IndicatorPublished 4 Nov 2026

Attacker url observed in the wild: https://github.com/xmrig/xmrig/releases/download/v6.22.2/… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2021-41773

Indicators of compromise

URLs 1

OffSeq Mirage — an attacker payload URL, observed 2026-11-04..2026-11-04, 24× (CVE-2021-41773)

https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-linux-static-x64.tar.gz

Description

OffSeq Mirage honeypot sensors detected an attacker URL linked to CVE-2021-41773, observed 24 times on 2026-11-04. The URL points to a payload hosted on GitHub for xmrig version 6.22.2, associated with the T1105 technique (Ingress Tool Transfer). The attacker infrastructure was identified in the US. This URL was used in attacker payloads for tool download or exploitation. Defenders are advised to block and monitor this URL and search logs for related requests.

Impact

The presence of this URL in attacker activity indicates active attempts to deliver or execute malicious payloads exploiting CVE-2021-41773. Successful exploitation could allow attackers to transfer tools into victim environments, potentially leading to further compromise. However, no direct exploit code or confirmed in-the-wild exploitation is reported in this data. The impact is tied to the exploitation of CVE-2021-41773, which is a known vulnerability.

Defensive guidance

Block and monitor the identified URL in network defenses such as proxy, web gateways, and WAFs. Search existing logs for any requests to this URL to identify potential compromise. Since this is an indicator of attacker infrastructure and payload delivery, standard patching and mitigation for CVE-2021-41773 should be applied as per vendor advisories.

Summary

The OffSeq Mirage threat intelligence platform observed an attacker-controlled URL used in the wild that hosts a payload related to CVE-2021-41773. This CVE corresponds to a vulnerability that attackers exploit to transfer tools or payloads into a target environment (technique T1105). The specific URL is a GitHub release link for xmrig 6.22.2 Linux static binary, which was seen 24 times on a single day from attacker infrastructure located in the United States. This indicator is relevant for detecting and blocking attacker activity involving this payload delivery method.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

URLs 1

Description

AI analysisMachine-generated, updated 4 Nov 2026, 16:16 UTC

MITRE ATT&CK techniques1 from threat tags

References

Community reviews

Related threats