The Armory: What 12,000 Attackers Carry

TI-2026-075A · Series: The Armory (Part A) · TLP:WHITE · 2026-07-10

Assessment (HIGH confidence). Every attacker carries a tool, and every tool leaves a fingerprint. Because a honeypot records the SSH client fingerprint (HASSH) of each connection, it holds a live inventory of the offensive-tooling supply chain — a census built entirely from how attackers knock, before a password is tried or a payload is dropped. Across 11,984 attacker IPs, that census shows something uncomfortable and rarely quantified: the overwhelming majority of what hits the wire is dual-use. Hydra, Ncrack, Medusa, Paramiko, Nmap, Sliver, Havoc, AdaptixC2 — all of them are published, maintained, legitimate security tools. The attacker's armory and the defender's armory are the same armory. This letter maps it; the ones that follow open individual weapons.

1. The handshake is the inventory

Before an SSH client ever sends a username, it announces itself. In the key-exchange it offers a precise, ordered set of algorithms, and that set is a property of the client's build — the library it compiled against, the version, the defaults its author chose. Hash that offer and you get HASSH: a fingerprint that identifies the tool, regardless of what IP it came from.

So the honeypot does not need to catch a payload to know what it is dealing with. From the handshake alone it classifies the tool behind 11,984 attacker IPs:

Attackers announce what they carry the instant they connect. That is what makes a census possible.

2. The uncomfortable part: it's all legitimate software

Look at that pentest tool row, because it is the whole thesis of this series in one line. It resolves to:

• Hydra — the published network brute-forcer (HASSH dde267e5…, seen across ~29–86 IPs).
• Ncrack — the Nmap project's cracking tool (4e066189…, ~34–96 IPs).
• Medusa — a parallel brute-forcer (9052c4ab…, 58 IPs).
• Paramiko — the Python SSH library that scripts half the security industry (19532158…, 63–113 IPs, 27 countries).
• Nmap SSH2 algorithm enumeration (a20aced7…, 52 IPs).

Every one of these is a tool a defender runs, a red team runs under contract, a student runs in a lab. They are documented, maintained, and taught. And here they are, pointed at a honeypot they were never authorized to touch.

The fingerprint that identifies the tool cannot identify the intent, because authorized and criminal use run byte-for-byte identical code. There is no "malicious Hydra." There is only Hydra, and a target that did or did not consent. Dual-use is not an anomaly in offensive security — it is the structural condition of the field.

3. One library version, eighty-four countries

The scanner and botnet rows tell the other half of the fingerprint's power: it re-assembles fleets that geography scatters.

A single HASSH cluster — libssh_0.11.x — spans 1,313 IPs across 84 countries, 44,341 login attempts. Another, libssh_0.9.6, spans 421 IPs across 59 countries. libssh2_1.11.0 covers 628 IPs in 48 countries; Go-SSH, 320 in 43. A botnet can rent addresses on every continent, but it compiles its tool once — and that one build string reunites the whole fleet under a single fingerprint.

And it goes further than the tool. Two of those clusters — the 0.9.6 botnet and the 0.11.x scanner — resolve to one operator id (actor-6f199858ed7e), running a scanner arm and a botnet arm in parallel: enumerate wide with one build, brute-force where it lands with another. That is not a script. That is a structured operation, and the build strings gave it away. (A later letter opens it.)

4. The tools run from Google Cloud

Here is a detail worth sitting with. The brute-force and enumeration clusters do not come from some bulletproof host in a permissive jurisdiction. They concentrate on AS396982 — Google Cloud Platform:

• Hydra: 29 IPs on AS396982
• Ncrack: 29 of 34 IPs on AS396982
• Nmap SSH-enum: all 23 IPs on AS396982
• libssh2_scanner: all 21 IPs on AS396982
• openssh_legacy: 22 of 25 IPs on AS396982

Disposable cloud instances, spun up to run published offensive tools against the internet. Legitimate tooling, on legitimate infrastructure, aimed at targets that did not agree. Whether any given instance is authorized research or plain abuse is not resolvable from the tool or the host — only the target and consent decide, and a honeypot supplies neither on the attacker's behalf. The brand of the cloud is not a trust signal.

