Machine-speed attack TTPs: what attackers did on JODOR deception systems

This article is written for security operations centre (SOC) teams, cyber threat intelligence (CTI) teams and defence teams. It summarises what attackers actually did on the sensors and deception systems JODOR operated in Saudi Arabia between 29 August and 23 October 2026, and gives you what you need to spot the same behaviour in your own logs. It is marked TLP:CLEAR, so you may share it freely.

Where the data comes from

We placed four types of sensor in front of one live web platform that JODOR operates in Saudi Arabia, which is neither a bank nor a government body. The first type is deceptive web paths, the second is service sensors, the third is sensors at the edge and in the web application firewall (WAF), and the fourth is network sensors. Over 56 days they recorded 450,908 requests from 22,924 addresses. We counted an address as an attacker when JODOR confirmed it hostile, or when it sent a request matching a published exploit pattern or asked for a secret file. By that definition there were 2,207 attackers from 84 countries, where country means hosting location and not attribution.

Timing: everything happens in the first second

906 attackers sent a single request and vanished, while 646 sent ten or more. 416 attackers sent five or more requests within one second, and the busiest single address reached 286 requests in one second. Of the 173 attackers who used a known exploit, 110 used it within the first second of arriving, which is 64%, and 146 within ten seconds, which is 84%. Among those hunting for secrets, the median time to the first secret-file request was 0.75 seconds after their first request.

These figures come from web-log timestamps, measured from each attacker's first logged request. We want to be clear that logs alone cannot prove an attacker used AI. What they do prove is that the attacks were fully automated, and that a window for manual response effectively does not exist.

Exploit families and CVEs

The table below shows the exploit families we saw, the request pattern, the weakness, the MITRE ATT&CK technique and the number of attackers. One attacker can appear in more than one family.

What stands out is that most of these flaws are old and have had published fixes for years. Attackers do not need a new vulnerability while the old ones still open doors.

The techniques in MITRE ATT&CK terms

Mapped to the ATT&CK matrix, exploitation of public-facing applications (T1190) appeared for 770 attackers, by far the most common technique. Unsecured credentials (T1552) followed with 293 attackers, a wider set than the 261 secret hunters. Attempts to run commands on the server (T1059) came from 145 attackers, container discovery through the Docker interface (T1613) from 59, attempts to plant or call a web shell (T1505.003) from 39, and logins with stolen or guessed credentials (T1078 and T1110) from 25. Active automated scanning (T1595) was present almost everywhere, which is why we did not count it as a separate figure.

Who attacked, and what the lists caught

None of the 2,207 attackers matched a known state-linked group, and no match is not proof of absence. Half of them, 1,102, were on none of 34 public blocklists, and the matches we did find came from commodity public lists. 76% were seen on one day only. Of the 220 attackers hosted in Saudi Arabia, 194 were on no list. Some visitors posed as search-engine robots from networks those search engines do not use. Our assessment is that these were very likely opportunistic, automated attackers, so they should be judged by behaviour rather than by reputation.

We confirmed 18 addresses in two tiers. Tier A holds 16 addresses that appeared on two or more public lists, raised a real JODOR alert and showed exploit behaviour, with between 5 and 1,752 requests each. Tier B holds two addresses that were on no list but touched the deception systems and attempted exploitation. One sent 152 requests while posing as a search robot and swept configuration files and secrets; the other swept fifteen or more variants of the .env file. Address indicators age quickly, so re-check them before you block. The full pack is available on request through the contact form.

Detection rules

JODOR's AI agents wrote 163 detection rules, and we have published eight of them as YARA rules for web-server, reverse-proxy and firewall access logs rather than for file scanning. This is the PHP-CGI argument injection rule, which caught 81 attackers:

rule PHP_CGI_Argument_Injection
{
    meta:
        author = "JODOR Technologies"
        mitre  = "T1190"
        tlp    = "CLEAR"
    strings:
        $a  = "allow_url_include" ascii nocase
        $b  = "auto_prepend_file" ascii nocase
        $c  = "php://input" ascii nocase
        $c2 = "php%3A//input" ascii nocase
    condition:
        $a and $b and ($c or $c2)
}

Run it with a command such as yara rules.yar exported_access_log.txt. The secrets-sweep rule needs your logs grouped by client or address first, because its condition requires four or more secret paths from the same source. The other rules cover Apache CGI traversal, ThinkPHP, the Docker API, Spring Actuator, Laravel Ignition and the confirmed hostile-infrastructure list.

What to do today

Start by blocking the listed exploit paths at the edge, and raise an alert on any request for secret files or deceptive paths, because a genuine user never asks for them. Patch CVE-2021-41773, CVE-2021-42013, CVE-2024-4577, CVE-2012-1823, CVE-2021-3129 and CVE-2017-9841 on internet-facing systems within fourteen days at most. Rotate any key that was ever in a web folder, even if you have since removed it, and keep secrets in a dedicated vault. Stop web-server processes from starting a shell, and watch web folders for new files. Require multi-factor authentication and rate-limit login attempts. Make address blocks expire after 30 to 90 days, and verify search robots by reverse lookup before you trust them.

Before you rely on any of this, test it. Replay the exploit paths against a staging environment rather than production, confirm that an alert fires within ten seconds of the first request, check that secret-file paths return 404 and raise an alert, and confirm that blocks really expire on the date you set. Then run JODOR's rules over one day of your access logs and review every hit.

Subscribers to JODOR Managed Deception receive this level of detail every month, but about the attackers who target them specifically.

Sources: JODOR sensors and deception systems in Saudi Arabia, 29 August to 23 October 2026, collected by JODOR and not published in raw form. JODOR rule file web_exploitation_rules_2026Q3.yar, marked TLP:CLEAR. MITRE ATT&CK Enterprise matrix, the common public reference for classifying attacker behaviour. The CVE records named above in the public CVE database, the official source for each vulnerability's description.