"admin can detect this activity by monitoring connections to the command server IP addr 67.217.57.240 on ports 666, 888, and 5656, looking for systemd services with names containing pcpcat, and checking for unusual outbound connections carrying JSON data containing environment vars or credentials."
1
New PCPcat Exploiting React2Shell Vulnerability to compromise 59,000+ Servers
