NautilusMalware
Last reported 10 months ago, by Huntress1 report
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“MSTSC tunnels Remote Desktop Protocol connections, defaulting to port 3389.”
- T1036Masquerading
“Process Masquerading”
- T1543.002Systemd Service
“Persistence was established by creating a hidden directory to blend in with legitimate systemd services.”
- T1552.003Shell History
“Interactive Shell History Prevention: When spawning a reverse shell, the ZinFoq immediately executes the following command:”
- T1572Protocol Tunneling
“FTP Proxy allows file transfer protocol tunneling with support for both control and data connections.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182“Aqua Nautilus published a great analysis of a nearly identical Kaiji sample in October 2025, documenting its persistence and evasion techniques.”
Indicators in its reports
named in the reports above- 38.165.44[.]205in 1 report
- hxxp://38.165.44[.]205/1in 1 report
- 45.76.155[.]14in 1 report
- api.qtss[.]ccin 1 report
- hxxp://207.148.79[.]178:6608/sys.shin 1 report
- 207.148.79[.]178in 1 report
- hxxp://216.158.232[.]43:12000/sex.shin 1 report
- 216.158.232[.]43in 1 report
- hxxp://45.32.158[.]54/5e51aff54626ef7f/x86_64in 1 report
- 45.32.158[.]54in 1 report
- hxxp://45.76.155[.]14/vimin 1 report
- hxxp://keep.camdvr[.]org:8000/d5.shin 1 report
- keep.camdvr[.]orgin 1 report
- hxxp://103.135.101[.]15/wocaosinm.sh;wgetin 1 report
- 103.135.101[.]15in 1 report
- hxxp://103.135.101[.]15/wocaosinm.sh;shin 1 report
- hxxp://vps-zap812595-1.zap-srv[.]com:3000/sex.shin 1 report
- vps-zap812595-1.zap-srv[.]comin 1 report
- hxxp://help.093214[.]xyz:9731/fn32.shin 1 report
- help.093214[.]xyzin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.