North Korea-linked Actors Exploit React2Shell to Deploy New EtherRAT Malware

Threat actors with ties to North Korea have likely become the latest to exploit the recently disclosed React2Shell flaw in React Server Components to deploy a previously undocumented remote access trojan dubbed EtherRAT. According to Sysdig, EtherRAT leverages Ethereum smart contracts for command-and-control resolution, deploys five independent Linux persistence mechanisms, and downloads its own Node.js runtime from nodejs[.]org.

The activity shows significant overlap with Contagious Interview, a campaign observed since February 2025 that targets blockchain and Web3 developers via fake job interviews and related techniques. The attack chain uses CVE-2025-55182 (CVSS 10.0) to run a Base64 shell command that downloads and executes scripts, downloads Node.js, and writes an encrypted blob and obfuscated dropper to disk before deleting the shell script.

EtherRAT then decrypts the payload with a hard-coded key, spawns it with the downloaded Node.js binary, and polls a C2 URL fetched from an Ethereum contract every five minutes using a nine-endpoint consensus mechanism. This setup aims to provide long-term, stealthy access and resilience against takedowns, with multiple persistence methods including systemd user services, XDG autostart, cron jobs, .bashrc injections, and profile injections.