Indicator Threats

ThreatFox IOCs for 2026-09-18

ThreatFox IOCs for 2026-09-17

A malicious file identified by the SHA-256 hash b5eec555aa0e07b1af33a0ec195a3fb195e1543339d22305fffbfa7e6a7b4381 was observed twice on September 16, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect or block the associated malicious file in environments and security tools.

ThreatFox IOCs for 2026-09-16

ThreatFox IOCs for 2026-09-15

A malicious file identified by the SHA-256 hash eaf9adb4bb80316a3aafceabc0f2ed2aed7c76cf134b9b7c66226fc4f003aa97 was observed by OffSeq Mirage honeypot sensors in attacker activity between September 14, 2026, and October 14, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in China. This hash fingerprints a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.

ThreatFox IOCs for 2026-09-14

ThreatFox IOCs for 2026-09-13

ThreatFox IOCs for 2026-09-12

ThreatFox IOCs for 2026-09-11

ThreatFox IOCs for 2026-09-10

ThreatFox IOCs for 2026-09-09

ThreatFox IOCs for 2026-09-08

A malicious file identified by the SHA-256 hash 7cc0b40e8819ec9139ffae5942add2db1c26e168edaeda57302c9047f23dfb6c was observed by OffSeq Mirage honeypot sensors on 2026-09-07. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. The attacker infrastructure was located in the United States. No known exploits in the wild or specific affected software versions are identified.

A malicious file identified by the SHA-256 hash 8e06754e5e64bdf5f61dd604a5f12e9bc10f5502316b5379fb258f84a5d84702 was observed 10 times on September 7, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. No known exploits in the wild or vendor patches are applicable. Organizations should match this hash against their environments and security tools to detect potential compromise.

A malicious file identified by the SHA-256 hash 6a7e1676d52a85906d43a543bdb35f8b3282447a5ce8c98dfad33e04afe79dc6 was observed by OffSeq Mirage honeypot sensors 10 times between 2026-09-07 and 2026-09-11. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and originated from attacker infrastructure in Great Britain. This file hash corresponds to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during attacks. No specific software versions are affected, and no known exploits in the wild have been reported for this indicator.

ThreatFox IOCs for 2026-09-07

ThreatFox IOCs for 2026-09-06

ThreatFox IOCs for 2026-09-05

ThreatFox IOCs for 2026-09-04