TF-MAL-elf.minocat
📛 Threat Title
Malware family: MINOCAT
Description
ThreatFox malware family `elf.minocat`. Printable name: MINOCAT.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.minocat
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.minocat
IOC database
- Type
- domain
- Value
elf.minocat- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.minocat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.minocat
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:anorak001.github.io
Introduction: The "Log4j" of 2025? If you thought the holidays would be quiet, think again. On December 3, 2025, the cybersecurity world was hit with CVE-2025-55182, widely dubbed "React2Shell" with a CVSS rating of 10.0. This is not a complex, multi-stage exploit chain. This is a CVSS 10.0 Unauthenticated Remote Code Execution (RCE) vulnerability. It affects React Server Components ...
-
web:cloud.google.com
Widespread exploitation of the React2Shell vulnerability (CVE-2025-55182) by multiple threat actors, including China and cyber criminals.
-
web:cyberpress.org
UNC6600 deployed a tunneling tool, MINOCAT , that establishes persistence via cron jobs and systemd services. Another actor, UNC6586, used the flaw to deliver the SNOWLIGHT downloader, which connects to the command-and-control domain reactcdn windowserrorapis [.]com to retrieve further payloads.
-
web:cybersecuritynews.com
Threat Actors and Malware Campaigns Google researchers have identified several campaigns targeting unpatched systems. Key observations include: China-Nexus Espionage: Groups linked to China are using React2Shell to deploy backdoors and stealthy tools. One group, UNC6600, installs the MINOCAT tunneler to maintain hidden access to victim networks.
-
web:malpedia.caad.fkie.fraunhofer.de
According to Google, MINOCAT is an 64-bit ELF executable for Linux that includes a custom "NSS" wrapper and an embedded, open-source Fast Reverse Proxy (FRP) client that handles the actual tunneling.
-
web:malwaretips.com
The Remediation and Action Plan Given the critical nature and active exploitation, the following steps must be initiated immediately: 1. Immediate Patching and Dependency Audit. RCE Mitigation (CVE-2025-55182) Immediately update all vulnerable React Server Components packages to at least version `19.0.1`, `19.1.2`, or `19.2.1`.
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.esecurityplanet.com
Google warns that attackers are actively exploiting React2Shell to hijack unpatched servers.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.