Last seven days
- First activity
- Sep 22, 2026
- Last activity
- Sep 28, 2026
- Feed role
- C2 / Distribution
- Host form
- 20 IP / 1 hostnames
SNOWLIGHT
SNOWLIGHT is a cross-platform, architecture-aware loader and stager primarily used to retrieve and launch the VShell remote-access backdoor.
Profile source: Mallory opens in a new tabSNOWLIGHT
Family profile
SNOWLIGHT is a cross-platform, architecture-aware loader and stager primarily used to retrieve and launch the VShell remote-access backdoor. Windows and Linux variants contact command-and-control infrastructure, transmit a short host check-in, retrieve an encrypted payload, decode it in memory, and transfer execution to VShell. Linux variants have selected payloads for x86, x86-64, ARM, and ARM64 systems and can execute decrypted payloads from anonymous in-memory file descriptors. Observed variants use anti-reinfection markers, process-name masquerading resembling Linux kernel worker threads, encrypted or XOR-obfuscated payload delivery, and anti-analysis checks. SNOWLIGHT has appeared in phishing-led Windows intrusions, exploit-driven compromises of internet-facing applications, and a Linux chain in which a malicious archive filename is interpreted by unsafe shell scripting. It has been used by or associated with UNC5174, UNC6586, UAT-6382, and UAT-8302, but its presence alone is insufficient to attribute an intrusion to a particular actor. Activity involving SNOWLIGHT has targeted academic researchers, government entities, and internet-facing enterprise and web infrastructure.
Capabilities
- Defense Evasion
- Post Exploitation
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
7 Sep 22
1 Sep 23
6 Sep 24
1 Sep 25
1 Sep 26
3 Sep 27
2 Sep 28
Observed infrastructure
Leading locations
- CN9
- HK4
- US3
- SG2
- DE1
- ES1
- NL1
Leading providers
- Shenzhen Tencent Computer Systems Company Limited5
- Alibaba (US) Technology Co., Ltd.2
- Hangzhou Alibaba Advertising Co.,Ltd.2
- Huawei Cloud Service data center2
- Advin Services LLC1
- AROSSCLOUD INC.1
Infrastructure traits
- Hosting 21
Samples
Recent associated samples
36fff810e4fb7de1f052330915dcb2b96413b83fd962cdd021c97537d06c75c2 Observed Sep 28, 2026Triage
4bc4987862318f1e1772155e85b0e32c1c9cb90afeefb4d04f3b58d1b51473d6 Observed Sep 28, 2026Triage
4eff95566912a2032bc6aff7f0a830ca29f18d815068cfe4bd6240d0fb7b117e Observed Sep 28, 2026Triage
9c1a4318df911281fd7b6971c7fd0e022ebe310b7c49381c6b89ef23ad9551e6 Observed Sep 28, 2026Triage
b87c5c316e18095207279dfa929f5f7da5430072902792d54d00158e05616dcd Observed Sep 28, 2026Triage
14d996fb3575d574b60f8a8f5aa97dcf0648b97913c5caad1583e8666e1e1a19 Observed Sep 28, 2026Triage
68673e9d58639c1973f74f680a4c18c95c44c102a4308390398e933e5b6b653b Observed Sep 28, 2026Triage
8d3c99aac433d26cd85c0c00efae5d39107f8bf301290c565c8c0a9d1a837b09 Observed Sep 28, 2026Triage
b3c275aa8aa13999b14a3af18d970b7f20d0144dd5cf4bd94912de6aa83b1566 Observed Sep 28, 2026Triage
dbca105bd59db42253fd02f350563514146ff626c80f3dcd72dc76babfd40f26 Observed Sep 28, 2026Triage
Reported operators
Threat actors
6 named in public reportingThe malware suite evaluated in this section has been definitively identified as SNOWLIGHT. This threat toolkit includes a shell dropper alongside four architecture-specific ELF loaders.
The malware suite evaluated in this section has been definitively identified as SNOWLIGHT. This threat toolkit includes a shell dropper alongside four architecture-specific ELF loaders.
SNOWLIGHT, a VShell stager used by UNC5174, UNC6586, and UAT-6382.
