Loading story…
Threat actors have begun exploiting the recently disclosed React2Shell vulnerability in React Server Components (RSC), tracked as CVE-2025-55182, to deploy a novel remote access trojan named EtherRAT. The Sysdig Threat Research Team first documented EtherRAT in active attacks against Next.js applications, noting its use of Ethereum blockchain-based command and control (C2) infrastructure. EtherRAT operates as a fileless malware, running payloads via Node.js without writing to disk, and features modules for system reconnaissance, credential harvesting, worm-like propagation, web server hijacking, and SSH backdoor installation. The malware’s blockchain C2 mechanism provides both operational stealth and a forensic trail, as all infrastructure changes are permanently recorded on Ethereum. Attribution remains uncertain, but North Korean-linked actors are suspected, with the campaign excluding targets in Commonwealth of Independent States (CIS) countries.
Security briefings confirm that EtherRAT leverages five independent Linux persistence mechanisms and downloads its own Node.js runtime from nodejs.org, further complicating detection and remediation. The campaign marks the first public documentation of React2Shell being used for more than cryptomining, representing a significant escalation in post-exploitation capabilities. Defenders are advised to monitor for React2Shell exploitation, review blockchain activity for C2 indicators, and implement robust credential and endpoint protections to mitigate the risk posed by EtherRAT and similar fileless threats.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
Sysdig published a detailed analysis of EtherRAT after recovering live payloads, documenting five modules for reconnaissance, credential and crypto theft, worming, web server hijacking, and SSH persistence. The company said attribution remains uncertain because some indicators suggested a DPRK nexus while CIS-exclusion behavior and other artifacts aligned more with Russian or Eastern European cybercrime patterns.
Threat actors exploited React2Shell (CVE-2025-55182) to deliver EtherRAT, a fileless Node.js implant that uses an Ethereum smart contract to resolve command-and-control infrastructure. Reporting described the campaign as active and rapidly weaponized after the vulnerability's disclosure and KEV listing.
Kroll's December 15 briefing said Storm-0249 had changed tactics to target EDR solutions through DLL sideloading and social engineering. The actor was also observed using the ClickFix technique to trick users into executing malicious commands.
Palo Alto Networks' Unit 42 discovered a new ransomware family named 01FLIP that targets Windows systems. Encrypted files are renamed with a .01flip extension.
CISA released technical details on BRICKSTORM, malware described as enabling full system control and data exfiltration. The disclosure added public technical information about the threat's capabilities.
Fortinet released fixes for 18 vulnerabilities, including critical flaws CVE-2025-59718 and CVE-2025-59719 with CVSS scores of 9.1 and 9.8. The update was highlighted in Kroll's December 15 threat briefing.
Microsoft addressed 70 vulnerabilities in its December 2025 Patch Tuesday release, including one zero-day. The broader set of Microsoft and Edge updates covered 154 issues in total.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean-linked threat actors have exploited the critical React2Shell vulnerability (CVE-2025-55182) in React Server Components to deploy a new malware implant known as EtherRAT. EtherRAT features advanced capabilities, including five independent Linux persistence mechanisms, blockchain-based command-and-control using Ethereum smart contracts, and the ability to download its own Node.js runtime. The attack chain begins with remote code execution via a crafted HTTP request, followed by the download and execution of a malicious shell script that prepares the environment and deploys the main JavaScript implant. Researchers note significant overlap with the "Contagious Interview" campaign, which targets blockchain and Web3 developers through fake job offers and coding assignments, but EtherRAT introduces new technical distinctions. The exploitation of React2Shell began within hours of the vulnerability's public disclosure, with both North Korean and China-linked groups observed leveraging the flaw. Automated attacks have compromised at least 30 organizations across multiple sectors, resulting in credential theft, cryptomining, and the deployment of commodity backdoors. The EtherRAT campaign demonstrates the rapid weaponization of newly disclosed vulnerabilities and the increasing sophistication of North Korean cyber operations, particularly in targeting cloud environments and the JavaScript ecosystem.
Jul 18, 2026
Attackers rapidly weaponized **React2Shell** (`CVE-2025-55182`), a critical flaw in React Server Components and React/Next.js applications that enables unauthenticated remote code execution. Security reporting described the bug as one of the most consequential vulnerabilities of the year, with exploitation spreading across criminal and state-linked operations and defenders urged to prioritize emergency patching and monitoring. The flaw was also tied to broader shifts in the threat landscape, including more resilient malware campaigns, cloud-focused intrusions, and increasingly AI-enabled attack activity. Large-scale exploitation followed disclosure, with more than **8.1 million attack sessions** observed from over **8,000 unique source IPs** spanning **101 countries**, including substantial traffic routed through major cloud providers such as AWS. Researchers also linked the vulnerability to follow-on malware activity, including the **EtherRAT** campaign, which used Ethereum smart contracts for command-and-control, while reporting highlighted advanced evasion methods such as AMSI bypass and rapid IP rotation that reduced the effectiveness of static defenses. The volume and sophistication of the attacks underscored the need for behavioral detection, dynamic threat intelligence, and immediate remediation of exposed internet-facing systems.
Jul 9, 2026
Threat actors are actively exploiting **React2Shell**, a critical remote code execution flaw in React Server Components tracked as `CVE-2025-55182`, with related exposure also noted in Next.js as `CVE-2025-66478`. The bug stems from insecure deserialization in the React Server Components Flight protocol and allows unauthenticated attackers to upload malicious payloads and execute arbitrary code on vulnerable internet-facing servers. Public disclosure was quickly followed by advisories, proof-of-concept code, and reports of broad exploitation, while Microsoft and other researchers said hundreds of machines had already been hacked. Follow-on campaigns have been widespread and largely opportunistic, ranging from credential-harvesting operations to malware deployment against organizations in multiple sectors and regions. Cisco Talos-linked reporting said at least **766 servers** were compromised by an automated campaign that stole SSH keys, cloud tokens, API keys, Kubernetes and GitHub credentials, Docker metadata, and other environment secrets, including keys tied to AI platforms and payment services. Other investigations tied exploitation to **XMRig**, **RustoBot**, **Kaiji**, **Sliver**, **CrossC2**, **Tactical RMM**, **VShell**, and **EtherRAT**, along with persistence, reconnaissance, DNS-based exfiltration, and SSH key installation, underscoring how rapidly the vulnerability was weaponized after disclosure.
Aug 15, 2026