Indicator Threats

ThreatFox IOCs for 2026-10-03

ThreatFox IOCs for 2026-10-02

The URL webhook.site was observed in attacker activity as an out-of-band callback or command-and-control (C2) endpoint between 2026-10-01 and 2026-10-05. This activity was detected by OffSeq Mirage honeypot sensors and involved the use of the T1071 technique (Application Layer Protocol). The URL was seen originating from attacker infrastructure in Iran (IR) and Mali (ML).

ThreatFox IOCs for 2026-10-01

ThreatFox IOCs for 2026-09-30

ThreatFox IOCs for 2026-09-29

ThreatFox IOCs for 2026-09-28

ThreatFox IOCs for 2026-09-27

This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-09-26. It is categorized as OSINT related to network activity and payload delivery but does not specify a particular malware or exploit. No affected software versions or technical details are provided.

A malicious file identified by the SHA-256 hash b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793 was observed by OffSeq Mirage honeypot sensors three times between September 25 and October 8, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.

ThreatFox IOCs for 2026-09-25

ThreatFox IOCs for 2026-09-24

ThreatFox IOCs for 2026-09-23

ThreatFox IOCs for 2026-09-22

ThreatFox IOCs for 2026-09-21

The URL 'oast.me' has been observed in attacker activity as an out-of-band callback or command-and-control (C2) endpoint. This activity was detected by OffSeq Mirage honeypot sensors four times between September 20, 2026, and October 3, 2026. The observed technique corresponds to MITRE ATT&CK T1071, which involves using application layer protocols for command and control. The attacker infrastructure was identified as originating from Lithuania (LT). Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.

ThreatFox IOCs for 2026-09-20

A malicious file identified by the SHA-256 hash bb36568c1f0a4f4d604cc67f8692506291eb1ffd217a451ffc846c94daa09440 was observed by OffSeq Mirage honeypot sensors five times between September 19, 2026, and October 8, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. No known exploits in the wild or specific affected software versions are identified.

ThreatFox IOCs for 2026-09-19

A malicious file identified by the SHA-256 hash 39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96 was observed 12 times in attacker activity between September 18, 2026, and October 21, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in South Carolina. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.