Threats tagged 'in-the-wild'

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-06-28 and 2026-07-06. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in GB, DE. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 6 time(s) in attacker activity between 2026-06-24 and 2026-07-04. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in IT, KR, IR. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 38 time(s) in attacker activity between 2026-06-24 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in VN, SG, HK, BD, NZ, BR, MO, CN. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2,357 time(s) in attacker activity between 2026-06-24 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in IR, IN, MX, JP, BR, TW, PK, TR. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.