Honeypot attack session (period 2021_2022), commands issued:
enable
system
shell
sh
cat /proc/mounts; /bin/busybox WJKCB
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WJKCB
tftp; wget; /bin/busybox WJKCB
dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s
/bin/busybox WJKCB
rm .s; exit
cat /proc/mounts; /bin/busybox VYYHM
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VYYHM
tftp; wget; /bin/busybox VYYHM
/bin/busybox VYYHM
cat /proc/mounts; /bin/busybox ITNAM
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ITNAM
tftp; wget; /bin/busybox ITNAM
/bin/busybox ITNAM
cat /proc/mounts; /bin/busybox OUKVL
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OUKVL
tftp; wget; /bin/busybox OUKVL
/bin/busybox OUKVL

MITRE ATT&CK techniques observed:
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1070 Indicator Removal
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter