This entry reports on ThreatFox Indicators of Compromise (IOCs) dated 2026-09-01. It relates to malware activity involving OSINT, network activity, and payload delivery. No specific technical details, affected software versions, or exploitation evidence are provided.
A malicious file identified by the SHA-256 hash ed555255a37cf5daec7f617af1c5553723b47376830c666bdf036f5ea9e979e8 was observed twice on August 30, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect and block this specific malicious file in environments and security tools.
This entry provides Indicators of Compromise (IOCs) from ThreatFox dated 2026-08-29. It is categorized as OSINT related to network activity and payload delivery. No specific malware samples, exploits, or vulnerabilities are detailed. There are no affected software versions or patches available. The threat level is assessed as medium based on the provided metadata.
The URL da8ue2kupagblkmed22g71kjyejxromzd.oast.pro was observed in attacker activity as an out-of-band callback or command-and-control endpoint. This URL was detected twice on 2026-08-28 by OffSeq Mirage honeypot sensors. The observed technique corresponds to T1071 (Application Layer Protocol). The attacker infrastructure was located in Turkey (TR).
The OffSeq Mirage honeypot sensors detected an attacker-controlled URL used as a command-and-control (C2) or out-of-band callback endpoint. This URL was observed twice on 2026-08-28 and is associated with the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified in Turkey (TR). Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
The URL da7h7gkupag53ubtlfng6iwxxod7xrzrk.oast.live was observed in the wild as an attacker callback or command-and-control (C2) endpoint. It was detected twice on August 26, 2026, by OffSeq Mirage honeypot sensors. The activity involved the use of the T1071 technique, which relates to application layer protocol communications. The attacker infrastructure was identified as originating from Turkey (TR).
This entry provides a collection of Indicators of Compromise (IOCs) from ThreatFox dated 2026-08-26. It is an OSINT report focused on network activity and payload delivery related to potential malware threats. No specific affected software versions or exploits in the wild are identified. The threat level is assessed as moderate based on available data.
A malicious SHA-256 file hash (4a9a6cf71efa9793bc277ba6859293f9ea0e927199500958e06a38520b961901) was observed by OffSeq Mirage honeypot sensors on 2026-08-25. The file is associated with attacker activity using technique T1105 (Ingress Tool Transfer) and is linked to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator should be matched against files in environments and security tools to detect potential compromise.
This entry provides a collection of Indicators of Compromise (IOCs) from ThreatFox dated 2026-08-25. It is categorized as OSINT related to network activity and payload delivery but does not specify any particular malware or exploit details. No affected software versions or specific vulnerabilities are identified. The threat level is assessed as medium based on available metadata.
OffSeq Mirage honeypot sensors detected the URL www.google.com being used as an attacker callback or command-and-control (C2) endpoint 220 times between August 24, 2026, and September 24, 2026. The observed technique corresponds to T1071.004, which involves application layer protocol communication for C2. The activity originated from attacker infrastructure located in Nigeria and the United States. This URL is flagged as an indicator of compromise (IOC) for monitoring and blocking in network defenses.
A malicious file identified by the SHA-256 hash bfb4fc546e7c80572a85cea5828f27621dcefb05a35c06685e43cc67f8d3a48b was observed by OffSeq Mirage honeypot sensors on August 23, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. No specific affected software versions or products are identified. No known exploits in the wild or threat actors are linked to this indicator at this time.
A malicious file identified by the SHA-256 hash b9624cc297aaae53f3ed88823d1afe307e7b17d4fc7fcfba5b511e31b23ad30d was observed by OffSeq Mirage honeypot sensors on August 22, 2026. This file was detected three times in attacker activity involving the T1105 technique (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to identify and block the malicious payload in security environments.
A malicious file identified by the SHA-256 hash 9f1897ced87b33877e10b8185c97ba0ec386e53b04a82b5e942f05f56db18bd9 was observed by OffSeq Mirage honeypot sensors three times between August 22 and August 23, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect and block the specific malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash 344bbdca6cc3f80f2d996398fa443c3dd7c98575b85cebc26df684ba04aa9369 was observed by OffSeq Mirage honeypot sensors three times between August 22 and August 23, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to transfer tools or payloads during an attack. The attacker infrastructure was located in Great Britain. The file is associated with malicious payloads such as droppers, web shells, miners, or post-exploitation tools. No specific affected software versions or patches are identified. There is no evidence of known exploits in the wild for this file hash.
A malicious file identified by the SHA-256 hash c71d74ce79b23052d26619ccc3c967fa46d2fd97328369b22565ac84f9028882 was observed by OffSeq Mirage honeypot sensors on 2026-08-22. This file was involved in attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was transferred from attacker infrastructure located in Great Britain. The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. There is no information about active exploitation in the wild or specific affected software versions. The indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash ad19b70c4e523ef24baf5e062d2200e139b619b56049219d41cd0397faff2c40 was observed by OffSeq Mirage honeypot sensors four times between August 22 and August 23, 2026. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This hash serves as an indicator of compromise (IOC) for detection and response purposes. No known exploits or threat actors are currently associated with this file, and no affected software versions are specified.