Loading malware…
PeerBlight is a Linux backdoor malware family identified by Huntress during post-exploitation activity following exploitation of the React Server Components remote code execution vulnerability CVE-2025-55182 (React2Shell), including against vulnerable Next.js deployments. It has been observed in active attacks across multiple organizations and sectors including construction and entertainment. The malware is installed on compromised Linux systems after exploitation and has also appeared in broader React2Shell intrusion activity alongside payloads such as XMRig cryptominers, CowTunnel, ZinFoq, Sliver droppers, and Kaiji variants.
PeerBlight is notable for resilient command-and-control design. It first attempts to connect to a primary C2 at 185.247.224[.]41:8443 over raw TCP, using AES-256 encryption after an RSA-2048 key exchange. It also includes a domain generation algorithm that can produce up to 200 domain-and-port combinations, and a fallback mechanism using the BitTorrent DHT network to distribute configuration, making it resilient to traditional domain takedowns. Huntress extracted a live DHT configuration pointing to a secondary C2 at 49.51.230[.]175:9898 hosted on Tencent Cloud. The malware bootstraps DHT via router.bittorrent[.]com, router.utorrent[.]com, and dht.transmissionbt[.]com, and botnet nodes can be identified by the LOLlolLOL node ID prefix.
Capabilities directly described in the reporting include reverseShell, downloadFile, uploadFile, chmod, rm, upgrade, runexe, listrunexe, killrunexe, and sleep interval changes. For persistence, PeerBlight installs a systemd service at /lib/systemd/system/systemd-agent.service and copies itself to /bin/systemd-daemon when running as root. It also supports Upstart persistence via /etc/init/systemd-agent.conf and non-root persistence under a hidden directory masquerading as a systemd PrivateTmp path. For evasion, it masquerades as a ksoftirqd daemon by overwriting argv[0] and calling prctl(PR_SET_NAME), causing Linux monitoring tools to display it as a kernel-like thread; newer detection content references a softirq string change for variant detection. Reporting also notes it installs a systemd service to ensure persistence and masquerades as a "ksoftirqd" process.
Researchers assessed that PeerBlight shares some code overlap and persistence conventions with RotaJakiro, and mention code overlaps with both RotaJakiro and Pink, but it is described as a distinct malware family with different protocol, encryption, and command structures. Huntress recovered a sample with SHA256 a605a70d031577c83c093803d11ec7c1e29d2ad530f8e95d9a729c3818c7050d. Detection reporting also notes updated YARA rules for newer variants.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Huntress is seeing threat actors exploit a vulnerability in React Server Components (CVE-2025-55182) across several organizations... Dubbed “React2Shell”, CVE-2025-55182 exists due to insecure deserialization... and can be exploited by unauthenticated attackers merely by crafting one malicious HTTP request. | During our investigations into post-exploitation activity, we found a distinct Linux malware family we're calling PeerBlight. This backdoor uses the BitTorrent DHT network as a fallback C2 mechanism, making it resilient to traditional domain takedowns.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
The binary copies itself to /bin/systemd-daemon and enables the service using the generic "System Daemon" description.
The service masquerades as a legitimate SSH agent component, using the description "SSH Agent Service (System Management)" to blend in with authentic system services.
This backdoor uses the BitTorrent DHT network as a fallback C2 mechanism, making it resilient to traditional domain takedowns.
The payload, which we have named “ ZinFoq ” ... communicates with command-and-control infrastructure at “ api.qtss[.]cc ” over HTTPS using hex-encoded payloads
The threat actor attempted to download multiple payloads from C2 servers... The commands follow the same methodology: download a shell script, execute it via bash...
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware/tooling observed in post-exploitation that uses BitTorrent DHT as a resilient command-and-control fallback channel to maintain access even if domains are taken down.
Linux backdoor observed delivered in React2Shell exploitation activity.
Named backdoor referenced among payloads/tools seen in React2Shell exploitation activity (no additional behavior described in the provided content).
PeerBlight is a Linux backdoor observed being dropped during exploitation of the React2Shell vulnerability, providing attackers with persistent access to compromised systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.