A malicious file identified by the SHA-256 hash 39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96 was observed 12 times in attacker activity between September 18, 2026, and October 21, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in South Carolina. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash b5eec555aa0e07b1af33a0ec195a3fb195e1543339d22305fffbfa7e6a7b4381 was observed twice on September 16, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect or block the associated malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash eaf9adb4bb80316a3aafceabc0f2ed2aed7c76cf134b9b7c66226fc4f003aa97 was observed by OffSeq Mirage honeypot sensors in attacker activity between September 14, 2026, and October 14, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in China. This hash fingerprints a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 7cc0b40e8819ec9139ffae5942add2db1c26e168edaeda57302c9047f23dfb6c was observed by OffSeq Mirage honeypot sensors on 2026-09-07. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. The attacker infrastructure was located in the United States. No known exploits in the wild or specific affected software versions are identified.
A malicious file identified by the SHA-256 hash 8e06754e5e64bdf5f61dd604a5f12e9bc10f5502316b5379fb258f84a5d84702 was observed 10 times on September 7, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. No known exploits in the wild or vendor patches are applicable. Organizations should match this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 6a7e1676d52a85906d43a543bdb35f8b3282447a5ce8c98dfad33e04afe79dc6 was observed by OffSeq Mirage honeypot sensors 10 times between 2026-09-07 and 2026-09-11. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and originated from attacker infrastructure in Great Britain. This file hash corresponds to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during attacks. No specific software versions are affected, and no known exploits in the wild have been reported for this indicator.
A malicious file identified by the SHA-256 hash 1e70b63472772e3f5092ffe9c3573470e73590e6ab6d93fdcede1d368a5fd72d was observed by OffSeq Mirage honeypot sensors twice between August 31, 2026, and October 29, 2026. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This hash serves as an indicator of compromise (IOC) to detect this specific malicious payload in environments and security tools.
A malicious file identified by the SHA-256 hash f0aa83bbbd2c75e2f71ec16029ee5fcfad59f3a8efa30a500b815f0f6c18d987 was observed by OffSeq Mirage honeypot sensors in attacker activity between August 31, 2026, and October 29, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. The file was observed twice during this period. No specific affected software versions or exploits in the wild are reported.
A malicious file identified by the SHA-256 hash 3f3bf218089d1488617d37f8a5116bb2791eb39ce06a1b5bc9a4cdfe5e94dd39 was observed by OffSeq Mirage honeypot sensors twice between August 31, 2026, and October 29, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. Organizations are advised to match this hash against files in their environments and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 8e1a67a5c03b3cd818f046c7a1605afccc0ee5ce437a0d099881f1872b54bc70 was observed by OffSeq Mirage honeypot sensors twice between August 31, 2026, and October 29, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany (DE). This indicator can be used to detect the presence of this malicious file in environments by matching it against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash d1cac82f44b54b0fd244a9e4122811e9ae108a197c7a65a20fd2e7552683e68e was observed by OffSeq Mirage honeypot sensors in attacker activity between August 31, 2026, and October 29, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This file hash serves as an indicator of compromise (IOC) to detect this specific malicious payload in environments and security tools.
A malicious file identified by the SHA-256 hash d70f917e35813a7ae323e6b2b539d6dbbfc3a3a6599f1fed93430b14ca08b141 was observed by OffSeq Mirage honeypot sensors during attacker activity between August 31, 2026, and October 29, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This hash serves as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash 3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892 was observed by OffSeq Mirage honeypot sensors twice between August 31, 2026, and October 29, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect the presence of this malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash ed555255a37cf5daec7f617af1c5553723b47376830c666bdf036f5ea9e979e8 was observed twice on August 30, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect and block this specific malicious file in environments and security tools.
The URL da8ue2kupagblkmed22g71kjyejxromzd.oast.pro was observed in attacker activity as an out-of-band callback or command-and-control endpoint. This URL was detected twice on 2026-08-28 by OffSeq Mirage honeypot sensors. The observed technique corresponds to T1071 (Application Layer Protocol). The attacker infrastructure was located in Turkey (TR).
The OffSeq Mirage honeypot sensors detected an attacker-controlled URL used as a command-and-control (C2) or out-of-band callback endpoint. This URL was observed twice on 2026-08-28 and is associated with the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified in Turkey (TR). Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
The URL da7h7gkupag53ubtlfng6iwxxod7xrzrk.oast.live was observed in the wild as an attacker callback or command-and-control (C2) endpoint. It was detected twice on August 26, 2026, by OffSeq Mirage honeypot sensors. The activity involved the use of the T1071 technique, which relates to application layer protocol communications. The attacker infrastructure was identified as originating from Turkey (TR).
A malicious SHA-256 file hash (4a9a6cf71efa9793bc277ba6859293f9ea0e927199500958e06a38520b961901) was observed by OffSeq Mirage honeypot sensors on 2026-08-25. The file is associated with attacker activity using technique T1105 (Ingress Tool Transfer) and is linked to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator should be matched against files in environments and security tools to detect potential compromise.
OffSeq Mirage honeypot sensors detected the URL www.google.com being used as an attacker callback or command-and-control (C2) endpoint 220 times between August 24, 2026, and September 24, 2026. The observed technique corresponds to T1071.004, which involves application layer protocol communication for C2. The activity originated from attacker infrastructure located in Nigeria and the United States. This URL is flagged as an indicator of compromise (IOC) for monitoring and blocking in network defenses.
A malicious file identified by the SHA-256 hash bfb4fc546e7c80572a85cea5828f27621dcefb05a35c06685e43cc67f8d3a48b was observed by OffSeq Mirage honeypot sensors on August 23, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. No specific affected software versions or products are identified. No known exploits in the wild or threat actors are linked to this indicator at this time.