By Hand: The Human in an Automated Armory

TI-2026-075M · The Armory, Part M Confidence: HIGH — direct honeypot HASSH coordination + prior actor-profiling corroboration Classification: TLP:WHITE

The one percent that types

Almost everything in the census is a machine. The libssh fleets, the Go swarm, the residential botnet, the credential-auditor triad — these are programs, scheduled and unattended, firing at the rate of a scheduler rather than a hand. Read the whole tool catalogue and it is an ocean of automation, thousands of processes doing the same thing over and over without anyone watching.

And then there is a one-percent sliver that does not fit. About 118 of the 11,984 tool-classified attackers carry a single HASSH — 084386fa7ae5039bcf6f07298a05a227 — and the classifier labels them, alone among the tiers, manual. The reason is the tool itself. That fingerprint belongs to PuTTY, and PuTTY is not a library. It is a Windows graphical SSH client: a window, a settings dialog, a saved-sessions list you click through with a mouse. Nobody builds a botnet on PuTTY, because there is nothing to script — PuTTY is an application a person opens, not a component a program calls.

Which makes its appearance in a honeypot the single most valuable signal in the entire census. Every other fingerprint tells you which tool. This one tells you there is a human at the keyboard. In an armory that is 99% automated, the PuTTY HASSH is the mark of the 1% that is a person — and, as this letter will argue, the 1% that matters most.

What a GUI client proves

It is worth being precise about why the PuTTY fingerprint carries the weight it does, because the inference is unusually strong.

A scanning botnet is built from libraries: libssh, x/crypto/ssh, Paramiko. These exist to be called — a program imports them, loops over a target list, and fires thousands of connections without a human present. That is the whole point of a library. PuTTY is the opposite kind of software. It has no headless mode a botnet would use; it is a desktop application whose entire design assumes a person sitting in front of it, typing a hostname, clicking Open, watching a terminal window. You can automate almost anything with enough effort, but nobody automates with PuTTY, because it is strictly harder than using the libraries built for the purpose. The rational automated attacker never reaches for it.

So when PuTTY's handshake shows up at the honeypot, the most parsimonious explanation — by a wide margin — is the literal one: a human opened PuTTY on a Windows machine and connected by hand. The fingerprint is not proof of intent (PuTTY is the world's most common administrator's client, entirely legitimate), but combined with an unrequested connection to a machine that is not the operator's, it is as close to "a person is doing this personally" as network telemetry gets. Where the rest of the Armory distinguishes tools, this letter's fingerprint distinguishes hands from scripts — and that is a categorically more useful thing to know.

The rhythm of a person

The behavioural record confirms what the tool implies. The manual tier does not move like a machine.

The Go swarm fires 780 sessions from one IP in ninety minutes; the residential botnet fires fifty in five. The PuTTY tier does nothing of the kind. Its IPs appear a handful of times each, spread thinly across months — the fleet has been active from 21 March into 10 July 2026, still running, but at the unhurried cadence of a person who opens a session, looks around, decides something, and closes it. Low volume, long persistence. That combination — sparse activity sustained over a long life — is itself a human signature, because automation is either dense (a burst) or dead (abandoned), while a person returns occasionally, at human intervals, for as long as they remain interested.

This is the behavioural counterpart of the GUI fingerprint, and it means a defender can flag likely humans even without reading the HASSH: a source that appears rarely, over a long period, doing a little each time, is behaving like a person, not a process.

A magazine with names in it

The manual tier's credentials seal the case, because they contain something no harvested dictionary does: people.

Alongside the expected entries — root:kali, root:redhat, root:Huawei@123, test:test123, opc:opc — the manual tier fires pairs like arthur:arthur, amine:amine, rebecca:rebecca, plex:plex. Personal first names, loaded as username-and-password guesses. A scraped corpus does not contain your friends. A credential list seeded with names reads like an operator's own material — aliases they use, contacts they know, guesses a person types from memory rather than a file they downloaded.

This is the principle from The Ammunition (075J) at its sharpest: a specialized magazine names either the prey or the hand, and a magazine full of human names names the hand. Where the automated tiers spray public lists that are anonymous by construction, the manual operator loads a personal one, and the personal entries become potential attribution links — not to a fleet, but to an individual. The names are the closest thing in the whole honeypot to a signature written by the attacker themselves.

