LightSpy Malware Variant Targeting macOS
huntress.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
2 CVEs- CVE-2025-55182Meta React Server Components Remote Code Execution VulnerabilityMeta · React Server ComponentsKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter5 reports99.8%Top 0.04%95.0priority
- CVE-2024-55956Cleo Multiple Products Unauthenticated File Upload VulnerabilityCleo · Multiple ProductsKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report94.0%Top 0.16%83.7priority
Where it names them
CVE-2025-55182 Original (opens in a new tab) ↗
PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182Huntress is seeing threat actors exploit React2Shell (CVE-2025-55182) to deploy a Linux backdoor, a reverse proxy tunnel, and a Go-based post-exploitation implant.Learn More
CVE-2024-55956 Original (opens in a new tab) ↗
Malichus Implant Malware AnalysisTeam Huntress has analyzed Cleo's software vulnerability CVE-2024-55956.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.