New EtherRAT backdoor surfaces in React2Shell attacks tied to North Korea

According to Sysdig researchers, North Korea–linked threat actors are likely exploiting the new critical React2Shell flaw (CVE-2025-55182) to deploy a previously unknown remote access trojan named EtherRAT. The vulnerability affects React Server Components versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0, including packages such as react-server-dom-parcel and react-server-dom-webpack, with the flaw arising from unsafe data deserialization from HTTP requests to Server Function endpoints.

EtherRAT is described as a persistent RAT that uses Ethereum smart contracts for command-and-control resolution, employs five Linux persistence methods, and downloads its own Node.js runtime. The campaign overlaps with North Korea’s Contagious Interview activity, which targets developers in Windows, Linux and macOS, and uses social engineering to deliver payloads like BeaverTail, OtterCookie and InvisibleFerret.

The dropper decrypts payloads with AES-256-CBC, then establishes persistence and queries nine RPC endpoints for C2, selecting the majority response to resist tampering.