MalwareUsed by 1 actorExploits 2 CVEs

NEXUS Listener

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2025-55182React2ShellExploited in the wild

The vulnerability at the center of this attack is CVE-2025-55182, widely known as React2Shell. Rated a maximum severity score of 10.0 on the CVSS scale, the flaw exists in the React Server Components (RSC) Flight protocol, specifically in how a React server processes HTTP requests to Server Function endpoints. A single crafted HTTP request is enough for an attacker to execute code on the server with no authentication required.

via cyber security newscybersecuritynews.com

CVE-2025-66478Rejected duplicate of React2Shell in Next.js App RouterExploited in the wild

Next.js also received a separate tracking number, CVE-2025-66478, given its significant downstream exposure to this flaw.

via cyber security newscybersecuritynews.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UAT-10608

Talos is disclosing a large-scale automated credential harvesting campaign carried out by a threat cluster we currently track as UAT-10608. The campaign is primarily leveraging a collection framework dubbed “NEXUS Listener.”

via blueteamsecinfosec.pub

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1595Active ScanningEvidence1

The attack begins with automated scanning for vulnerable Next.js apps, which are breached via the React2Shell vulnerability.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence4

Hackers are exploiting a critical security flaw called React2Shell, targeting websites built on the widely used Next.js framework... A single crafted HTTP request is enough for an attacker to execute code on the server with no authentication required.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

A script that executes a multi-phase credential-harvesting routine is placed in the standard temporary directory.

T1059.007JavaScriptEvidence1

The server deserializes the malicious payload, resulting in arbitrary code execution in the server-side Node.js process.

Persistence

1 technique

T1098.004SSH Authorized KeysEvidence1

This is accomplished by means of a dropper that proceeds to deploy a multi-phase harvesting script that collects various details from the compromised system - ... SSH private keys and authorized_keys ...

Privilege Escalation

1 technique

T1098.004SSH Authorized KeysEvidence1

Credential Access

6 techniques

T1056Input CaptureEvidence1

Talos is disclosing a large-scale automated credential harvesting campaign carried out by a threat cluster we currently track as UAT-10608.

T1528Steal Application Access TokenEvidence1

According to Cisco Talos researchers, the data stolen this way includes: ... Cloud credentials (AWS/GCP/Azure metadata, IAM credentials) ...

T1552Unsecured CredentialsEvidence2

Several breached hosts exposed package registry authentication files, including npm and pip configuration files that carried registry credentials.

T1552.005Cloud Instance Metadata APIEvidence1

API keys IAM role-associated temporary credentials by querying the Instance Metadata Service for AWS, Google Cloud, and Microsoft Azure

T1555Credentials from Password StoresEvidence4

Stolen material included database connection strings, SSH private keys, cloud access tokens, GitHub tokens, Stripe live secret keys, Kubernetes service account credentials, environment variables, and shell command histories.

T1649Steal or Forge Authentication CertificatesEvidence2

Stolen material included... SSH private keys...

Discovery

2 techniques

T1057Process DiscoveryEvidence2

According to Cisco Talos researchers, the data stolen this way includes: ... Process and runtime data

T1613Container and Resource DiscoveryEvidence2

According to Cisco Talos researchers, the data stolen this way includes: ... Kubernetes tokens Docker/container information

Collection

2 techniques

T1056Input CaptureEvidence1

Talos is disclosing a large-scale automated credential harvesting campaign carried out by a threat cluster we currently track as UAT-10608.

T1119Automated CollectionEvidence1

Post-compromise, UAT-10608 leverages automated scripts for extracting and exfiltrating credentials from a variety of applications

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence4

Each phase collects a different type of data... and reports back to the NEXUS Listener C2 server on port 8080, including the victim’s hostname and a phase identifier.

T1105Ingress Tool TransferEvidence2

That dropper then retrieves a multi-phase credential harvesting script from the attacker’s infrastructure.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence4

Each phase collects a different type of data, from SSH keys and cloud tokens to database passwords, and reports back to the NEXUS Listener C2 server on port 8080, including the victim’s hostname and a phase identifier.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

blueteamsecNews

May 8, 2023

UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applications - Infosec.Pub

A collection framework used in a large-scale automated credential harvesting campaign.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actorExploits 2 CVEs

NEXUS Listener

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2025-55182React2ShellExploited in the wild

via cyber security newscybersecuritynews.com

CVE-2025-66478Rejected duplicate of React2Shell in Next.js App RouterExploited in the wild

Next.js also received a separate tracking number, CVE-2025-66478, given its significant downstream exposure to this flaw.

via cyber security newscybersecuritynews.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UAT-10608

via blueteamsecinfosec.pub

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1595Active ScanningEvidence1

The attack begins with automated scanning for vulnerable Next.js apps, which are breached via the React2Shell vulnerability.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence4

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

A script that executes a multi-phase credential-harvesting routine is placed in the standard temporary directory.

T1059.007JavaScriptEvidence1

The server deserializes the malicious payload, resulting in arbitrary code execution in the server-side Node.js process.

Persistence

1 technique

T1098.004SSH Authorized KeysEvidence1

Privilege Escalation

1 technique

T1098.004SSH Authorized KeysEvidence1

Credential Access

6 techniques

T1056Input CaptureEvidence1

Talos is disclosing a large-scale automated credential harvesting campaign carried out by a threat cluster we currently track as UAT-10608.

T1528Steal Application Access TokenEvidence1

According to Cisco Talos researchers, the data stolen this way includes: ... Cloud credentials (AWS/GCP/Azure metadata, IAM credentials) ...

T1552Unsecured CredentialsEvidence2

Several breached hosts exposed package registry authentication files, including npm and pip configuration files that carried registry credentials.

T1552.005Cloud Instance Metadata APIEvidence1

API keys IAM role-associated temporary credentials by querying the Instance Metadata Service for AWS, Google Cloud, and Microsoft Azure

T1555Credentials from Password StoresEvidence4

T1649Steal or Forge Authentication CertificatesEvidence2

Stolen material included... SSH private keys...

Discovery

2 techniques

T1057Process DiscoveryEvidence2

According to Cisco Talos researchers, the data stolen this way includes: ... Process and runtime data

T1613Container and Resource DiscoveryEvidence2

According to Cisco Talos researchers, the data stolen this way includes: ... Kubernetes tokens Docker/container information

Collection

2 techniques

T1056Input CaptureEvidence1

Talos is disclosing a large-scale automated credential harvesting campaign carried out by a threat cluster we currently track as UAT-10608.

T1119Automated CollectionEvidence1

Post-compromise, UAT-10608 leverages automated scripts for extracting and exfiltrating credentials from a variety of applications

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence4

Each phase collects a different type of data... and reports back to the NEXUS Listener C2 server on port 8080, including the victim’s hostname and a phase identifier.

T1105Ingress Tool TransferEvidence2

That dropper then retrieves a multi-phase credential harvesting script from the attacker’s infrastructure.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence4

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

blueteamsecNews

May 8, 2023

UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applications - Infosec.Pub

A collection framework used in a large-scale automated credential harvesting campaign.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.