5. The heavy end of the armory

The SSH tooling is the light end. The honeypot's malware enrichment surfaces the rest — the command-and-control frameworks tied to attacker IPs:

• Sliver (win.sliver) — open-source Go C2, a Cobalt Strike alternative.
• Havoc (win.havoc) — open-source C2, widely adopted by red teams and criminals.
• AdaptixC2 (win.adaptix_c2) — a 2024–25 open-source framework whose abuse climbed sharply in 2026.
• Remcos (win.remcos) — a commercial RAT sold as "remote administration."

Alongside them, the commodity ELF botnets: redtail (32 IPs), mirai (9), xmrig, xorddos, and aisuru — a 2025–26 Mirai variant behind record DDoS. The same instrument that logs a Hydra brute-force logs a Sliver beacon. The armory runs, without a break, from a cracker script to a full red-team C2 — and every named framework on the heavy end is, again, dual-use: written for authorized operations, deployed in unauthorized ones.

6. Read between the lines: you can't blocklist a profession

The instinct, staring at this list, is to want to ban the tools. It cannot be done, and the census is why.

You cannot blocklist Hydra, Nmap, Paramiko, or Havoc without blocklisting the people who defend with them — the red teams, the researchers, the students, the incident responders who script in Paramiko every day. There is no signature that separates the authorized Hydra from the criminal one, because there is no difference in the code. The only thing that differs is context: the target, the consent, the volume, the intent — none of which lives in the tool.

That is precisely why a honeypot is the right instrument to study the armory. It cannot be a legitimate target of anyone's authorized test, so every tool that reaches it is, by construction, unauthorized — and the honeypot supplies the one thing the fingerprint lacks: context. The tool tells you what; the honeypot tells you that it should not be here.

7. The series ahead

This letter is the map. It establishes the taxonomy, the numbers, the dual-use thesis, and the two tracing primitives the series will lean on — HASSH to name the weapon, SSH-key reuse (284 keys reused across IPs) to name the hand. The letters that follow open the armory one weapon at a time:

• the cloud-hosted pentest cluster on Google Cloud,
• the dual-arm operator running scanner and botnet in parallel,
• and the C2 frameworks at the heavy end — Sliver, Havoc, AdaptixC2.

The organizing claim holds across all of them, and it is the reason the series is worth writing: what attacks you is, overwhelmingly, what defends you — the same code, maintained by the same community, pointed the other way. The value of a honeypot was never catching the exotic. It is inventorying the ordinary — the real, mostly-dual-use toolchain in daily use against the internet — so defenders reason about what is actually deployed, not what is merely imagined.

8. Sources

• LSN honeypot intelligence summary — tool distribution across 11,984 IPs (scanner/botnet/pentest_tool/manual), malware family feed (Sliver, Havoc, AdaptixC2, Remcos; redtail, mirai, aisuru), SSH-key reuse (284 actor_reuse).
• LSN honeypot HASSH campaigns — per-tool clusters (Hydra, Ncrack, Medusa, Paramiko, Nmap-enum) and library-version fleets (libssh_0.11.x 84 countries, libssh_0.9.6 59, libssh2_1.11.0 48, Go-SSH 43); AS396982 concentration; operator actor-6f199858ed7e.
• Salesforce — HASSH (SSH client fingerprinting by key-exchange algorithm offer).

Confidence: HIGH on the census, the tool identifications, the cluster geography, and the AS396982 concentration — all direct from honeypot telemetry. The dual-use thesis is interpretive but well-supported (every named tool is verifiably legitimate published software). Individual malware-family attributions carry the usual enrichment-source uncertainty (small local counts) and are treated as leads for later letters, not conclusions here. TLP:WHITE — attacker tooling only; no operator secrets or exploit specifics disclosed.