APT / THREAT GROUP
MINOCAT
2
aliases
Last seen:Mar 17, 2026
Intelligence Profile
According to Google, MINOCAT is an 64-bit ELF executable for Linux that includes a custom "NSS" wrapper and an embedded, open-source Fast Reverse Proxy (FRP) client that handles the actual tunneling.
Threat Analysis
MINOCAT is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.
Intelligence Reports Mentioning MINOCAT
Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)
Mandiant Blog· Dec 12, 2025
External References
Quick Facts
TypeAPT / Threat Group
Aliases2
Also Known As
MINOCATelf.minocat
External Intelligence
Malpedia: elf.minocatResearch Links
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.