Chinese Hackers Have Started Exploiting the Newly Disclosed React2Shell Vulnerability

Two China‑linked threat groups, Earth Lamia and Jackpot Panda, have been observed weaponising the newly disclosed React Server Components flaw CVE‑2025‑55182, also known as React2Shell, within hours of it becoming public. The vulnerability allows unauthenticated remote code execution and has been addressed in React versions 19.0.1, 19.1.2, and 19.2.1.

According to a new report shared by Amazon Web Services, exploitation activity has been detected from IP addresses and infrastructure historically linked to known China state‑nexus threat actors, observed in AWS MadPot honeypot infrastructure.

The report notes Earth Lamia was previously attributed to attacks exploiting a critical SAP NetWeaver flaw (CVE‑2025‑31324) earlier this year, while Jackpot Panda has primarily targeted entities engaged in online gambling across East and Southeast Asia, according to CrowdStrike.

The activity appears to target sectors including financial services, logistics, retail, IT, universities and government organisations across Latin America, the Middle East and Southeast Asia, with infrastructure overlaps cited for both groups. Amazon said it also detected threat actors exploiting 2025‑55182 alongside other N‑day flaws, and observed commands such as whoami, writing /tmp/pwned.txt, and reading /etc/passwd during exploitation attempts.

CJ Moses, CISO of Amazon Integrated Security, said the findings illustrate a systematic approach where threat actors rapidly integrate public exploits into scanning infrastructure and run broad campaigns across multiple CVEs to maximise success.