SOC Prime Bias: Critical

08 Apr 2026 18:14
newspaper icon Cisco Talos Blog

UAT-10608 Exposed: Automated Credential Theft at Scale Against Web Applications

Author Photo
SOC Prime Team linkedin icon Follow
UAT-10608 Exposed: Automated Credential Theft at Scale Against Web Applications
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

Cisco Talos reports a large-scale operation abusing the React2Shell weakness in Next.js apps to steal credentials in bulk. The attackers use a purpose-built framework dubbed NEXUS Listener to extract high-value secrets from compromised hosts, including environment variables, SSH keys, cloud and Kubernetes tokens, and API credentials. Talos observed 766+ impacted systems across multiple regions and cloud providers. Stolen data is pushed out through HTTP callbacks to a centralized C2 endpoint.

Investigation

Talos analyzed payloads delivered via CVE-2025-55182, which drop a randomly named shell script into /tmp and execute it using nohup for persistence-like continuity. The script runs staged collection modules covering environment secrets, SSH material, cloud metadata, Kubernetes tokens, Docker details, and command history. Results are sent back to the NEXUS Listener service over port 8080. Investigators reviewed the NEXUS Listener web UI, backend data storage, and associated network telemetry to validate the credential types and the scale of collection.

Mitigation

Patch affected Next.js deployments to remediate React2Shell exposure. Enforce IMDSv2 on cloud metadata endpoints, rotate any potentially exposed secrets immediately, and separate SSH key usage by environment and role. Add RASP controls or WAF rules designed to catch SSR-style injection attempts. Cloud teams should enable secret scanning, minimize instance role permissions, and review server-side configuration to prevent accidental exposure of sensitive environment variables.

Response

Alert on unexpected nohup-spawned scripts executing from /tmp, especially dot-prefixed or randomly named files, and monitor outbound HTTP traffic to unknown destinations on port 8080. Block exfiltration URLs matching known NEXUS Listener callback patterns. Isolate impacted hosts, revoke compromised keys/tokens, and perform forensic review to understand what data was collected and where it was used. Deploy IDS detections for React2Shell exploitation and tighten least-privilege access to metadata and secret stores.

