Last seven days
- First activity
- Sep 2, 2026
- Last activity
- Sep 9, 2026
- Feed role
- C2 / Distribution
- Host form
- 38 IP / 1 hostnames
SNOWLIGHT
SNOWLIGHT is a cross-platform, architecture-aware loader and stager primarily used to retrieve and launch the VShell remote-access backdoor.
Profile source: Mallory opens in a new tabSNOWLIGHT
Family profile
SNOWLIGHT is a cross-platform, architecture-aware loader and stager primarily used to retrieve and launch the VShell remote-access backdoor. Windows and Linux variants contact command-and-control infrastructure, transmit a short host check-in, retrieve an encrypted payload, decode it in memory, and transfer execution to VShell. Linux variants have selected payloads for x86, x86-64, ARM, and ARM64 systems and can execute decrypted payloads from anonymous in-memory file descriptors. Observed variants use anti-reinfection markers, process-name masquerading resembling Linux kernel worker threads, encrypted or XOR-obfuscated payload delivery, and anti-analysis checks. SNOWLIGHT has appeared in phishing-led Windows intrusions, exploit-driven compromises of internet-facing applications, and a Linux chain in which a malicious archive filename is interpreted by unsafe shell scripting. It has been used by or associated with UNC5174, UNC6586, UAT-6382, and UAT-8302, but its presence alone is insufficient to attribute an intrusion to a particular actor. Activity involving SNOWLIGHT has targeted academic researchers, government entities, and internet-facing enterprise and web infrastructure.
Capabilities
- Defense Evasion
- Post Exploitation
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
2 Sep 2
3 Sep 3
1 Sep 4
6 Sep 5
2 Sep 6
16 Sep 7
9 Sep 8
Observed infrastructure
Leading locations
- CN18
- HK6
- SG5
- US4
- JP2
- ES1
- KR1
- NL1
- TW1
Leading providers
- Shenzhen Tencent Computer Systems Company Limited10
- Hangzhou Alibaba Advertising Co.,Ltd.4
- Tencent Building, Kejizhongyi Avenue3
- VH Global Limited2
- ABCCLOUD SDN.BHD.1
- Akamai Connected Cloud1
Infrastructure traits
- Hosting 36
Samples
Recent associated samples
a3940db32bd7af999c62effe75e134f93633996ef46bdc3f6b249c0c5ac2ea3b Observed Sep 9, 2026Triage
b9533ce8e428f16f3d0e1946f19a6f756ff11a532d0b7e61ae402837f46c678e Observed Sep 9, 2026Triage
18e0bf2302dc16191448affb4cfd9584177826a789481a76997037833d905a00 Observed Sep 8, 2026Triage
80c881c47e9b7a28e79eb25b0005ceff0e17229c4164235d138141cfebf12cb8 Observed Sep 8, 2026Triage
b6d489a8dd7df03e22e5e45dcba015057d2f16365fed2af33a2184d5728a5bfd Observed Sep 8, 2026Triage
e767dec2973eab5d61c6422e50d11c5e9a8e5cf01a81fe508e10cd4aec215be4 Observed Sep 8, 2026Triage
f1687d04df0d3478cafc0536ed9cc12efc65786cc53badecf85d9012f5bf453c Observed Sep 8, 2026Triage
11a6cf0de7a49a72730475c599bce7b112d583d251411a5d77c5a67fcc7e32c2 Observed Sep 8, 2026Triage
2d55df8b32e321ec113578b99a5369af99c8cdde1c7c468ba96a4a30914c32d3 Observed Sep 8, 2026Triage
5655dc172ac6d133f60c70d0bd5bbb732822273ff0e910648d0f58a2a643204d Observed Sep 8, 2026Triage
Reported operators
Threat actors
6 named in public reportingThe malware suite evaluated in this section has been definitively identified as SNOWLIGHT. This threat toolkit includes a shell dropper alongside four architecture-specific ELF loaders.
The malware suite evaluated in this section has been definitively identified as SNOWLIGHT. This threat toolkit includes a shell dropper alongside four architecture-specific ELF loaders.
SNOWLIGHT, a VShell stager used by UNC5174, UNC6586, and UAT-6382.
