Research, limits and technical truth
01 · FINDINGS AND OHIIHO RESEARCH
The public record of what controlled environments can reveal.
OHIIHO states what HIIH produces. OHIIHO Research shows what monitored HIIH environments have actually revealed. Research is evidence of collection and analysis capability; HIIH does not claim that every Research report is a direct export of the customer Finding pipeline.
Finding family: Engagement
Post-access propagation
Observed — a Go ransomware-worm executing inside a controlled target.
Supporting material — session records, transferred artifacts, encryption and propagation sequence.
Outcome — behavioral analysis plus detection and hunting content.
Inside Sorry-worm: anatomy of a Go ransomware-worm hybrid · 2026-05
Read the research →
Finding family: Engagement
Agentic workflow
Observed — AI-enabled tooling used to assemble and run an intrusion-support workflow, inside a controlled environment.
Supporting material — workflow sequence, generated artifacts and operating patterns.
Outcome — carefully qualified analysis of how AI-assisted tooling reshapes an intrusion.
The AI Did Not Write the Phish. It Built the Business. · 2026-06
Read the research →
Finding family: Access
Access validation
Observed — credentials presented and SSH probed across multiple regions, captured target-side.
Supporting material — authentication sequences, client characteristics, timing and infrastructure patterns.
Outcome — detection context for credential-validation behavior distinct from broad scanning.
Residential Broadband Botnet Uses AsyncSSH to Validate Credentials Across Four Regions · 2026-06
Read the research →
Each example separates observed facts from assessment. Explore evidence from OHIIHO Research ↗
02 · HONEST LIMITS AND TECHNICAL TRUTH
What the current Finding model does — and does not — guarantee.
| What HIIH does today | What it does not claim |
|---|---|
| A structured Finding object and model exist and represent interpreted adversary activity | Not every Finding carries the same evidence depth or class |
| Findings can include related observations or artifacts | Signed or tamper-evident evidence manifests are not offered today (file hashes are provided as analytical identifiers) |
| The Surface Console exposes Findings and related context | Not every Finding type is populated yet — the access family is live today |
| Console, MCP and API pull paths exist; STIX 2.1 over TAXII 2.1 is available by engagement | Identical fields across every output format |
| Selected real examples can be demonstrated and sanitized | A Finding does not automatically establish attribution or targeting |
Current public scope
The model exists, demonstrated today
The structured Finding model is real and demonstrable, and the Console, MCP and API pull paths carry the same Finding identity; STIX 2.1 over TAXII 2.1 is available by engagement. The Access Finding family is live and inspectable in the Console. Every Finding shown is labeled with the evidence it links to; depth varies by engagement.