An attacker URL 'db7gmmcupag28tv6hn00opfunut1saqiz.oast.fun' was observed in the wild on 2026-10-14 by OffSeq Mirage honeypot sensors. The URL was used as an out-of-band callback or command-and-control (C2) endpoint associated with the ATT&CK technique T1071 (Application Layer Protocol). The attacker infrastructure was identified as originating from Turkey (TR). This URL was seen twice during the observation period. No specific software versions are affected as this is an indicator of compromise rather than a software vulnerability.
A malicious file identified by the SHA-256 hash cc0e9d0184c0b930381446b6891769a35711b38c6a57303482e3115f921d4edc was observed 26 times in attacker activity between October 13 and October 21, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to transfer tools or payloads into target environments. The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Hong Kong, India, South Korea, Taiwan, and the United States. This indicator should be matched against files in environments and security tools to detect potential compromise.
CVE-2026-105445 is a critical vulnerability in Docker Hub's account-to-organization conversion feature that allows an authenticated attacker to reassign a personal access token (PAT) they control to another user without requiring token rotation or revocation. This enables the attacker to use the unchanged PAT to authenticate as the recipient user and perform actions such as pulling, pushing, or deleting images within the token's scope, including organization repositories.
A malicious file identified by the SHA-256 hash 8a34152174b8009549359c9dd2407bd93c80e7dc3d0dedebdf8df423ccbdeacf was observed by OffSeq Mirage honeypot sensors on October 11, 2026. This file was detected six times in attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in South Korea and Ukraine. Organizations should check this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash e5f1c2ec78b2d1bede0ef4502e1b9acb00ca6dcb34468937075b3c5d56f811ec was observed by OffSeq Mirage honeypot sensors on 2026-10-09. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in South Korea (KR). No known exploits in the wild or specific affected software versions are reported.
A malicious file identified by the SHA-256 hash 1ecfe3ec7b25893dc55c0ed14196a817f1edd0469cca0a6ad42974d0eccbf146 was observed by OffSeq Mirage honeypot sensors on October 9, 2026. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. This hash can be used as an indicator of compromise to detect the presence of this specific malicious payload in environments and security tools. No specific software versions or patches are applicable. No known exploits or threat actors are linked to this hash at this time.
A malicious file identified by the SHA-256 hash 81a7cdbbf15c84b01f5144fa45f4148dd12a373df07ea37850510cc3b0694d92 was observed by OffSeq Mirage honeypot sensors on 2026-10-07. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator should be matched against files in environments and security tools to detect potential compromise.
The URL webhook.site was observed in attacker activity as an out-of-band callback or command-and-control (C2) endpoint between 2026-10-01 and 2026-10-05. This activity was detected by OffSeq Mirage honeypot sensors and involved the use of the T1071 technique (Application Layer Protocol). The URL was seen originating from attacker infrastructure in Iran (IR) and Mali (ML).
A malicious file identified by the SHA-256 hash b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793 was observed by OffSeq Mirage honeypot sensors three times between September 25 and October 8, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
A threat actor exploited a path traversal vulnerability (CVE-2025-4632) in Samsung MagicINFO 9 Server to gain unauthorized access to endpoints. They deployed a rogue AnyDesk remote access tool, created a local administrator account, and disabled Microsoft Defender protections. Instead of deploying a pre-compiled cryptominer, the actor compiled a Monero cryptominer directly on the compromised endpoint using multiple compilers and utilities. The miner connected to the C3Pool mining service and ran under explorer.exe with suspicious arguments. This on-endpoint compilation generated significant endpoint detection and response (EDR) telemetry, increasing detectability despite attempts at stealth.
In September 2026, the Chinese threat actor UTA0565 exploited unpatched zero-day vulnerabilities in Google Chrome and Microsoft Windows through phishing campaigns targeting Asian government entities. The attacker used fake domains impersonating legitimate organizations to deliver an exploit chain leveraging CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. Successful exploitation resulted in deployment of CLEANGULP, a previously undocumented malware family with backdoor capabilities including command execution, file operations, and beacon object file execution. CLEANGULP communicated with command-and-control servers using encrypted HTTP traffic with custom encoding. Multiple Chinese APT groups shared access to this exploit kit, indicating coordinated cyber espionage activity during the vulnerability window. Patch status is not yet confirmed; organizations should monitor vendor advisories and apply patches once available.
CVE-2026-94450 is a high-severity vulnerability in AWS s2n-quic versions 1.88.0 and earlier. It involves improper validation of the Destination Connection ID length, which can allow an unauthenticated remote attacker to cause a denial of service by shutting down a server endpoint with a single crafted UDP datagram. This affects only server endpoints configured to send Retry packets. The issue is fixed in version 1.89.0 and later.
A suspected Chinese-speaking threat actor linked to Red Heron conducted extensive exploitation campaigns from May to September 2026. The attacker exploited multiple vulnerabilities in WordPress (CVE-2026-63030, CVE-2026-60137) to breach a western government organization, stealing over 18,000 sensitive records including credentials and personally identifiable information. Additionally, the actor exploited CVE-2026-7273 in ZyXEL GS1900 switches, compromising 996 devices across 48 countries and exfiltrating configurations and credentials. The adversary demonstrated sophisticated capabilities such as custom tool development possibly using large language models, privilege escalation, and systematic data exfiltration via PowerShell-based techniques.
The URL 'oast.me' has been observed in attacker activity as an out-of-band callback or command-and-control (C2) endpoint. This activity was detected by OffSeq Mirage honeypot sensors four times between September 20, 2026, and October 3, 2026. The observed technique corresponds to MITRE ATT&CK T1071, which involves using application layer protocols for command and control. The attacker infrastructure was identified as originating from Lithuania (LT). Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash bb36568c1f0a4f4d604cc67f8692506291eb1ffd217a451ffc846c94daa09440 was observed by OffSeq Mirage honeypot sensors five times between September 19, 2026, and October 8, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. No known exploits in the wild or specific affected software versions are identified.
A malicious file identified by the SHA-256 hash 39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96 was observed 12 times in attacker activity between September 18, 2026, and October 21, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in South Carolina. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash b5eec555aa0e07b1af33a0ec195a3fb195e1543339d22305fffbfa7e6a7b4381 was observed twice on September 16, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect or block the associated malicious file in environments and security tools.
CVE-2026-86830 is a high-severity vulnerability in AWS IAM Identity Center's Temporary Elevated Access Management (TEAM) solution prior to version 1.5.1. It involves incorrect privilege assignment that could allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests. This could lead to unintended temporary elevated access to AWS accounts managed through TEAM. The issue is fixed in version 1.5.1 and later.
A malicious file identified by the SHA-256 hash eaf9adb4bb80316a3aafceabc0f2ed2aed7c76cf134b9b7c66226fc4f003aa97 was observed by OffSeq Mirage honeypot sensors in attacker activity between September 14, 2026, and October 14, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in China. This hash fingerprints a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 7cc0b40e8819ec9139ffae5942add2db1c26e168edaeda57302c9047f23dfb6c was observed by OffSeq Mirage honeypot sensors on 2026-09-07. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. The attacker infrastructure was located in the United States. No known exploits in the wild or specific affected software versions are identified.
