F5 BIG-IP CVE-2021-22986 (Explotación Activa)

1er Payload:

http://118.107.43.174/upload/files/run.sh
http://118.107.43.174/upload/files/xmrig.tar.gz

2do Payload:

http://124.158.4.235:8080/docs/nexusa.txt
http://136.243.19.213:8885/docs/config.json
http://222.122.47.27:2143/auth/java.exe
http://27.1.1.34:8080/docs/solr.sh

IPs origen:

45.83.29.58
222.108.2.20
37.120.194.100
176.222.34.116
132.145.111.134
173.82.240.245
176.222.34.116
173.237.207.45
104.233.164.29
139.162.186.127
35.235.96.53
53.96.235.35
13.56.200.228
34.82.84.224
15.228.52.25
45.56.89.140
35.203.110.60
159.89.150.40
45.33.71.63
119.236.147.84
54.253.20.132
157.175.47.23
15.236.131.189
223.75.252.90
185.89.250.187
47.75.102.144