Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2026-81578 (CVSS 8.8, CWE-306) is an authentication bypass in the web management interface that lets unauthenticated requests mutate system configuration. | Attackers dropped Udydn.class under server/lib and staged a base64-encoded command in data/content/Udydn.cmd. Setting user-lookup.db-driver to Udydn caused Class.forName("Udydn") to execute its static initializer.
CVE-2026-82078 (CVSS 9.4, CWE-470) is an unsafe dynamic class-loading flaw in the database connection utilities that converts attacker-controlled configuration into arbitrary Java bytecode execution. | Attackers dropped Udydn.class under server/lib and staged a base64-encoded command in data/content/Udydn.cmd. Setting user-lookup.db-driver to Udydn caused Class.forName("Udydn") to execute its static initializer.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
The Udydn payload uses cmd /c to execute the decoded staged command; observed commands included whoami & ver and whoami & ver & tasklist. | cmd /c "whoami & ver" as SYSTEM under pc-app.exe.
The payload selects /bin/sh -c on non-Windows systems based on the os.name Java property. | String[] argv = isWin ? ... : new String[] { "/bin/sh", "-c", decoded };
A final configuration write points user-lookup.db-driver at the class name Udydn. The next connection attempt performs the unsafe dynamic instantiation—Class.forName("Udydn")—and because Java executes a class's static initializer at load time, merely loading the class detonates the payload. | A final configuration write points user-lookup.db-driver at the class name Udydn; the next connection attempt performs Class.forName("Udydn"), causing its static initializer to run.
The payload's cleanup thread sleeps twenty seconds, then deletes logs/server.log and every server.log.* rotation, deletes data/internal/derby.log, and removes its own staging files and class. | The payload sleeps twenty seconds, then deletes logs/server.log and rotations, data/internal/derby.log, its .cmd/.out staging files, and its own class file.
In incident one ... the decoded command was whoami & ver—pure environment validation: which identity did I land as. | In the first incident, the decoded command was whoami & ver; the whoami command was used to determine which identity the attacker obtained.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.