Huntress Details Linux Intrusion Involving Multiple Threat Actors and Codex

Apr 22, 2026 · Original article ↗

Summary

Huntress analysts traced multiple Linux threat actors deploying miners, persistence, and credential theft, with data exfiltration and log wiping. Activity later returned via a React2Shell-vulnerable app; investigators highlight limits of AI-only response.

Key points

Huntress SOC analysts found multiple threat actors on a Linux endpoint, including a cryptominer, a multi-revenue botnet, and a credential harvester.
The attackers used cron jobs, systemd services, UDEV rules, and other mechanisms for persistence, and attempted to disable the Huntress agent.
A collection script exfiltrated sensitive files and credentials, including SSH materials, cloud credentials, API tokens, application secrets, and system metadata.
On April 6, attackers returned, repeatedly downloaded payloads, and wiped more than 40 log files, limiting the forensic timeline.
The host was reinfected on April 16; Huntress said activity was consistent with exploitation of CVE-2025-55182 in affected React and Next.js versions.
Codex helped with some troubleshooting but did not fully remediate the threats; analysts said visibility gaps, limited privileges, and concurrent attacker activity complicated response.
Huntress attributed the eventual securing of the endpoint to real-time EDR telemetry, SOC analysis, comprehensive cleanup, and recommendations to update React and Next.js.

Article Details

Attack Vectors: The incident's initial access vector is unknown because the Huntress agent was installed mid-compromise.
The April 16 reinfection was reported as consistent with exploitation of CVE-2025-55182 against an application running Next.js 15.4.6 and React 19.1.0; the application remained unpatched.
Actor B used a shell dropper downloaded from its staging server to install botnet components.
Actor C used a base64-encoded dropper to fetch and execute further payloads, then established persistence and exfiltrated sensitive files.
Defensive Notes: Patch the exposed React/Next.js application; the article reports the host was reinfected while the vulnerability remained unpatched.
Use continuous real-time EDR telemetry and human-led investigation; the agent's mid-compromise installation and wiped logs limited forensic visibility.
Investigate and remove all persistence mechanisms, including cron jobs, systemd services, and UDEV rules, and verify comprehensive cleanup.
Review command-line activity and correlate it with user/session context to distinguish legitimate Codex-generated commands from attacker activity.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`0x1x2x3[.]top`	Actor C C2 domain used by a malicious cron job to retrieve payloads.
DOMAIN	`pool[.]supportxmr[.]com`	Monero mining pool used by Actor B's fkkkf miner.
EMAIL	`workoutoffice@protonmail[.]com`	Repocket account email used for Actor B's residential proxy/bandwidth-selling botnet component.
IPV4	`147[.]45[.]41[.]25`	Staging IP contacted by Actor C's dropper to retrieve next-stage payloads.
IPV4	`162[.]55[.]234[.]175`	Actor B staging/C2 server used to deliver workersh, installsh, dnser, and other botnet payloads.
IPV4	`172[.]245[.]159[.]216`	Staging/C2 IP used for follow-on malware delivery associated with Actor C.
IPV4	`172[.]86[.]127[.]128`	Exfiltration server receiving sensitive files via wget --post-file.
IPV4	`57[.]129[.]119[.]218`	Private Monero mining pool used by the FH8a7d7M cryptominer.
IPV4	`62[.]60[.]246[.]210`	Private Monero mining pool used by Actor A's cryptominer.
SHA256	`781c19b56fbdb17284707f9026e107f639e5447df7df3b248a5d5a50c4b0806c`	SHA256 hash of /tmp/.e2933fc3b.sh, the script used to collect and exfiltrate sensitive data.