Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
React2Shell Side Quest: Tracking Down Malicious MeshCentral Nodes
Malware Families
Excerpt
While spelunking through the noise of React2Shell initial access payloads, we were diverted down a side quest when we spotted an exploit attempting to drop a well-known Remote Monitoring and Management (RMM) agent: MeshCentral . This payload execution chain is a classic Exploit-to-RMM-Agent-to-Persistence , which can be a useful if not powerful combination, and it led us to check just how “Mesh-y” our GreyNoise data has become. Initial Access & Payload Analysis The…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2025-55182 | High | Score 82/100 | First seen |
| SHA256 | bf876e0af91ca494469be4b45b170e698913c89a37a291e6d3b755c7edd5fb81 | Medium | Score 53/100 | First seen |
| CVE | CVE-2025-66478 | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…