Honeypot attack session (period 2021_2022), commands issued:
enable
admin
system
sh
/bin/busybox gay
echo -en "\x6d\x69\x6e\x65\x72\x77\x6f\x72\x64"
ls /home; ps aux; /bin/busybox gay; echo -en "\x6d\x69\x6e\x65\x72\x77\x6f\x72\x64"

MITRE ATT&CK techniques observed:
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1059 Command and Scripting Interpreter
T1027 Obfuscated Files or Information
T1059 Command and Scripting Interpreter