A malicious file identified by the SHA-256 hash 154d5729d26ae38ff37e7d1463a019d259da7c0f9a37e4482333e1e686ebe39e was observed by OffSeq Mirage honeypot sensors on July 18, 2026. This file was detected three times during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The file was associated with attacker infrastructure located in Brazil and Iran. Organizations are advised to match this hash against files in their environments and security telemetry to detect potential compromise.
A malicious file identified by the SHA-256 hash 135cefead339d5e0813e38049da8666efefef7c7b64c6ed22f5fec62b676ced1 was observed by OffSeq Mirage honeypot sensors on August 8, 2026. The file was detected twice during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This hash can be used as an indicator of compromise to detect the presence of this malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash 0dc95fb4077cce0bff19aa1a77109d059dff6503bbf6c1b0dd2f41fc0a4c88e7 was observed 167 times in attacker activity between July 12 and August 1, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Bulgaria, France, Great Britain, Hong Kong, and the United States. This file hash serves as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash 0cb070e16ed2c0c6b1df1df4ffa57be59c4bed42f8ac3803d37d0c54c7c9f958 was observed twice in attacker activity on July 26, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The activity was detected by OffSeq Mirage honeypot sensors and linked to attacker infrastructure in MU. There is no information on known exploits in the wild or affected software versions.
A malicious file identified by the SHA-256 hash 0616c20dea0ff2bd59fff5b60b3e907231d8c99296d0a0c719ba553f83dbd056 was observed 10 times on 2026-10-24 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is provided.
A malicious file identified by the SHA-256 hash 048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7 was observed in attacker activity between 2026-06-28 and 2026-07-15. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was detected by OffSeq Mirage honeypot sensors. The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. Organizations are advised to match this hash against files in their environments and security tools.
A malicious file identified by the SHA-256 hash 01dc4719944a22b0d4fc55112ed7d7366ea82773ffa178bedf472b3d66d8b3b9 was observed by OffSeq Mirage honeypot sensors four times between July 23 and July 28, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure located in MU. There is no information on active exploitation in the wild or known threat actors associated with this hash. No affected software versions or patches are applicable as this is an indicator of compromise rather than a software vulnerability.
A URL associated with attacker activity was observed multiple times in the wild on July 19, 2026. The URL, hosted on sistemasyusa.icu, was linked to an attacker payload involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This URL was seen in attacker payloads such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified as originating from the Philippines. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
A URL associated with attacker activity was observed multiple times on July 18, 2026. The URL, https://sistemasyusa.icu/admin/productimages/b, was detected by OffSeq Mirage honeypot sensors and linked to the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The attacker infrastructure was identified as originating from the Philippines. This URL has been used in attacker payloads such as tool downloads, callbacks, or exploitation targets. No specific software vulnerability or exploit code is detailed.
The URL https://psychologylifecentre.com/bins/unkillbot_x86_64 was observed in attacker activity on 2026-07-20 by OffSeq Mirage honeypot sensors. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it is used for transferring attacker tools or payloads. The URL was seen four times and linked to attacker infrastructure located in the United States. It is recommended to block and monitor this URL and search proxy, web, and WAF logs for any requests to it.
An attacker URL https://psychologylifecentre.com/bins/$b was observed in the wild by OffSeq Mirage honeypot sensors 38 times between July 19 and July 21, 2026. The URL is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen in attacker payloads such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified in the Philippines and the United States. Defenders are advised to block and monitor this URL and search their proxy, web, or WAF logs for any requests to it.
The URL http://vps.atlas101.us.kg:7768/dl.sh was observed in attacker activity by OffSeq Mirage honeypot sensors on August 17, 2026. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it is used for transferring tools or payloads during attacks. The attacker infrastructure was identified as originating from Bulgaria. This URL has been seen in attacker payloads such as tool downloads, callbacks, or exploitation targets. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
An attacker URL (http://en2an.top/cleanfda/init.sh) was observed in the wild by OffSeq Mirage honeypot sensors on 2026-10-23. The URL is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen twice in attacker activity originating from infrastructure in China. This URL is linked to attacker payloads such as tool downloads, callbacks, or exploitation targets. No specific software versions or CVEs are associated with this indicator. No known exploits or threat actors have been confirmed in connection with this URL.
A URL hosting an attacker payload script (http://bins.oceanic-node.su/wget.sh) was observed multiple times in attacker activity between July and August 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the URL was used for tool download or callback. The attacker infrastructure was identified in Hong Kong, South Korea, and Taiwan. This URL is considered an indicator of compromise and should be blocked and monitored in network defenses.
The URL sbc.questblue.com was observed in the wild as an attacker callback or command-and-control (C2) endpoint. This activity was detected by OffSeq Mirage honeypot sensors on July 24, 2026, with two occurrences noted. The technique involved is T1071, which relates to the use of application layer protocols for command and control. The attacker infrastructure was identified as originating from Finland (FI).
CVE-2026-115975 is a broken access control vulnerability in the JiraController component of CervantesSec's cervantes product version v1.3-beta. This flaw allows an attacker with some privileges to create, edit, or delete Jira tickets related to vulnerabilities in projects they should not have access to. The vulnerability has a high severity rating with a CVSS score of 7.1.
Formbook malware has resurfaced using localized business-order themed lures targeting European users and manufacturing organizations. The attack chain involves JavaScript, hidden PowerShell scripts, an AES-encrypted .NET payload, and process hollowing of aspnet_compiler.exe to execute Formbook. Persistence is maintained via SystemUpdate_* shortcuts and related artifacts. Network detection includes Formbook command-and-control check-ins flagged by Suricata. Indicators of compromise (IOCs) include specific domain names and file hashes. No direct patch or remediation is indicated in the source information.