React2Shell Reflections: Cloud Insights, Finance Sector Impacts, and Threat Insights

The blog notes that CVE 2025-55812, known as React2Shell, was disclosed in January 2026, with the vulnerability discovered on 3 December 2025 and a patch released the same day; within 30 hours of the patch, a public proof-of-concept emerged, leaving many systems unpatched when exploitation began.

Darktrace observed that exploitation of unauthenticated remote code execution in React Server Components progressed rapidly, with attackers gaining control of exposed Next.js servers within two minutes of the honeypot going online.

In one cloud-native finance sector incident, opportunistic actors deployed a Go-based remote access trojan and cryptomining payloads such as XMrig after compromising an internet-facing Azure VM running Next.js, with crypto mining continuing later the same day via a cryptominer consistent with XMRig tooling.

The attack included initial access from abused VPN infrastructure linked to Surfshark, and involved file names and paths including a binary masquerading as “vim” and a DLL named kugou.dll used to load a malicious counterpart, with persistence established via a Run key.

The report highlights that targets in the financial sector included organisations in the United Kingdom, Sweden, Spain, Portugal, Nigeria, Kenya, Qatar and Chile, and notes the emergence of new DPRK tooling such as Beavertail and EtherRAT for C2 and persistence.