Loading story…
Cisco Talos reported that threat cluster UAT-10608 exploited the critical Next.js React2Shell vulnerability, tracked as CVE-2025-55182 with a CVSS 10.0, to compromise at least 766 internet-exposed hosts across multiple regions and cloud providers. The campaign appears to be broad and automated, with attackers likely using internet-scanning services to find vulnerable deployments before gaining remote code execution and installing a dropper plus a multi-stage credential-harvesting framework called NEXUS Listener.
Investigators said the malware collected secrets from files, cloud settings, system memory, shell history, containers, and SSH material, then exposed the loot through a password-protected web dashboard that allowed operators to browse victims and search stolen data. Observed data included AWS credentials, private SSH keys, database connection strings, GitHub and GitLab tokens, Stripe keys, SendGrid and Brevo secrets, Telegram bot tokens, and credentials for OpenAI, Anthropic, and NVIDIA NIM, raising risks of cloud takeover, lateral movement, software supply chain abuse, follow-on intrusions, and resale of access; defenders were urged to patch vulnerable Next.js systems, rotate exposed credentials, restrict metadata service access, and monitor for suspicious background processes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The DFIR Report uncovered exposed attacker infrastructure showing the React2Shell campaign had compromised more than 900 companies worldwide and used Telegram bots for near-real-time victim triage. Researchers also observed more than 65,000 archived file entries uploaded to a Filebase bucket named "bissapromax" between April 10 and April 21, 2026, revealing expanded scale and additional operational tradecraft.
Cisco Talos published findings on the UAT-10608 operation, warning that the indiscriminate theft of aggregated credentials could enable follow-on intrusions, social engineering, cloud compromise, and resale of access. Reporting also urged organizations to patch vulnerable Next.js applications, rotate exposed secrets, and monitor for suspicious processes.
Cisco Talos reported that the campaign had compromised at least 766 hosts across multiple regions and cloud providers, with one exposed NEXUS Listener instance showing 766 affected hosts within a 24-hour period. Observed stolen data included Stripe keys, AWS credentials, GitHub and GitLab tokens, database connection strings, and credentials for services such as OpenAI, Anthropic, NVIDIA NIM, SendGrid, Brevo, and Telegram.
After gaining access, the attackers deployed a dropper and a multi-stage harvesting toolkit called NEXUS Listener to collect secrets, cloud credentials, SSH keys, shell history, container data, and other sensitive information from infected systems. The framework included a password-protected web interface for browsing compromised hosts and reviewing stolen data.
A threat cluster tracked as UAT-10608 began exploiting the critical React2Shell remote code execution flaw, CVE-2025-55182, to gain initial access to internet-exposed Next.js deployments. Cisco Talos assessed the activity as broad and likely automated, using internet scanning to find vulnerable hosts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcedarkreading.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcethreats.wiz.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are actively exploiting **React2Shell**, a critical remote code execution flaw in React Server Components tracked as `CVE-2025-55182`, with related exposure also noted in Next.js as `CVE-2025-66478`. The bug stems from insecure deserialization in the React Server Components Flight protocol and allows unauthenticated attackers to upload malicious payloads and execute arbitrary code on vulnerable internet-facing servers. Public disclosure was quickly followed by advisories, proof-of-concept code, and reports of broad exploitation, while Microsoft and other researchers said hundreds of machines had already been hacked. Follow-on campaigns have been widespread and largely opportunistic, ranging from credential-harvesting operations to malware deployment against organizations in multiple sectors and regions. Cisco Talos-linked reporting said at least **766 servers** were compromised by an automated campaign that stole SSH keys, cloud tokens, API keys, Kubernetes and GitHub credentials, Docker metadata, and other environment secrets, including keys tied to AI platforms and payment services. Other investigations tied exploitation to **XMRig**, **RustoBot**, **Kaiji**, **Sliver**, **CrossC2**, **Tactical RMM**, **VShell**, and **EtherRAT**, along with persistence, reconnaissance, DNS-based exfiltration, and SSH key installation, underscoring how rapidly the vulnerability was weaponized after disclosure.
Jun 29, 2026
A critical unauthenticated remote code execution flaw in React Server Components, tracked as **CVE-2025-55182** and widely dubbed **React2Shell**, exposed React 19 server-side packages and downstream frameworks including **Next.js App Router**. The bug stems from unsafe deserialization in the RSC/Flight protocol, allowing a single crafted HTTP request to reach vulnerable server function paths and execute arbitrary code in default deployments, including some apps that did not explicitly define Server Function endpoints. React released fixes for `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in **19.0.1**, **19.1.2**, and **19.2.1**, while Next.js issued related guidance under **CVE-2025-66478** for affected 15.x, 16.x, and certain canary releases; vendors stressed that WAF rules and hosting-provider mitigations are only temporary and that patching and redeployment are required. Security firms and vendors reported rapid weaponization after disclosure, with public exploit code, Nuclei and Metasploit support, and confirmed in-the-wild exploitation against internet-facing Next.js and other RSC-enabled applications. Reported post-compromise activity included **XMRig** cryptominers, **Sliver**, **MeshAgent**, **Cobalt Strike**, **SNOWLIGHT**, **ShadowPAD**, credential theft targeting cloud and Kubernetes environments, and persistence mechanisms tied to multiple China-linked actors and other threat groups; CISA added the flaw to its **Known Exploited Vulnerabilities** catalog. Researchers estimated broad exposure across cloud environments and web assets, while Cloudflare, Akamai, Imperva, Google Cloud, and others deployed emergency protections, underscoring the scale and urgency of remediation.
Jul 9, 2026
A critical remote code execution vulnerability, dubbed **React2Shell**, was discovered in the React 19 library, specifically affecting React Server Components. The flaw allows unauthenticated attackers to execute arbitrary code on servers by sending crafted requests, making it a severe risk for organizations using default React and Next.js deployments. Within hours of public disclosure, security firms including Google’s Threat Intelligence Group and AWS confirmed active exploitation in the wild, highlighting the shrinking window between vulnerability awareness and real-world attacks. Researchers from Wiz and Unit 42 demonstrated that even clean, default deployments were susceptible, emphasizing the widespread impact due to the popularity of these frameworks. Threat actors rapidly weaponized the React2Shell vulnerability, with the RondoDoX botnet launching automated exploitation campaigns targeting both web applications and IoT devices. CloudSEK’s analysis of command and control logs revealed a multi-month campaign, with a significant spike in attacks following the vulnerability’s disclosure in December 2025. The RondoDoX botnet deployed various payloads, including web shells and cryptominers, and quickly adapted its infrastructure in response to security firm reports. Organizations with technology stacks overlapping the targeted vectors were promptly alerted, underscoring the urgent need for patching and monitoring in environments using React 19 and Next.js.
Jun 29, 2026