SNOWLIGHTMalware
According to sysdig, SNOWLIGHT is used as a dropper for its fileless payload (vshell).From MISP Galaxy
Last reported 23 days ago, by Help Net Security4 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1221Template Injection
“…trary Code Execution (RCE) & Command Injection via untrusted workflow serialization, insecure Python tool calling, and Server-Side Template Injection (SSTI).”
- T1565Data Manipulation
“18%) and Data Manipulation (5% vs.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
The vulnerabilities AI finds are the ones attackers want“The attackers escalated privileges, exfiltrated data and dropped payloads including SNOWLIGHT, SPARKRAT and cryptominers.”
-
Vulnerability Discovery and Exploitation Trends in the AI Era“… variety of post-exploitation activities, including privilege escalation, data exfiltration, and dropping secondary payloads including SNOWLIGHT, SPARKRAT, and cryptominers.”
-
Advent of Configuration Extraction, Part 3: SNOWLIGHT Config“Advent of Configuration Extraction, Part 3: SNOWLIGHT Config”
-
Multiple Threat Actors Rapidly Exploit React2Shell: A Case Study of Active Compromise“Notably, in addition to typical financially motivated coin miners, the following were also observed: a SNOWLIGHT [1] downloader reportedly used by UNC5174, a Golang-based HISONIC backdoor [2] reportedly used by UNC6603, and CrossC2 RAT [3], the Linux version of the Cobalt Strike…”
Indicators in its reports
named in the reports above- 344c391cfd4fd304…b3c6c4cbbb29in 1 report
- rel.symbol[.]namein 1 report
- symbol[.]namein 1 report
- instr[.]idin 1 report
- 154.89.152[.]240in 1 report
- hxxps://github[.]com/hackerschoice/gsocketin 1 report
- hxxps://sect.iij.ad[.]jp/blog/2025/11/unc5174-windows-snowlight-in-2025/in 1 report
- sect.iij.ad[.]jpin 1 report
- 45.143.131[.]123in 1 report
- 5bae25736a09de5f…9d021a65daa9in 1 report
- ba43e447e63611d3…9ccf6169808bin 1 report
- ac3e12fa0aa4d6e4…9d3b3a6c2fb8in 1 report
- a536d755313ce550…3c496c8fcd12in 1 report
- 0c748b9e8bc6b5b4…6a19d4f9b657in 1 report
- 1a1edbea47162b1a…6a04b7c15552in 1 report
- 0d07a97499322130…e830a2d82729in 1 report
- 5baa52387daedea5…e8e4a423baafin 1 report
- c1a9cfc62626118b…9ea5c987fcc0in 1 report
- 4a74676bd00250d9…17f58fc9f85cin 1 report
- cb5f62bf7b591e69…f02e403d2e78in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.