The signature move: looking, by hand

Ask what the manual tier actually does once connected, and the answer is almost touchingly simple. Its captured commands are dominated by a single line, typed over and over across the fleet: uname -s -v -n -r -m.

It is the command a person types to answer, by hand, the question every intruder must answer first: what is this machine? The automated tiers answer it with structured reconnaissance scripts that probe device class and capability in a programmed sequence (075F). The manual operator just types uname and reads the output — the human equivalent of the involuntary orientation phase, done deliberately, one keystroke at a time. Land on a foothold, type uname, look at what came back, and decide personally whether this box is worth anything.

That single typed command is the manual tier's whole doctrine, and it is the doctrine of a person, not a program: look first, decide personally. No script runs; a human reads the screen and makes a judgment. It is the least sophisticated behaviour in the census and, for exactly that reason, the most human.

Rare by volume, sharpest by threat

Here is why the one percent matters more than its size suggests. Prior actor-profiling — The High-Threat Triad (TI-2026-055F) — rated this human PuTTY operator the highest individual threat in the entire dataset. Not because of reach: 118 IPs is nothing against the scanner fleets' thousands. Because of judgment.

A human makes decisions in real time. When a defence does something unexpected, the automated tier keeps firing its script into the wall; the human notices, and adapts. When they land on a high-value target — a database server, a domain controller, a build system — the botnet treats it identically to a home router, but the human recognises it and changes their behaviour to match. And when they land in a honeypot, the script runs its routine and gets recorded, while the human smells the trap and leaves. Automation has scale; the human has intent, adaptation, and target discrimination — the three things that turn a foothold into a serious breach.

So the manual tier inverts the volume metric that governs the rest of the census. Measured by IP count it is a rounding error. Measured by threat-per-session it is the sharp end of the whole arsenal. A defence that prioritises by volume — that chases the loudest fleets — systematically under-weights precisely the operator most likely to do real, targeted harm, because that operator is deliberately quiet. The ocean of automation is dangerous by mass; the single human swimming in it is dangerous by mind.

Reading the hand — for defenders

• Treat a GUI-client HASSH as a human-operator flag. PuTTY (084386fa) and other interactive desktop clients are not scripted; their fingerprint on an unrequested connection is a high-priority signal that a person, not a process, is on the line. Escalate manual-tier sessions for human review.
• Corroborate on rhythm. Sparse activity sustained over a long life — a source that appears rarely, for months, doing a little each time — is a human cadence even without the HASSH. Combine cadence, GUI fingerprint, and hand-typed commands for high-confidence manual detection.
• Personal-name credentials are individual IOCs. Names like arthur/amine/rebecca in a magazine may link sessions to a person rather than a fleet; track them as operator-linked markers.
• Invert the volume metric. The quietest, most human-looking sessions deserve the most scrutiny. One adaptive human is a greater risk to a specific asset than a thousand spraying bots; triage should weight human indicators heavily, not by count.

The census is a catalogue of machines. This letter is about the exception — the rare session where the fingerprint, the rhythm, the credentials, and the single typed command all point the same way: to a person, sitting at a Windows box, opening PuTTY, and deciding by hand what to do with a stranger's server. The automation is the ocean. The human is the shark, and there are not many of them, which is exactly why each one is worth finding.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-075A — The Armory: What 12,000 Attackers Carry — the census in which the manual tier is the ~1% pole.
• TI-2026-055F — The High-Threat Triad — the PuTTY human operator profiled as the highest individual threat.
• TI-2026-075J — The Ammunition — the specialized magazine that names the hand; here, human names.
• TI-2026-075F — The First Move — the involuntary orientation the human performs deliberately by typing uname.
• TI-2026-075I — The Weapon Is Never the Point — the synthesis: behaviour and hand, not the (blameless) tool.

This dossier documents observed adversary behaviour for defensive purposes. PuTTY is a legitimate, ubiquitous administrator's client; its fingerprint indicts no one, but marks the presence of a human operator behind an unrequested session. TLP:WHITE.