MalwareExploits 1 CVE

proxy.sh

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2025-55182React2ShellExploited in the wild

...leveraged exposed Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers, along with the recently disclosed React2Shell (CVE-2025-55182, CVSS score: 10.0) vulnerability.

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1595Active ScanningEvidence1

"...build a distributed proxy and scanning infrastructure at scale..."; "...delivers various scanners to continuously search the internet for vulnerable and misconfigured servers."; "scanner.py... downloading... CIDR lists..."

Initial Access

2 techniques

T1133External Remote ServicesEvidence1

Initial Access External Remote Services (T1133) : Unauthenticated Docker, Kubernetes, Redis, and Ray management APIs.

T1190Exploit Public-Facing ApplicationEvidence1

The activity ... leveraged exposed Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers ... TeamPCP ... leveraging misconfigured Docker APIs ... as main infection pathways to breach modern cloud infrastructure.

Execution

4 techniques

T1053.003CronEvidence1

Persistence Scheduled Task / Cron (T1053.003) : Systemd services and scheduled scanners.

T1059Command and Scripting InterpreterEvidence3

Successful exploitation paves the way for the deployment of next-stage payloads from external servers, including shell- and Python-based scripts ...

T1609Container Administration CommandEvidence1

Execution Container Administration Command (T1609): Docker API and Ray job submission used for remote workload execution.

T1610Deploy ContainerEvidence2

Persistence Deploy Container (T1610) : Persistent malicious workloads across clusters.

Persistence

3 techniques

T1053.003CronEvidence1

Persistence Scheduled Task / Cron (T1053.003) : Systemd services and scheduled scanners.

T1133External Remote ServicesEvidence1

Initial Access External Remote Services (T1133) : Unauthenticated Docker, Kubernetes, Redis, and Ray management APIs.

T1525Implant Internal ImageEvidence1

Persistence Implant Internal Image (T1525) : Malicious containers deployed with auto-restart policies.

Privilege Escalation

1 technique

T1053.003CronEvidence1

Persistence Scheduled Task / Cron (T1053.003) : Systemd services and scheduled scanners.

Stealth

2 techniques

T1497Virtualization/Sandbox EvasionEvidence1

"Notably, proxy.sh performs environment fingerprinting at execution time," ... "Early in its runtime, it checks whether it is running inside a Kubernetes cluster."

T1497.001System ChecksEvidence1

"Notably, proxy.sh performs environment fingerprinting at execution time ... Early in its runtime, it checks whether it is running inside a Kubernetes cluster."

Discovery

4 techniques

T1046Network Service DiscoveryEvidence1

One of the core components is "proxy.sh," which installs proxy, peer-to-peer (P2P), and tunneling utilities, and delivers various scanners to continuously search the internet for vulnerable and misconfigured servers ... scanner.py ... downloading CIDR lists ... pcpcat.py ... discover exposed Docker APIs and Ray dashboards across large IP address ranges.

T1082System Information DiscoveryEvidence1

"proxy.sh performs environment fingerprinting... it checks whether it is running inside a Kubernetes cluster."

T1497Virtualization/Sandbox EvasionEvidence1

"Notably, proxy.sh performs environment fingerprinting at execution time," ... "Early in its runtime, it checks whether it is running inside a Kubernetes cluster."

T1497.001System ChecksEvidence1

"Notably, proxy.sh performs environment fingerprinting at execution time ... Early in its runtime, it checks whether it is running inside a Kubernetes cluster."

Lateral Movement

1 technique

T1570Lateral Tool TransferEvidence1

kube.py ... followed by dropping "proxy.sh" into accessible pods for broader propagation ...

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence2

Command & Control Application Layer Protocols (T1071)

T1090ProxyEvidence2

One of the core components is "proxy.sh," which installs proxy, peer-to-peer (P2P), and tunneling utilities ... compromised infrastructure is misused for ... proxy and command-and-control (C2) relays.

