🇨🇳 CN4 malware familiesExploits CVEs in the wild

UNC6600

Also known asunc6600

UNC6600 is a China-nexus espionage cluster observed by Google Threat Intelligence Group exploiting the React2Shell vulnerability (CVE-2025-55182) for initial access. In the reported activity, UNC6600 delivered MINOCAT, a tunneling utility based on Fast Reverse Proxy (FRP), to maintain covert access and persistence on compromised Linux systems. GTIG reported that the actor executed bash scripts that created a hidden directory at $HOME/.systemd-utils, killed processes named "ntpclient," downloaded the MINOCAT binary, and established persistence via a cron job, a systemd service, and malicious commands inserted into the user’s shell configuration so MINOCAT would run in new shells. MINOCAT is described as a 64-bit ELF executable for Linux with a custom "NSS" wrapper and an embedded FRP client. UNC6600 is one of multiple China-linked groups observed weaponizing React2Shell globally against unpatched React and Next.js workloads. Alias mentioned in the content: unc6600.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Where they're from

Attributed origin per open-source reporting.

MITRE ATT&CK

Tradecraft

8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

7 of 15 tactics18 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0001

Initial Access

1 technique

T1190×2

Exploit Public-Facing Application

TA0002

Execution

2 techniques

T1053

Scheduled Task/Job

T1053.003

Cron

T1059

Command and Scripting Interpreter

T1059.004

Unix Shell

TA0003

Persistence

2 techniques

T1053

Scheduled Task/Job

T1053.003

Cron

T1543

Create or Modify System Process

T1543.002

Systemd Service

TA0004

Privilege Escalation

2 techniques

T1053

Scheduled Task/Job

T1053.003

Cron

T1543

Create or Modify System Process

T1543.002

Systemd Service

TA0008

Lateral Movement

1 technique

T1210

Exploitation of Remote Services

TA0011

Command and Control

2 techniques

T1090

Proxy

T1090.003

Multi-hop Proxy

T1105

Ingress Tool Transfer

TA0040

Impact

1 technique

T1489

Service Stop

ARSENAL

Associated malware families

4 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

MINOCATMultiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.2Apr 9, 2026

ANGRYREBEL.LINUXMultiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.1Apr 9, 2026

HISONICMultiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.1Apr 9, 2026

SNOWLIGHTMultiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.1Apr 9, 2026

WEAPONIZED

Associated vulnerabilities

1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.

CVE-2025-55182React2ShellIn the wildEvidence2

Since exploitation began last week, our team at Google Threat Intelligence Group (GTIG) has been tracking widespread activity as multiple threat clusters race to leverage React2Shell (CVE-2025-55182).

ACTIVITY FEED

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

14 SOURCESView more in app

f5 communityNews

Dec 30, 2025

F5 Threat Report - December 31st, 2025 | DevCentral

Listed as a threat actor associated in the report’s aggregated section with exploitation activity around React2Shell (CVE-2025-55182) and related RSC/Next.js vulnerabilities.

f5 communityNews

Dec 30, 2025

F5 Threat Report - December 31st, 2025 | DevCentral

Named in an aggregated list of actors associated with React2Shell (CVE-2025-55182) exploitation activity (UNC-style naming suggests an uncategorized cluster).

polyswarmNews

Dec 19, 2025

Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)

China-nexus threat actor exploiting CVE-2025-55182 to deploy MINOCAT tunneler.

the hacker newsNews

Dec 16, 2025

React2Shell Vulnerability Actively Exploited to Deploy Linux Backdoors

UNC6600 is a China-nexus threat actor group exploiting the React2Shell vulnerability to deliver the tunneling utility MINOCAT.

+9 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping8

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal4

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs1

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.