterns to hunt in your SIEM. |
| Detection engineer writing rules | Each fiche includes file-system indicators, HTTP request patterns, and YARA signatures. Adapt them to your stack. |
| Incident responder on a live case | Check the vulnerability table — if the shell is W0rm-infected, the operator’s supply chain is a second attacker on the same host. The MITRE ATT&CK mapping connects to your existing playbooks. |
| Threat intel analyst building context | The supply-chain and scene attribution sections map the underground economy behind the tools. |
Evidence levels
| Level | Meaning |
|---|---|
| E1 | Static triage |
| E2 | Sandbox execution |
| E3 | Isolated lab validation |
| E4 | Sensor-observed deployment |
| E5 | Independently corroborated |
Scope
This catalogue covers commodity crimeware — the webshells, credential harvesters, phishing mailers, and config grabbers that make up the operational toolkit of financially motivated threat actors. It does not cover state-sponsored tooling, APT implants, or espionage frameworks. Those are handled through separate restricted channels.
The tools documented here represent one layer of the threat landscape: the infrastructure layer that enables bulk compromise, credential theft, and access brokering at scale. Understanding this layer — its tools, its economics, its internal betrayals — is essential context for anyone defending internet-facing infrastructure.
