IndicatorPublished 7 Nov 2026

Malicious SHA-256 file hash cf0b50b8b7a8… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-11-07..2026-11-07, 2×

cf0b50b8b7a861c3490889683d857e50b54d0e4975678d58778bba800b589db8

Description

A malicious file identified by the SHA-256 hash cf0b50b8b7a861c3490889683d857e50b54d0e4975678d58778bba800b589db8 was observed twice on 2026-11-07 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was traced to Poland and Romania. This indicator should be matched against files in environments and security tools to detect potential compromise.

Impact

The presence of this malicious file indicates attacker activity involving the transfer of potentially harmful payloads into a target environment. The payload could enable further compromise through droppers, web shells, miners, or post-exploitation tools. However, there is no direct evidence of exploitation or impact severity beyond detection of the file hash. No known exploits in the wild are reported for this indicator.

Defensive guidance

Match the provided SHA-256 hash against files in your environment, endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds to identify potential compromises. There is no vendor patch or fix applicable as this is an indicator of malicious activity rather than a software vulnerability. Implement detection and blocking based on this IOC to prevent or respond to attacker tool transfers.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 7 Nov 2026, 15:50 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats