A malicious file identified by the SHA-256 hash 0616c20dea0ff2bd59fff5b60b3e907231d8c99296d0a0c719ba553f83dbd056 was observed 10 times on 2026-10-24 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is provided.
A malicious file identified by the SHA-256 hash 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 was observed 9 times on 2026-10-24 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations should match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
An attacker URL (http://en2an.top/cleanfda/init.sh) was observed in the wild by OffSeq Mirage honeypot sensors on 2026-10-23. The URL is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen twice in attacker activity originating from infrastructure in China. This URL is linked to attacker payloads such as tool downloads, callbacks, or exploitation targets. No specific software versions or CVEs are associated with this indicator. No known exploits or threat actors have been confirmed in connection with this URL.
A malicious file identified by the SHA-256 hash c38eaf2b436cefd15e73bfa0a143d996cac708c1bccc9d3ce9b371b418e85595 was observed twice on October 23, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect the presence of this specific malicious file in environments and security tools.
The URL alibaba.oast.pro was observed in the wild as an attacker-controlled callback or command-and-control (C2) endpoint. It was detected twice on 2026-10-21 by OffSeq Mirage honeypot sensors using the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified as located in Germany. This URL is associated with malicious activity and should be blocked and monitored in network defenses.
The URL aws.oast.online was observed in attacker activity as a callback or command-and-control (C2) endpoint. It was detected by OffSeq Mirage honeypot sensors on 2026-10-21, with four occurrences noted. The activity involved the use of the T1071 technique, which relates to application layer protocol communications. The attacker infrastructure was identified as being located in Germany. This URL is associated with malicious out-of-band communications and should be blocked and monitored in network defenses.
A malicious file identified by the SHA-256 hash 1984be06964df21243c08368f5497a050709ac64fce32c718389b60a04bd3870 was observed multiple times in attacker activity from October 21 to October 24, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and may represent a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in South Korea and the United States. This indicator can be used to detect or block the malicious payload in affected environments.
A URL associated with attacker activity was observed multiple times between 2026-10-17 and 2026-10-19. This URL was used as an out-of-band callback or command-and-control (C2) endpoint, employing the T1071 technique (Application Layer Protocol). The attacker infrastructure was located in the Netherlands. Security teams are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash 7b8cd695424f9b004b459ce886d92e9a24f38957dc9071510ab669a7cb89c417 was observed in attacker activity between October 14 and October 24, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was detected by OffSeq Mirage honeypot sensors. The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Brazil and Italy. This indicator can be used to match against files in environments and security feeds to detect potential compromise.
An attacker URL 'db7gmmcupag28tv6hn00opfunut1saqiz.oast.fun' was observed in the wild on 2026-10-14 by OffSeq Mirage honeypot sensors. The URL was used as an out-of-band callback or command-and-control (C2) endpoint associated with the ATT&CK technique T1071 (Application Layer Protocol). The attacker infrastructure was identified as originating from Turkey (TR). This URL was seen twice during the observation period. No specific software versions are affected as this is an indicator of compromise rather than a software vulnerability.
A malicious file identified by the SHA-256 hash cc0e9d0184c0b930381446b6891769a35711b38c6a57303482e3115f921d4edc was observed 26 times in attacker activity between October 13 and October 21, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to transfer tools or payloads into target environments. The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Hong Kong, India, South Korea, Taiwan, and the United States. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 8a34152174b8009549359c9dd2407bd93c80e7dc3d0dedebdf8df423ccbdeacf was observed by OffSeq Mirage honeypot sensors on October 11, 2026. This file was detected six times in attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in South Korea and Ukraine. Organizations should check this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash e5f1c2ec78b2d1bede0ef4502e1b9acb00ca6dcb34468937075b3c5d56f811ec was observed by OffSeq Mirage honeypot sensors on 2026-10-09. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in South Korea (KR). No known exploits in the wild or specific affected software versions are reported.
A malicious file identified by the SHA-256 hash 1ecfe3ec7b25893dc55c0ed14196a817f1edd0469cca0a6ad42974d0eccbf146 was observed by OffSeq Mirage honeypot sensors on October 9, 2026. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. This hash can be used as an indicator of compromise to detect the presence of this specific malicious payload in environments and security tools. No specific software versions or patches are applicable. No known exploits or threat actors are linked to this hash at this time.
A malicious file identified by the SHA-256 hash 81a7cdbbf15c84b01f5144fa45f4148dd12a373df07ea37850510cc3b0694d92 was observed by OffSeq Mirage honeypot sensors on 2026-10-07. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator should be matched against files in environments and security tools to detect potential compromise.
The URL webhook.site was observed in attacker activity as an out-of-band callback or command-and-control (C2) endpoint between 2026-10-01 and 2026-10-05. This activity was detected by OffSeq Mirage honeypot sensors and involved the use of the T1071 technique (Application Layer Protocol). The URL was seen originating from attacker infrastructure in Iran (IR) and Mali (ML).
In September 2026, Mandiant and Google Threat Intelligence Group identified active exploitation of two zero-day vulnerabilities (CVE-2026-88772 and CVE-2026-88771) in Citrix NetScaler ADC and Gateway appliances. Exploitation of CVE-2026-88772 allows attackers to bypass authentication and execute root-level code by causing a heap memory corruption in the NetScaler Packet Processing Engine. Attackers deploy custom PHP web shells (WHIPSHOT) and a Python tunneler (SLAPSHOT) to maintain persistence, conduct internal reconnaissance, and steal credentials. Persistence techniques include modifying web server configurations to treat non-PHP files as executable scripts and setting the setuid bit on /bin/sh to maintain root privileges. Citrix has issued guidance and recommended updates to address these vulnerabilities. The campaign has targeted organizations in North America and Europe across multiple sectors since early September 2026.
A malicious file identified by the SHA-256 hash b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793 was observed by OffSeq Mirage honeypot sensors three times between September 25 and October 8, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
The URL 'oast.me' has been observed in attacker activity as an out-of-band callback or command-and-control (C2) endpoint. This activity was detected by OffSeq Mirage honeypot sensors four times between September 20, 2026, and October 3, 2026. The observed technique corresponds to MITRE ATT&CK T1071, which involves using application layer protocols for command and control. The attacker infrastructure was identified as originating from Lithuania (LT). Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash bb36568c1f0a4f4d604cc67f8692506291eb1ffd217a451ffc846c94daa09440 was observed by OffSeq Mirage honeypot sensors five times between September 19, 2026, and October 8, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. No known exploits in the wild or specific affected software versions are identified.