OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-02 and 2026-07-02. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in US. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in PL. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 4 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in PL. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 4 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in PL. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 4 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in PL. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 4 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in PL. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in PL. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 3 time(s) in attacker activity between 2026-07-01 and 2026-07-06. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in GB. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-01 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in US. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in ES. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 162 time(s) in attacker activity between 2026-07-01 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in CN, HK, VN, EG, KR, US, IR, TW. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 10 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in CN. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 10 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in CN. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 10 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in CN. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-06-29 and 2026-06-29. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in KR. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
The URL www.interact.sh has been observed in the wild as an attacker-controlled callback or command-and-control (C2) endpoint. It was detected by OffSeq Mirage honeypot sensors five times between June 29, 2026, and October 22, 2026. The activity involved the use of the MITRE ATT&CK technique T1071 (Application Layer Protocol). The attacker infrastructure was identified in France, Turkey, and the United States. Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
OffSeq Mirage honeypot sensors observed this attacker URL 12 time(s) in attacker activity between 2026-06-29 and 2026-06-29. Observed technique: T1071 (Application Layer Protocol). Seen from attacker infrastructure in FR. This URL was used as an out-of-band callback or command-and-control endpoint. Block and monitor it, and search your proxy/web/WAF logs for requests to it.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 10 time(s) in attacker activity between 2026-06-28 and 2026-07-07. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in KR, CN. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 10 time(s) in attacker activity between 2026-06-28 and 2026-07-07. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in KR, CN. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
A malicious file identified by the SHA-256 hash 783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59 was observed by OffSeq Mirage honeypot sensors during attacker activity between June 28, 2026, and July 15, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. This hash serves as an indicator of compromise (IOC) to detect this specific malicious payload in environments.