OffSeq Mirage honeypot sensors detected a malicious file with SHA-256 hash 0c99433c7d433d65ab890dcee20b330f262379d532bc76f91e18f09ecfa5fb54 during attacker activity on June 24-25, 2026. The file is linked to the ATT&CK technique T1105, which involves ingress tool transfer, suggesting the file was used to deliver or stage malicious payloads such as droppers, web shells, miners, or post-exploitation tools. This indicator can be used to match against files in environments and endpoint detection and response (EDR) or antivirus (AV) systems to identify potential compromise. There is no vendor patch or remediation applicable as this is an indicator of a malicious file rather than a vulnerability. No confirmed exploitation or targeted countries are reported.

The presence of this malicious file hash indicates potential compromise involving the transfer of malicious tools or payloads. If found in an environment, it suggests that an attacker may have staged or delivered harmful software such as droppers, web shells, miners, or post-exploitation tools. However, there is no evidence of widespread exploitation or active campaigns using this file hash beyond the observed honeypot detections.

No patch or official fix is applicable since this is an indicator of compromise rather than a software vulnerability. Organizations should use this SHA-256 hash to scan their environments, including endpoint detection and response (EDR) and antivirus (AV) systems, to identify and remediate any presence of this malicious file. Incorporate this indicator into threat intelligence feeds and monitoring tools to detect potential ingress tool transfer activity. Follow standard incident response procedures if the file is detected.