IndicatorPublished 8 Nov 2026

Attacker url observed in the wild: https://raw.githubusercontent.com/nightagents/nightshell/… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2017-9841

Indicators of compromise

URLs 1

OffSeq Mirage — an attacker payload URL, observed 2026-11-08..2026-11-08, 2× (CVE-2017-9841)

https://raw.githubusercontent.com/nightagents/nightshell/refs/heads/main/night.php?token=GHSAT0AAAAAACYWDMT5UQIYLJJSWO5KVDNIZYGPEDA

Description

An attacker URL associated with CVE-2017-9841 was observed in the wild by OffSeq Mirage honeypot sensors on 2026-11-08. The URL was seen twice in attacker activity and is linked to the T1105 technique (Ingress Tool Transfer), indicating its use for downloading tools or payloads during attacks. The URL originated from attacker infrastructure located in the United Arab Emirates (AE).

Impact

The presence of this URL in attacker payloads indicates active use of CVE-2017-9841 in attack scenarios, potentially allowing attackers to transfer malicious tools or payloads into victim environments. However, there is no confirmation of widespread exploitation or active in-the-wild exploitation beyond the observed honeypot activity.

Defensive guidance

Block and monitor access to the identified URL. Search proxy, web, and WAF logs for any requests to this URL to detect potential compromise attempts. Since this is an indicator of compromise related to CVE-2017-9841, ensure that systems are patched against CVE-2017-9841 as per vendor advisories.

Summary

OffSeq Mirage honeypot sensors detected an attacker-controlled URL hosted on raw.githubusercontent.com related to CVE-2017-9841. This URL was observed twice on 2026-11-08 as part of attacker activity involving the T1105 technique, which involves transferring tools or payloads into a target environment. The URL is used as an attacker payload for download, callback, or exploitation purposes. The activity was traced back to attacker infrastructure in AE. No direct exploit code or active exploitation confirmation is provided.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

URLs 1

Description

AI analysisMachine-generated, updated 8 Nov 2026, 18:18 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats