This entry reports on ThreatFox Indicators of Compromise (IOCs) dated 2026-10-17. It relates to malware activity involving payload delivery and network activity. No specific technical details, affected software versions, or exploits in the wild are provided. The severity is assessed as medium based on the available information.
This entry provides Indicators of Compromise (IOCs) from ThreatFox dated 2026-10-16. It relates to open-source intelligence (OSINT) about malware activity, specifically focusing on payload delivery and network activity. No specific technical details, affected software versions, or exploits in the wild are reported.
This entry provides Indicators of Compromise (IOCs) from ThreatFox dated 2026-10-15. It relates to observed malware activity involving network behavior and payload delivery. No specific technical details, affected software versions, or exploit information are provided.
A malicious file identified by the SHA-256 hash 7b8cd695424f9b004b459ce886d92e9a24f38957dc9071510ab669a7cb89c417 was observed in attacker activity between October 14 and October 24, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was detected by OffSeq Mirage honeypot sensors. The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Brazil and Italy. This indicator can be used to match against files in environments and security feeds to detect potential compromise.
An attacker URL 'db7gmmcupag28tv6hn00opfunut1saqiz.oast.fun' was observed in the wild on 2026-10-14 by OffSeq Mirage honeypot sensors. The URL was used as an out-of-band callback or command-and-control (C2) endpoint associated with the ATT&CK technique T1071 (Application Layer Protocol). The attacker infrastructure was identified as originating from Turkey (TR). This URL was seen twice during the observation period. No specific software versions are affected as this is an indicator of compromise rather than a software vulnerability.
This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-10-14. It is categorized as open-source intelligence (OSINT) concerning network activity and payload delivery. No specific malware details, exploits, or affected software versions are provided.
A malicious file identified by the SHA-256 hash cc0e9d0184c0b930381446b6891769a35711b38c6a57303482e3115f921d4edc was observed 26 times in attacker activity between October 13 and October 21, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to transfer tools or payloads into target environments. The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Hong Kong, India, South Korea, Taiwan, and the United States. This indicator should be matched against files in environments and security tools to detect potential compromise.
This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-10-13. It is categorized as OSINT related to network activity and payload delivery but lacks detailed technical information or specific malware signatures.
This entry provides Indicators of Compromise (IOCs) from ThreatFox dated 2026-10-12. It relates to open-source intelligence (OSINT) on network activity and payload delivery. No specific malware details, vulnerabilities, or exploits are described. No affected software versions or patch information is provided.
A malicious file identified by the SHA-256 hash 8a34152174b8009549359c9dd2407bd93c80e7dc3d0dedebdf8df423ccbdeacf was observed by OffSeq Mirage honeypot sensors on October 11, 2026. This file was detected six times in attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in South Korea and Ukraine. Organizations should check this hash against their environments and security tools to detect potential compromise.
This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-10-11. It is categorized as OSINT related to network activity and payload delivery but does not specify a particular malware or exploit. No affected software versions or technical details are provided.
This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-10-10. It is categorized under OSINT, network activity, and payload delivery, indicating it relates to threat intelligence data rather than a specific vulnerability or exploit. No specific malware details, affected software versions, or technical analysis are provided.
A malicious file identified by the SHA-256 hash e5f1c2ec78b2d1bede0ef4502e1b9acb00ca6dcb34468937075b3c5d56f811ec was observed by OffSeq Mirage honeypot sensors on 2026-10-09. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in South Korea (KR). No known exploits in the wild or specific affected software versions are reported.
A malicious file identified by the SHA-256 hash 1ecfe3ec7b25893dc55c0ed14196a817f1edd0469cca0a6ad42974d0eccbf146 was observed by OffSeq Mirage honeypot sensors on October 9, 2026. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. This hash can be used as an indicator of compromise to detect the presence of this specific malicious payload in environments and security tools. No specific software versions or patches are applicable. No known exploits or threat actors are linked to this hash at this time.
This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-10-09. It is categorized as OSINT related to network activity and payload delivery but lacks specific technical details or exploit information.
This entry reports on ThreatFox Indicators of Compromise (IOCs) dated 2026-10-08. It is categorized under OSINT, payload delivery, and network activity but lacks detailed technical information or specific indicators. No affected software versions or exploits in the wild are identified. The severity is assessed as medium based on the provided metadata.
A malicious file identified by the SHA-256 hash 81a7cdbbf15c84b01f5144fa45f4148dd12a373df07ea37850510cc3b0694d92 was observed by OffSeq Mirage honeypot sensors on 2026-10-07. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator should be matched against files in environments and security tools to detect potential compromise.
This entry provides Indicators of Compromise (IOCs) related to malware activity collected on 2026-10-06 from the ThreatFox MISP Feed. It is categorized as OSINT related to payload delivery and network activity. No specific technical details, affected software versions, or exploits in the wild are provided.
This entry reports on ThreatFox Indicators of Compromise (IOCs) dated 2026-10-05. It is categorized as open-source intelligence (OSINT) related to network activity and payload delivery. No specific malware details, affected software versions, or exploitation techniques are provided. There is no indication of active exploitation or available patches.
This entry reports on ThreatFox Indicators of Compromise (IOCs) dated 2026-10-04. It is related to malware activity involving network behavior and payload delivery, but lacks specific technical details or exploit information.