A malicious file identified by the SHA-256 hash e1568cae97252fa9350ef2d2d381975c8bd29e11f126fb06bd64e92a73d7beb9 was observed 196 times in attacker activity between July 16, 2026, and August 11, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Armenia, Argentina, Australia, Bulgaria, Brazil, Canada, Côte d'Ivoire, and China. This file hash serves as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash f6b70a84aaa31d0f4a3521f6ef91368be93d04b2153198c01731df22b96739ef was observed by OffSeq Mirage honeypot sensors during attacker activity between July 16 and July 17, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in China, Malaysia, Pakistan, and Russia. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat intelligence advises matching this hash against files in your environment and security tools. No known exploits or patches are reported for this indicator.
A malicious file identified by the SHA-256 hash 5a58a0b98ee139ca5264d58e631e947eb124b837d7555872b184ab5a0afc1788 was observed by OffSeq Mirage honeypot sensors on July 16, 2026. The file was seen twice during attacker activity originating from infrastructure in Great Britain. The observed technique corresponds to T1105 (Ingress Tool Transfer), indicating the file is likely a payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions are affected, and no known exploits in the wild have been reported for this indicator. This is an indicator of compromise (IOC) useful for detection and response efforts.
A malicious file identified by the SHA-256 hash e374a7ad447d2cf791ecae122894a51ba723901ea132e7fa16cd47c44e4a1769 was observed by OffSeq Mirage honeypot sensors three times between July 15 and July 18, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Croatia, the Netherlands, and the United States. This hash can be used as an indicator of compromise to detect this specific malicious payload in environments and security tools.
A malicious file identified by the SHA-256 hash fa4e294690bc1ffc2340daf400bd47fa58d515224f497f68fc2d280b1501f7cd was observed 55 times in attacker activity between July 15 and July 16, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in multiple countries including Brazil, Hungary, Indonesia, India, Iran, Pakistan, Russia, and Turkey. The hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. This indicator can be used to detect and block this malicious payload in affected environments.
A malicious file identified by the SHA-256 hash a6ea67372e5b31bfd633d9745541577e9f3edb39f0eea75cf9679b632ca04908 was observed twice on July 15, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and is linked to attacker infrastructure in Great Britain. This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. No known exploits or threat actors are currently associated with this indicator. No affected software versions or patches are identified.
A malicious file identified by the SHA-256 hash 40db9279ba409757c074048529be5bf8f141fa022489a965792e7f7de2223b78 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 14 and July 26, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This hash can be used as an indicator of compromise (IOC) to detect the presence of this malicious file in environments and security tools.
A vulnerability in the Symfony PHP framework prior to versions 7.4.13 and 8.0.13 allows an attacker to perform a signature algorithm downgrade in the MailomatRequestParser::validateSignature() function. The function incorrectly parses the X-MOM-Webhook-Signature header and uses the request-selected algorithm in hash_hmac() instead of enforcing the documented SHA-256 algorithm. This issue is fixed in Symfony versions 7.4.13 and 8.0.13.
Microsoft released the Windows 10 KB5099539 extended security update, which includes the July 2026 Patch Tuesday fixes addressing 570 vulnerabilities, including two exploited and one publicly disclosed zero-day. This update is part of the extended security updates (ESU) program for Windows 10, now extended to October 12, 2027, for enrolled devices. It primarily contains security patches and bug fixes without new features, updating Windows 10 to build 19045.7548 and Windows 10 Enterprise LTSC 2021 to build 19044.7548. Notable fixes include resolving issues in OLE Automation, File Explorer, Recycle Bin, input hotkey behavior, Secure Boot status reporting, networking transport registration, and Remote Desktop security enhancements. Some legacy applications using unregistered TDI transports may stop working due to new security hardening. Microsoft recommends migrating to SHA-256 for RDP certificate thumbprints to avoid future disruptions.
A malicious file identified by the SHA-256 hash b48d39eafd924b042bdfae32f0e19b0e9ff870b46d46f6ca7859e9dfc5a927d7 was observed 31 times on July 14, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Canada, India, and Turkey. There is no information about known exploits in the wild or affected software versions. The indicator is intended for matching against files in environments and security tools to detect this threat.
A malicious file identified by the SHA-256 hash 2d2be0eefdf649cff2a51ba6e11d20014e4203883791f1b8ae8cb56f2d245917 was observed by OffSeq Mirage honeypot sensors five times between July 13 and July 15, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Great Britain. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist (DENIED_EXTENSIONS) fails to block standard .php files. Because `php` is explicitly included in the allowed extension list for plugin archives, and extracted files are placed directly under the web root, any PHP file inside the ZIP becomes immediately executable via HTTP — without even needing to "enable" the plugin through the application UI. The /plugins/install-url API route (management.php) allows an administrator to source the malicious ZIP from any attacker-controlled HTTPS URL, validating it only against an attacker-supplied SHA-256 hash. This issue has been fixed in version 7.4.0.
A malicious file identified by the SHA-256 hash f2ca1bb6c7e907d06dafe4687e579fce76b37e4e93b7605022da52e6ccc26fd2 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 13 and July 15, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Spain. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The file was observed six times in the wild during this period. No specific affected software versions or patches are identified. No known exploits in the wild or threat actors are linked to this indicator.
A malicious file identified by the SHA-256 hash 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. This file was detected five times during attacker activity and is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Norway. There is no information about known exploits in the wild or affected software versions. This is an indicator of compromise to be matched against files in environments and security tools.
A malicious file identified by the SHA-256 hash 6ef4fcf12a66fb4f240fd1357a3e4c519f8f28e82146209168ce145d2b762991 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. This file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. There is no information about active exploitation or known threat actors linked to this file. No affected software versions or patches are specified.
A malicious file identified by the SHA-256 hash 578bfa5ed439f9d83b8197f4cf55c893c9f6447929c8df72c696fa9177213d3f was observed twice on July 12, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. No known exploits in the wild or affected software versions are reported. This indicator can be used to detect the presence of this malicious file in environments via file hash matching in EDR, AV, or threat intelligence feeds.
A malicious file identified by the SHA-256 hash aa111ee167785d363211b52af0cc02fae9c7e42968bff53d4a27db76929b7cf4 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in the United States. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is available. Organizations are advised to check this hash against their environments and security tools for detection.
A malicious file identified by the SHA-256 hash 2985d2ce196b9d6fb2c37d601a9b13a936b90ba84c2f16dbd06b53c2a7aecb49 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. This file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash a2328347ae28c0fd922ef7d919d0692444d5072cf58f32522896551fc622019a was observed by OffSeq Mirage honeypot sensors during attacker activity on July 12, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in the United States. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check for this hash in their environments and security tools. No known exploits or threat actors are currently linked to this indicator.
A malicious file identified by the SHA-256 hash f370b32bab1c20f235c9b88189c9e0769796f183bff521938acd4d69840e7ae4 was observed 436 times in attacker activity between July 12 and July 16, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure in multiple countries. This indicator can be used to detect and block the associated malicious payload in environments and security tools. No known exploits or active threat actors are currently linked to this file hash.