The OffSeq Mirage honeypot sensors detected an attacker-controlled URL used as a command-and-control (C2) or out-of-band callback endpoint. This URL was observed twice on August 22, 2026, originating from attacker infrastructure in Turkey. The activity involved the use of the T1071 technique, which relates to application layer protocol communication. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
An attacker-controlled URL (da4ms7supagd531da040xszuj79z5wgss.oast.site) was observed in the wild on 2026-08-22 by OffSeq Mirage honeypot sensors. This URL was used as an out-of-band callback or command-and-control (C2) endpoint employing the T1071 technique (Application Layer Protocol). The activity was seen originating from attacker infrastructure in Turkey. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash 561b9327e87addc615ec1c93342af9227faf8bc904218ad513cf86b8ff26a467 was observed by OffSeq Mirage honeypot sensors eight times between August 18 and August 26, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain and the Netherlands. This indicator can be used to detect the presence of this specific malicious file in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
The URL http://vps.atlas101.us.kg:7768/dl.sh was observed in attacker activity by OffSeq Mirage honeypot sensors on August 17, 2026. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it is used for transferring tools or payloads during attacks. The attacker infrastructure was identified as originating from Bulgaria. This URL has been seen in attacker payloads such as tool downloads, callbacks, or exploitation targets. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash 51b052a524af278366fb5527d4a5eee949b63f85168c37d4f97aefe3e73fe66a was observed by OffSeq Mirage honeypot sensors in attacker activity between August 16 and September 4, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in China. The hash fingerprints a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash a6296a79f44e21b76604d2d2bbf795d2cf380f70e39d45fbf166707ff3b4a6a4 was observed 56 times in attacker activity between August 15 and September 9, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Argentina, Bulgaria, Brazil, Chile, China, Colombia, Germany, and Hong Kong. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 15dfb2762480c825beb4f3cf3c57becf9386c02065f23525604fef2c8992f280 was observed by OffSeq Mirage honeypot sensors 58 times during attacker activity between August 13 and August 14, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file is associated with a malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Argentina, Brazil, Chile, China, Hong Kong, Luxembourg, Pakistan, and Saudi Arabia. This indicator should be matched against files in environments and security tools to detect potential compromise.