T1105Ingress Tool TransferEvidence3

Successful exploitation paves the way for the deployment of next-stage payloads from external servers ... scanner.py ... downloading CIDR lists from a GitHub account ...

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Dec 24, 2025

Operation PCPcat Hacked 59,000+ Next.js/React Servers Within 48 Hours

A script/tool deployed post-compromise to install proxy and tunneling services (GOST SOCKS5, FRP) for persistence and lateral movement.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

proxy.sh

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2025-55182React2ShellExploited in the wild

...leveraged exposed Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers, along with the recently disclosed React2Shell (CVE-2025-55182, CVSS score: 10.0) vulnerability.

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1595Active ScanningEvidence1

Initial Access

2 techniques

T1133External Remote ServicesEvidence1

Initial Access External Remote Services (T1133) : Unauthenticated Docker, Kubernetes, Redis, and Ray management APIs.

T1190Exploit Public-Facing ApplicationEvidence1

Execution

4 techniques

T1053.003CronEvidence1

Persistence Scheduled Task / Cron (T1053.003) : Systemd services and scheduled scanners.

T1059Command and Scripting InterpreterEvidence3

Successful exploitation paves the way for the deployment of next-stage payloads from external servers, including shell- and Python-based scripts ...

T1609Container Administration CommandEvidence1

Execution Container Administration Command (T1609): Docker API and Ray job submission used for remote workload execution.

T1610Deploy ContainerEvidence2

Persistence Deploy Container (T1610) : Persistent malicious workloads across clusters.

Persistence

3 techniques

T1053.003CronEvidence1

Persistence Scheduled Task / Cron (T1053.003) : Systemd services and scheduled scanners.

T1133External Remote ServicesEvidence1

Initial Access External Remote Services (T1133) : Unauthenticated Docker, Kubernetes, Redis, and Ray management APIs.

T1525Implant Internal ImageEvidence1

Persistence Implant Internal Image (T1525) : Malicious containers deployed with auto-restart policies.

Privilege Escalation

1 technique

T1053.003CronEvidence1

Persistence Scheduled Task / Cron (T1053.003) : Systemd services and scheduled scanners.

Stealth

2 techniques

T1497Virtualization/Sandbox EvasionEvidence1

"Notably, proxy.sh performs environment fingerprinting at execution time," ... "Early in its runtime, it checks whether it is running inside a Kubernetes cluster."

T1497.001System ChecksEvidence1

"Notably, proxy.sh performs environment fingerprinting at execution time ... Early in its runtime, it checks whether it is running inside a Kubernetes cluster."

Discovery

4 techniques

T1046Network Service DiscoveryEvidence1

T1082System Information DiscoveryEvidence1

"proxy.sh performs environment fingerprinting... it checks whether it is running inside a Kubernetes cluster."

T1497Virtualization/Sandbox EvasionEvidence1

"Notably, proxy.sh performs environment fingerprinting at execution time," ... "Early in its runtime, it checks whether it is running inside a Kubernetes cluster."

T1497.001System ChecksEvidence1

"Notably, proxy.sh performs environment fingerprinting at execution time ... Early in its runtime, it checks whether it is running inside a Kubernetes cluster."

Lateral Movement

1 technique

T1570Lateral Tool TransferEvidence1

kube.py ... followed by dropping "proxy.sh" into accessible pods for broader propagation ...

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence2

Command & Control Application Layer Protocols (T1071)

T1090ProxyEvidence2

T1105Ingress Tool TransferEvidence3

Successful exploitation paves the way for the deployment of next-stage payloads from external servers ... scanner.py ... downloading CIDR lists from a GitHub account ...

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Dec 24, 2025

Operation PCPcat Hacked 59,000+ Next.js/React Servers Within 48 Hours

A script/tool deployed post-compromise to install proxy and tunneling services (GOST SOCKS5, FRP) for persistence and lateral movement.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.