shoc.enz
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Security researchers at Imperva first observed the activity on May 24, 2026, when their Cloud Web Application Firewall blocked suspicious deserialization attacks that were later linked to active exploitation of CVE-2025-54068. The vulnerability affects Laravel Livewire v3 versions up to 3.6.3 and stems from improper validation during the framework’s hydration process. | This script, identified as “shoc.enz,” is a credential-harvesting tool designed to locate and extract sensitive configuration data from Laravel environments.
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Analysis of captured attack traffic shows that attackers leveraged PHPGGC gadget chains to construct payloads that execute remote shell commands. In observed cases, compromised systems were instructed to download a malicious Bash script from a command-and-control server and execute it silently in the background.
Stealth
3 techniques
Stealth
Credential Access
2 techniques
Credential Access
Credential Extraction : Parses discovered files for DB_HOST, DB_DATABASE, DB_USERNAME, DB_PASSWORD, and APP_KEY values
Once deployed, the malware scans the entire file system for .env files, which store critical application secrets such as database credentials, API keys, and encryption values. It extracts key fields including database hostnames, usernames, passwords, and application keys
Discovery
1 technique
Discovery
Collection
2 techniques
Collection
Command and Control
1 technique
Command and Control
Exfiltration
4 techniques
Exfiltration
The threat actor operates a redundant three-channel exfiltration system ... Secondary api.telegram.org Notifications and small file uploads ... MITRE ATT&CK Mapping ... T1041 Exfiltration Over C2 Channel Telegram Bot API exfiltration
attackers used a multi-channel exfiltration setup involving an FTP server, the Telegram API, and the cloud storage platform GoFile.
The threat actor operates a redundant three-channel exfiltration system: Channel Endpoint Purpose Primary FTP @ 47.129.100.149:21 Main credential storage ... MITRE ATT&CK Mapping ... T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol FTP exfiltration to 47.129.100.149
IOCs tracked for this family
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malicious Bash script used after exploitation of Laravel Livewire to scan for .env files, extract sensitive configuration data such as database credentials, API keys, and application secrets, compress the stolen data, and exfiltrate it via FTP, Telegram API, and GoFile while removing traces of execution.
A Bash-based credential stealer that scans compromised Laravel servers for .env files, extracts database and application secrets such as DB credentials and APP_KEY values, stages and compresses the data, and exfiltrates it via FTP, Telegram, and GoFile.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.