Operator Discovery

How session-level HASSH fingerprints surface coordinated SSH operators that subnet- and ASN-based clustering can't see — and what that's worth to your threat model.

// What we see right now

// Why HASSH

HASSH is an MD5 hash of the SSH client's KEX (key exchange), encryption, MAC, and compression algorithm sets, in the order the client offers them. Two clients running the same SSH library, version, and configuration produce the same HASSH — even if they're connecting from different IPs, ASNs, or countries.

That's the whole insight: an attacker can rent new IPs, but they can't easily change their tooling. A botnet operator controlling 4,000 compromised hosts is going to use the same SSH client on all of them, because that's what the malware ships with. A scanner deployed across 500 cloud VMs is going to identify identically on every connection, because that's what ZGrab does. HASSH collapses the cosmetic disguise of distributed infrastructure to expose the operator behind it.

Volume-based reputation services (Censys, Shodan, AbuseIPDB, CrowdSec) cannot cluster on HASSH because they don't run cowrie-class capture that produces HASSH. GreyNoise classifies SSH traffic but doesn't expose HASSH-based pivots publicly. We do both: every fingerprint is pivotable at /tools/hassh/<fp>/ and /api/v1/fingerprints/hassh/<fp>, and the campaign detector promotes qualifying clusters automatically.

// How the detector decides

A HASSH fingerprint qualifies as a hassh_cluster campaign when all of these are true:

The thresholds are intentionally conservative. Tightening them would catch smaller operators but contaminate the cluster set with false positives. Loosening them would surface more activity but make the "this is a real distributed operator" claim less defensible. The current values (50 actors, 3 /16s) are tuned from production data and published in the source: apps/threats/campaigns.py — constants HASSH_MIN_ACTORS and HASSH_MIN_SUBNETS_16.

// Top fingerprints in the last 7 days

Distinct non-benign actors per HASSH, last 7 days. Click any fingerprint to drill into its actor list, geographic spread, and ASN distribution.

// What the detector won't catch

Important to be honest about the limits:

• Operators using diverse tooling. A sophisticated actor running multiple SSH clients across their fleet will produce multiple HASSH fingerprints. Each one might fall below the 50-actor threshold individually. Credential-fingerprint and JA4 pivots (planned, GH #186) will help triangulate these.
• Single-provider hosting farms. Intentionally excluded by the /16 dispersion check — those are caught by our subnet and ASN detectors instead.
• Non-SSH attacks. HASSH is SSH-specific. The same architectural pattern (capture → pivot → detector) will extend to JA4 for TLS, but that's a separate feature in the queue.
• Brand-new operators. The 7-day window means a fresh operator needs at least one sensor touch from each of 50 IPs before they surface. Slow-and-low operators that probe gradually will take longer to cluster — that's the cost of a high-confidence threshold.

// How to use it