React2Shell Attacks Linked to North Korean Hackers

North Korean threat actors are believed to be behind CVE-2025-55182 exploitation delivering EtherRAT, according to Sysdig. The React2Shell vulnerability, officially tracked as CVE-2025-55182, can be exploited for unauthenticated remote code execution and affects version 19 of the React open source library, as well as related frameworks including Next.js, Waku, React Router, and RedwoodSDK.

The Shadowserver Foundation has seen roughly 70,000 affected systems, while the vulnerability’s existence came to light on 3 December and in-the-wild exploitation commenced shortly after. Exploitation soon surged, with attacks involving AWS credential theft, malware deployment (botnets), and cryptocurrency miners, and EtherRAT has been deployed as a persistent access implant in some campaigns.

While the evidence points to Lazarus or another North Korea-linked actor exploiting React2Shell as the initial delivery vector, Sysdig notes that another sophisticated actor may be combining techniques from multiple campaigns to complicate attribution.