Malicious SHA-256 file hash ae0e7b77c1e3… (OffSeq Mirage)

A malicious file identified by the SHA-256 hash ae0e7b77c1e3861661e63f0c615b842232851b8021f24eefd63ce9f88023012d was observed by OffSeq Mirage honeypot sensors on 2026-11-14. This file is associated with CVE-2026-109618 and was detected four times during attacker activity on that date. The observed attack technique is T1105 (Ingress Tool Transfer), indicating the file was likely used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the Netherlands. There is no information on affected software versions or confirmed exploitation in the wild.

• mirage.offseq.com (opens in a new tab)

• Bundesamt für Sicherheit in der Informationstechnik Amazon · PHP: Mehrere Schwachstellen ermöglichen CodeausführungExploitedVulnerability2026-10-20
• Helmholz: php2shellExploitedVulnerability2026-11-10
• Weidmueller: Security routers IE-SR-4TX and IE-SR-4GT affected by PHP vulnerabilityExploitedVulnerability2026-11-10
• ads-tec Industrial IT: PHP VulnerabilityExploitedVulnerability2026-11-10
• MB connect line: php2shellExploitedVulnerability2026-11-10