SNOWLIGHT

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to sysdig, SNOWLIGHT is used as a dropper for its fileless payload (vshell).

Threat Analysis

SNOWLIGHT is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning SNOWLIGHT

Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)

Mandiant Blog· Dec 12, 2025

External References

→https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures

→https://blog.talosintelligence.com/uat-8302/

→https://cloud.google.com/blog/topics/threat-intelligence/initial-access-brokers-exploit-f5-screenconnect

→https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-react2shell-cve-2025-55182

→https://rhisac.org/threat-intelligence/f5-big-ip-and-screenconnect-cves/

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

elf.snowlightSNOWLIGHT

External Intelligence

Malpedia: elf.snowlight

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search SNOWLIGHT