Standard threat-intelligence indexes malware by hash and family. Our Cyber Arsenal indexes the other thing — the vulnerabilities of the malware itself: the pre-auth RCE, the broken cookie validation, and the backdoors that the tools' own distributors wired into them. Over 40% of the commodity webshells and grabbers we catalogued are harvesting the operators who deploy them.