SNOWLIGHT, a VShell stager used by UNC5174, UNC6586, and UAT-6382.
Multiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.
Multiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.
Exploited software
Vulnerabilities linked to SNOWLIGHT
15 CVEs CVE-2026-34486 Apache Tomcat EncryptInterceptor Bypass CVE-2025-55182 React2Shell CVE-2020-25213 Unauthenticated Arbitrary File Upload RCE in WordPress File Manager CVE-2026-0740 Unauthenticated Arbitrary File Upload in Ninja Forms - File Uploads for WordPress CVE-2026-3844 Unauthenticated Arbitrary File Upload in Breeze Cache for WordPress CVE-2026-48907 Unauthenticated RCE in Joomla JCE profiles import CVE-2026-6433 Unauthenticated SQL Injection to PHP Code Execution in Custom CSS JS & PHP WordPress Plugin CVE-2026-1969 Arbitrary File Upload in ThemeREX Addons for WordPress CVE-2025-34085 Rejected duplicate of CVE-2020-36847 in WordPress Simple File List CVE-2025-7443 Arbitrary File Upload in BerqWP WordPress Plugin CVE-2025-7852 Arbitrary File Upload in WPBookit WordPress Plugin CVE-2025-12057 Arbitrary File Upload and RCE in WavePlayer WordPress Plugin CVE-2025-0994 Remote Code Execution in Trimble Cityworks Deserialization CVE-2025-42999 Insecure Deserialization in SAP NetWeaver Visual Composer Metadata Uploader CVE-2025-31324 Unauthenticated Arbitrary File Upload RCE in SAP NetWeaver Visual Composer Metadata Uploader
MITRE ATT&CK
SNOWLIGHT in ATT&CK
30 distinct techniquesTechniques
30 techniques T1204.002 Malicious File T1620 Reflective Code Loading T1566.001 Spearphishing Attachment T1036.007 Double File Extension T1055 Process Injection T1071.001 Web Protocols T1497.001 System Checks T1105 Ingress Tool Transfer T1027.009 Embedded Payloads T1497.003 Time Based Checks T1082 System Information Discovery T1497 Virtualization/Sandbox Evasion T1095 Non-Application Layer Protocol T1573 Encrypted Channel T1036 Masquerading T1027.007 Dynamic API Resolution T1190 Exploit Public-Facing Application T1059.004 Unix Shell T1218.003 CMSTP T1027 Obfuscated Files or Information T1203 Exploitation for Client Execution T1649 Steal or Forge Authentication Certificates T1539 Steal Web Session Cookie T1505.003 Web Shell T1202 Indirect Command Execution T1090.003 Multi-hop Proxy T1059 Command and Scripting Interpreter T1570 Lateral Tool Transfer T1071 Application Layer Protocol T1027.004 Compile After Delivery
Reporting
Research mentioning SNOWLIGHT
Aug 5
Security Week
CISA Warns of Exploited Langflow, N-central, and Tomcat Vulnerabilities - SecurityWeek
CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog after warning they are being actively exploited: CVE-2026-9198 in IBM Langflow OSS, CVE-2026-34486 in Apache Tomcat, and CVE-2026-18556 in N-able N-central. The Langflow issue is a critical code-injection flaw that can lead to unauthenticated remote code execution on default deployments, while the N-central bug is an authentication bypass vulnerability that N-able said was exploited as a zero-day. CISA also noted exploitation of CVE-2026-18577, a separate N-central flaw tied to an incomplete fix for the original issue. The Apache Tomcat vulnerability allows attackers to bypass EncryptInterceptor protections for cluster-node messages, potentially exposing cluster members to unauthenticated remote code execution. Reporting linked exploitation of the Tomcat flaw to a Chinese-speaking threat actor tracked as knaithe or KnYuan, with activity involving Snowlight malware and AI-enabled autonomous hacking using DeepSeek through the Hermes Agent framework. Under BOD 26-04, Federal Civilian Executive Branch agencies were ordered to remediate the KEV-listed flaws by August 7, and vendors have issued patches including Langflow version 1.10.1 and N-able updates for affected N-central deployments.
Aug 5
The Hacker News
