Standard threat-intelligence catalogues index malware by hash, family, and detection signature — the three questions a SOC asks to match a known-bad file and move on. Useful, necessary, and incomplete. That approach treats the attacker’s tool as a fixed artifact to be matched, never as what it actually is: software. And software written by criminals, shipped through a supply chain that verifies nothing, is some of the most vulnerable software on the internet.
Our Cyber Arsenal catalogues the other attack surface — the one the tool exposes to the people on the far side of it. Every sample in it was recovered from monitored adversary sessions against high-interaction sensor infrastructure: real operators, real deployments during real sessions, not lab recreations. For each tool we ask the question the hash-and-family approach skips. What is wrong with this tool, and who can use that against the operator running it — the defender, a rival, or the tool’s own author?
Three findings run across the catalogue.
The supply chain eats its own. More than 40% of the tools we catalogued carry a secondary backdoor — injected not by some outside party but by the very people who distribute them. A redistributor reselling a “trusted” webshell, and in several cases the original author, has quietly wired the tool to phone home. The operator who compromises your server with one of these is, in the same motion, handing that access to whoever backdoored the tool. There are two attackers on the host, and the second one is the first one’s supplier.
Zero-day-class vulnerabilities live inside criminal toolkits. Several of these tools ship with pre-authentication remote code execution, logic errors in their own cookie validation, or TLS disabled on every outbound connection they make. These are not theoretical — they were confirmed in isolated, controlled environments. A defender who knows the weakness can detect the tool, contain it, disrupt it, or attribute it, using the tool’s own flaws against the operator deploying it.
None of it is new, and that is the point. Some of these weapons have been circulating since 2007. They are still deployed, still traded, still working — not because they are sophisticated, but because the operators who use them do not read the CVEs of their own tools. The crimeware economy runs on trust without verification: download a “trusted” shell, drop it on a victim, never check whether the tool itself was turned against you. That same blind trust is the lever a defender gets to pull.
For a defender, each fiche turns that into three things you can act on today:
| You get | What it is for |
|---|---|
| Detection signatures | YARA rules to find the file on disk, and HTTP access-log patterns to catch the tool in use in your SIEM. |
| Vulnerability analysis | The weaknesses in the tool itself — a handle for containment, disruption, or attribution of the operator using it. |
| Supply-chain intelligence | Which tools are backdoored by their own distributors, so you know when the operator on your host has a second attacker riding along. |
These tools are on your perimeter right now. If you run PHP hosting, shared infrastructure, or any internet-facing web application, the shells and grabbers in the catalogue are what operators drop after initial access — commodity, widely available, deployed at scale by financially motivated actors. They are the infrastructure layer of bulk compromise, credential theft, and access brokering, and that layer is precisely the one most threat reporting indexes by hash and then stops looking at.
A note on restraint. The catalogue covers commodity crimeware — webshells, credential harvesters, phishing mailers, config grabbers — not state-sponsored tooling or espionage frameworks. Findings are graded on a five-level evidence scale from static triage to independent corroboration, and where weaknesses are claimed they are validated in controlled isolation. Public pages intentionally omit working exploit chains, live targets, and any reproduction steps. Extended indicators and zero-day detail are shared with national CERTs, hosting providers, and vetted defensive partners on request — not posted.
The catalogue grows as new tooling is recovered from live sessions. Start with the Cyber Arsenal index, or hunt straight to a sample by its SHA-256.
OHIIHO Research tracks targeted threat campaigns and APT-grade attackers through high-intensity, intelligence-grade honeypot infrastructure worldwide.