china_nexus_threat_actors

China-nexus (including Beijing-linked) threat actors observed in 2025 activity tied to (1) active exploitation of the React2Shell vulnerability (CVE-2025-55182) in React Server Components and (2) misuse of Google’s Gemini LLM in support of cyber operations. In React2Shell campaigns, early exploitation was linked to China- and Iran-nexus actors, with Beijing-linked hackers reported by AWS and Google as actively exploiting the flaw. The exploitation is used for arbitrary code execution and follow-on payload delivery, including malware and, in some cases, ransomware; attackers have been observed blending malicious actions into legitimate-looking application traffic and chaining the vulnerability with other weaknesses and misconfigurations. Separately, Google Threat Intelligence Group reported a China-nexus actor bypassing Gemini safeguards by posing as a cybersecurity student in a CTF competition, and noted state-backed actors from China leveraging Gemini for reconnaissance, phishing, and tooling development. No specific group name, sub-group, or additional aliases are provided in the source content beyond the generic China-nexus/Beijing-linked characterization.