HISONIC
HISONIC is a Go/Golang-based backdoor associated with China-nexus intrusion activity, particularly UNC6603. It has been observed in post-exploitation activity following exploitation of the critical React Server Components vulnerability CVE-2025-55182 ("React2Shell"), where multiple China-linked clusters deployed malware including MINOCAT, SNOWLIGHT, COMPOOD, HISONIC, and ANGRYREBEL.LINUX. Reporting states UNC6603 delivered an updated version of HISONIC and used it in attacks targeting cloud environments, including AWS and Alibaba Cloud infrastructure in the Asia-Pacific region. The updated HISONIC variant is described as blending into legitimate network activity by using legitimate cloud services such as Cloudflare Pages, Cloudflare, and GitLab to retrieve encrypted configuration and communicate covertly. In one investigated incident, JPCERT/CC observed installation of the HISONIC backdoor under the filename "javax" multiple times on December 6, 2025, on a compromised server that had been exploited via CVE-2025-55182. High-confidence context indicates HISONIC functions as a persistent backdoor used in espionage-oriented operations by UNC6603. Known indicators directly mentioned in the content include the filename "javax" used for the HISONIC payload; broader reporting also notes that SHA256 hashes for HISONIC samples were published, though the hashes themselves are not included in the provided content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Since exploitation began last week, our team at Google Threat Intelligence Group (GTIG) has been tracking widespread activity as multiple threat clusters race to leverage React2Shell (CVE-2025-55182). | Multiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Multiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.
Multiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique“React2Shell exploitation continues… globally exploited… victims triaged… distinct campaigns leveraging this vulnerability…” and “threat actor use React2Shell as the initial access vector in a ransomware attack.”
Command and Control
1 techniqueChina-Nexus Espionage: Multiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Golang-based backdoor installed after exploitation to provide remote access/persistence on the compromised host.
Backdoor deployed in campaigns exploiting React2Shell (CVE-2025-55182) per the referenced reporting.
A Go-based backdoor that retrieves encrypted configuration from Cloudflare Pages and GitLab, designed to blend in with legitimate network activity.
HISONIC is a backdoor malware, with an updated version deployed by UNC6603, used to maintain access and control over systems compromised via the React2Shell vulnerability.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.