SNOWLIGHT, a VShell stager used by UNC5174, UNC6586, and UAT-6382.
Multiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.
Multiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.
Exploited software
Vulnerabilities linked to SNOWLIGHT
15 CVEs CVE-2026-34486 Apache Tomcat EncryptInterceptor Bypass CVE-2025-55182 React2Shell CVE-2020-25213 Unauthenticated Arbitrary File Upload RCE in WordPress File Manager CVE-2026-0740 Unauthenticated Arbitrary File Upload in Ninja Forms - File Uploads for WordPress CVE-2026-3844 Unauthenticated Arbitrary File Upload in Breeze Cache for WordPress CVE-2026-48907 Unauthenticated RCE in Joomla JCE profiles import CVE-2026-6433 Unauthenticated SQL Injection to PHP Code Execution in Custom CSS JS & PHP WordPress Plugin CVE-2026-1969 Arbitrary File Upload in ThemeREX Addons for WordPress CVE-2025-34085 Rejected duplicate of CVE-2020-36847 in WordPress Simple File List CVE-2025-7443 Arbitrary File Upload in BerqWP WordPress Plugin CVE-2025-7852 Arbitrary File Upload in WPBookit WordPress Plugin CVE-2025-12057 Arbitrary File Upload and RCE in WavePlayer WordPress Plugin CVE-2025-0994 Remote Code Execution in Trimble Cityworks Deserialization CVE-2025-42999 Insecure Deserialization in SAP NetWeaver Visual Composer Metadata Uploader CVE-2025-31324 Unauthenticated Arbitrary File Upload RCE in SAP NetWeaver Visual Composer Metadata Uploader
MITRE ATT&CK
SNOWLIGHT in ATT&CK
30 distinct techniquesTechniques
30 techniques T1204.002 Malicious File T1620 Reflective Code Loading T1566.001 Spearphishing Attachment T1036.007 Double File Extension T1055 Process Injection T1071.001 Web Protocols T1497.001 System Checks T1105 Ingress Tool Transfer T1027.009 Embedded Payloads T1497.003 Time Based Checks T1082 System Information Discovery T1497 Virtualization/Sandbox Evasion T1095 Non-Application Layer Protocol T1573 Encrypted Channel T1036 Masquerading T1027.007 Dynamic API Resolution T1190 Exploit Public-Facing Application T1059.004 Unix Shell T1218.003 CMSTP T1027 Obfuscated Files or Information T1203 Exploitation for Client Execution T1649 Steal or Forge Authentication Certificates T1539 Steal Web Session Cookie T1505.003 Web Shell T1202 Indirect Command Execution T1090.003 Multi-hop Proxy T1059 Command and Scripting Interpreter T1570 Lateral Tool Transfer T1071 Application Layer Protocol T1027.004 Compile After Delivery
Reporting
Research mentioning SNOWLIGHT
Aug 5
Security Week
CISA Warns of Exploited Langflow, N-central, and Tomcat Vulnerabilities - SecurityWeek
CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog after warning they are being actively exploited: CVE-2026-9198 in IBM Langflow OSS, CVE-2026-34486 in Apache Tomcat, and CVE-2026-18556 in N-able N-central. The Langflow issue is a critical code-injection flaw that can lead to unauthenticated remote code execution on default deployments, while the N-central bug is an authentication bypass vulnerability that N-able said was exploited as a zero-day. CISA also noted exploitation of CVE-2026-18577, a separate N-central flaw tied to an incomplete fix for the original issue. The Apache Tomcat vulnerability allows attackers to bypass EncryptInterceptor protections for cluster-node messages, potentially exposing cluster members to unauthenticated remote code execution. Reporting linked exploitation of the Tomcat flaw to a Chinese-speaking threat actor tracked as knaithe or KnYuan, with activity involving Snowlight malware and AI-enabled autonomous hacking using DeepSeek through the Hermes Agent framework. Under BOD 26-04, Federal Civilian Executive Branch agencies were ordered to remediate the KEV-listed flaws by August 7, and vendors have issued patches including Langflow version 1.10.1 and N-able updates for affected N-central deployments.
Aug 5
The Hacker News
