The Auditors: The Password-Testing Triad

TI-2026-075Q · The Armory, Part Q Confidence: HIGH — direct honeypot HASSH clustering + multi-source corroboration Classification: TLP:WHITE

Three names, one job

The census carries a distinct little family of named tools that belong together: Hydra (HASSH dde267e50f82fcc16a7e1e7b59b8af71, ~86 IPs), Ncrack (4e066189c3bbeec38c99b1855113733a, ~96 IPs), and Medusa (9052c4ab4164c78256e71143dcfc7eac, ~58 IPs). Three separate tools, three famous names, and — this is the whole point — one identical job.

All three are purpose-built credential auditors. THC-Hydra is the veteran; Ncrack comes from the Nmap project; Medusa is the parallel-focused alternative. But strip away the branding and they do exactly the same thing: fire a credential magazine at a login service, in parallel, as fast as possible, and report which username-and-password pairs opened the door. They are the standard instruments of every penetration test and every internal security audit, taught in every course, shipped in every red-team distribution. In the honeypot, they are the offense's auditors — the tools whose entire function is to test whether your passwords hold.

They deserve a single letter, together, because their most important property is precisely that they are interchangeable.

Interchangeable by design

Hydra, Ncrack, and Medusa are not a toolkit of complementary functions — they are three implementations of one function, and an operator simply picks whichever they like. Their output is identical: a list of the credentials that worked. An operator who prefers Hydra's syntax uses Hydra; one who lives in the Nmap ecosystem reaches for Ncrack; one who wants Medusa's parallelism model uses Medusa. The choice is a matter of taste, not capability, because there is no capability difference that matters.

That interchangeability is itself the finding, and it has a sharp defensive consequence. The census's credential-auditing activity is not a tool to be signatured; it is a category to be understood. A defender who builds detection around Hydra's fingerprint and stops there has caught one third of the auditors and handed the operator a trivial evasion: switch to Medusa, same attack, new fingerprint. The real signal is not the binary at all — it is the behaviour, high-parallelism credential testing against a login service, which all three share and which survives any change of tool. Cluster on the function, and the triad collapses into one thing worth watching. Cluster on the binary, and you are playing whack-a-mole with three names for the same act.

They measure your locks; they do not break in

Here is the detail that surprises people about the auditors: in the honeypot they carry notably low threat scores — roughly 28 for Hydra, 28 for Ncrack, 32 for Medusa, among the lowest of any named tool in the entire census. For tools whose job is breaking into accounts, that seems backwards. It is not. It is the classifier reading them exactly right.

A credential auditor's job ends the moment it succeeds. It fires the magazine, finds a working password, records it — and stops. Finding the weak door is the whole task; the auditor does not itself walk through the door and do damage. The harm comes later and from elsewhere — from whatever payload or operator takes the credential the auditor discovered and uses it. The auditor is a measurer. It assesses the strength of your locks and hands the result to someone else, the way the mapmaker (075N) measured your crypto and handed that result on. This places the auditors in the same reconnaissance-adjacent family as the mapmaker: instruments that assess rather than exploit, whose low threat score is honest because the damage they enable is always somebody's next move, not their own.

For a defender, that reframes what an auditor hit means. It is not the breach. It is the warning before the breach — the signal that an operator now knows, specifically, which of your credentials are weak. The window between the audit and the exploitation is a chance to rotate those credentials before the downstream actor spends the auditor's findings.

The professional's shelf

The auditors do not live on the commodity floor. They are a core part of the arsenal profiled in The Cloud Contractor (075B) — the pentest tooling that concentrates on Google Cloud (AS396982) and similar rented substrate. That fit is not accidental. The auditors are professional tools, and they are run by operators who rent professional infrastructure and treat their credential-testing like an engagement rather than a spray.

And they travel with company. Finding Hydra, Ncrack, or Medusa co-located with the reconnaissance mapmaker (075N) on the same rented shelf is the fingerprint of a staged operation: survey the ground with Nmap, audit the locks with the triad, hand the openings to whatever comes next. That sequence — recon, then audit, then hand-off — is the signature of a methodical, engagement-style operator, and it is a categorically more serious profile than the mindless credential spray of the botnet floor. The spray is a weather system; the auditor-plus-recon operation is a plan. A defender who sees an auditor hit that was preceded by reconnaissance from shared infrastructure is watching a deliberate operation unfold in its correct order, and should escalate it well above generic spray noise.

Definitionally the defender's tool

Of everything in the census, the auditor triad is the cleanest possible statement of the whole series' thesis — cleaner even than Nmap — because these tools do not merely happen to be dual-use. Their sanctioned purpose is the attack.

Hydra, Ncrack, and Medusa exist for one reason: to let an organisation test its own credential strength before an attacker does. Running them against your own login services is not a grey area or a tolerated risk — it is a documented security best practice, the thing auditors are paid to do. And the run that is best practice on your own estate is, byte for byte, the same run that is an attack on a stranger's. Same binary. Same magazine. Same parallel login attempts. Same output. The tool cannot tell the two apart, because there is nothing in the tool to tell apart — the difference is entirely, and only, consent and target: did the estate being audited agree to be audited, and does it belong to the person running the audit?

This is why the presence of these tools can never, coherently, be treated as inherently malicious. To do so would be to indict every security team on earth, since every one of them runs exactly these tools against exactly this kind of target — their own. The auditors are the instruments a security audit is made of. The census records them only because, in these cases, they were pointed at machines that never asked to be audited. The verdict was never in the tool. It was always in who held it, and whether the target had agreed.

Reading the auditors — for defenders

• Detect the function, not the binary. Hydra, Ncrack, and Medusa are interchangeable; signaturing one invites a switch to another. Alert on the behaviour — high-parallelism multi-credential login testing — which all three share.
• Read an auditor hit as an early warning. The auditor's job ends at discovery; the harm is the next actor's move. An auditor hit means someone now knows which of your credentials are weak — rotate and enforce them before the window closes.
• Escalate staged operations. Auditor activity preceded by reconnaissance from shared infrastructure is a deliberate, engagement-style operation, far more serious than commodity spray. The recon-then-audit sequence is the tell.
• Never treat the tool as the crime. These are your own audit instruments. Judge consent and target — an unrequested audit of your credentials — never the presence of Hydra, Ncrack, or Medusa, which your own team also runs.

The census named these three tools because they are famous, and famous for a reason: they are the tools that make a password audit possible, on both sides of every login prompt on the internet. The Auditors are not the exception that proves the armory can contain a truly malicious tool. They are the rule at its clearest — a whole class of instrument that is definitionally the defender's, showing up in a catalogue of attacks only because someone aimed the defender's own tool the wrong way.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-075A — The Armory: What 12,000 Attackers Carry — the census's professional credential-auditor tier.
• TI-2026-075B — The Cloud Contractor — the rented-cloud pentest shelf the auditors sit on.
• TI-2026-075J — The Ammunition — the credential magazines the auditors fire.
• TI-2026-075N — The Mapmaker — the recon tool the auditors travel with; both measure rather than exploit.
• TI-2026-075I — The Weapon Is Never the Point — the thesis at its cleanest: a tool whose sanctioned purpose is the attack.

This dossier documents observed adversary behaviour for defensive purposes. Hydra, Ncrack, and Medusa are legitimate, standard security-audit tools; nothing here attributes criminality to them, only to the non-consensual act of auditing a stranger's credentials. TLP:WHITE.