Honeypot attack session (period 2021_2022), commands issued:
sh
wget
/bin/busybox;echo -e '\147\141\171\146\147\164'
gayfgtmulti-callREPOR/bin/busybox;echo -e '\147\141\171\146\147\164'

MITRE ATT&CK techniques observed:
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1083 File and Directory Discovery
T1027 Obfuscated Files or Information
T1083 File and Directory Discovery
T1027 Obfuscated Files or Information