"graph TB %% Class definitions classDef technique fill:#ffcc99 classDef tool fill:#99ccff classDef malware fill:#ccffcc %% Node definitions tech_initial_access["<b>Technique</b> – <b>T1189 Driveu2011by Compromise</b><br/><b>Description</b>: Attacker gains initial access by exploiting a vulnerability in a publicu2011facing website and executing code on the victim system."] class tech_initial_access technique tool_react2shell["<b>Tool</b> – <b>Name</b>: React2Shell (CVEu20112025u201155182)<br/><b>Description</b>: Preu2011authentication remote code execution vulnerability in Next.js applications."] class tool_react2shell tool tech_exploit_client["<b>Technique</b> – <b>T1203 Exploitation for Client Execution</b><br/><b>Description</b>: Exploits software vulnerabilities to execute code on a target system."] class tech_exploit_client technique tech_script_proxy["<b>Technique</b> – <b>T1216 System Script Proxy Execution</b><br/><b>Description</b>: Uses system scripts to proxy execution of malicious code."] class tech_script_proxy technique malware_loader["<b>Malware</b> – <b>Name</b>: Loader Script<br/><b>Description</b>: Small shell script placed in /tmp with a randomized name and launched with nohup."] class malware_loader malware tech_hide_artifacts["<b>Technique</b> – <b>T1564.011 Hide Artifacts: Ignore Process Interrupts</b><br/><b>Description</b>: Runs malicious processes in background to avoid detection."] class tech_hide_artifacts technique tech_network_logon["<b>Technique</b> – <b>T1037.003 Network Logon Script</b><br/><b>Description</b>: Configures a logon script that runs each time a user logs on to the network."] class tech_network_logon technique tech_private_keys["<b>Technique</b> – <b>T1552.004 Private Keys</b><br/><b>Description</b>: Searches for and extracts private SSH keys from the file system."] class tech_private_keys technique tech_credentials_files["<b>Technique</b> – <b>T1552.001 Credentials In Files</b><br/><b>Description</b>: Collects credentials stored in files such as .env, authorized_keys, Docker configs, etc."] class tech_credentials_files technique tech_cloud_metadata["<b>Technique</b> – <b>T1552.005 Cloud Instance Metadata API</b><br/><b>Description</b>: Queries cloud provider metadata services to obtain temporary IAM credentials."] class tech_cloud_metadata technique tech_container_api["<b>Technique</b> – <b>T1552.007 Container API</b><br/><b>Description</b>: Accesses Kubernetes serviceu2011account tokens from the pod filesystem."] class tech_container_api technique tech_remote_staging["<b>Technique</b> – <b>T1074.002 Remote Data Staging</b><br/><b>Description</b>: Stages collected data locally before exfiltration."] class tech_remote_staging technique tech_automated_exfil["<b>Technique</b> – <b>T1020 Automated Exfiltration</b><br/><b>Description</b>: Automates data exfiltration through scripted processes."] class tech_automated_exfil technique tech_web_service["<b>Technique</b> – <b>T1102 Web Service</b><br/><b>Description</b>: Utilizes legitimate web services for command and control communication."] class tech_web_service technique tech_dead_drop["<b>Technique</b> – <b>T1102.001 Dead Drop Resolver</b><br/><b>Description</b>: Stores exfiltrated data in a web service acting as a deadu2011drop location."] class tech_dead_drop technique tech_ssh["<b>Technique</b> – <b>T1021.004 SSH</b><br/><b>Description</b>: Uses SSH for remote service lateral movement."] class tech_ssh technique tech_ssh_hijack["<b>Technique</b> – <b>T1563.001 SSH Hijacking</b><br/><b>Description</b>: Reuses harvested private keys to hijack existing SSH sessions."] class tech_ssh_hijack technique tool_nexus["<b>Tool</b> – <b>Name</b>: NEXUS Listener<br/><b>Description</b>: Webu2011based GUI that receives harvested data and displays it to operators."] class tool_nexus tool %% Connections tech_initial_access –>|uses| tool_react2shell tool_react2shell –>|triggers| tech_exploit_client tech_exploit_client –>|enables| tech_script_proxy tech_script_proxy –>|launches| malware_loader malware_loader –>|applies| tech_hide_artifacts malware_loader –>|sets up| tech_network_logon malware_loader –>|collects| tech_private_keys malware_loader –>|collects| tech_credentials_files malware_loader –>|queries| tech_cloud_metadata malware_loader –>|accesses| tech_container_api malware_loader –>|stages| tech_remote_staging tech_remote_staging –>|exfiltrates via| tech_automated_exfil tech_automated_exfil –>|uses| tech_web_service tech_automated_exfil –>|uses| tech_dead_drop tech_web_service –>|provides C2 to| tool_nexus tool_nexus –>|enables| tech_ssh tech_ssh –>|augmented by| tech_ssh_hijack tech_ssh_hijack –>|reuses| tech_private_keys "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:
    An attacker has obtained a copy of a credential‑harvesting script (.eba9ee1e4.sh) that attempts to read /etc/passwd, search for SSH keys, and perform brute‑force login attempts against a target web application. To keep the script running after the SSH session ends and to evade interactive monitoring, the attacker uploads the script to /tmp/.eba9ee1e4.sh and launches it with nohup sh. Because the detection rule looks for the literal command line nohup sh /tmp/.eba9ee1e4.sh, this exact execution will generate the expected telemetry.

  • Regression Test Script:

    #!/bin/bash
# -------------------------------------------------------------
# Regression script to trigger the Sigma rule:
#   detection of `nohup sh /tmp/.eba9ee1e4.sh`
# -------------------------------------------------------------

# 1. Drop the malicious‑looking script (harmless content for testing)
cat <<'EOF' > /tmp/.eba9ee1e4.sh
#!/bin/bash
echo "Simulated credential harvesting – no real activity"
EOF
chmod +x /tmp/.eba9ee1e4.sh

# 2. Execute the script with nohup in the background (exact command line)
nohup sh /tmp/.eba9ee1e4.sh >/dev/null 2>&1 &

echo "Simulation launched – check SIEM for detection."

  • Cleanup Commands:

    # Terminate any lingering background instances of the test script
pkill -f "/tmp/.eba9ee1e4.sh" || true

# Remove the test script
rm -f /tmp/.eba9ee1e4.sh

echo "Cleanup complete."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free