OffSeq Mirage honeypot sensors observed this SHA-256 file hash 4 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in PL. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 4 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in PL. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 4 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in PL. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 4 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in PL. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in PL. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 3 time(s) in attacker activity between 2026-07-01 and 2026-07-06. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in GB. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-01 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in US. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in ES. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 162 time(s) in attacker activity between 2026-07-01 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in CN, HK, VN, EG, KR, US, IR, TW. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 10 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in CN. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 10 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in CN. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 10 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in CN. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block, exposing uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-06-29 and 2026-06-29. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in KR. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 10 time(s) in attacker activity between 2026-06-28 and 2026-07-07. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in KR, CN. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 10 time(s) in attacker activity between 2026-06-28 and 2026-07-07. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in KR, CN. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
A malicious file identified by the SHA-256 hash 783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59 was observed by OffSeq Mirage honeypot sensors during attacker activity between June 28, 2026, and July 15, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. This hash serves as an indicator of compromise (IOC) to detect this specific malicious payload in environments.
A malicious file identified by the SHA-256 hash 59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5 was observed by OffSeq Mirage honeypot sensors during attacker activity between June 28 and July 15, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Germany and the United Kingdom. No known exploits or threat actors are currently linked to this indicator. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7 was observed in attacker activity between 2026-06-28 and 2026-07-15. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was detected by OffSeq Mirage honeypot sensors. The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. Organizations are advised to match this hash against files in their environments and security tools.
A malicious file identified by the SHA-256 hash dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9 was observed by OffSeq Mirage honeypot sensors in attacker activity between 2026-06-28 and 2026-07-15. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and may represent a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. This indicator can be used to detect or block the malicious payload in affected environments.