React2Shell: Max-Score RCE (CVSS 10.0) Triggers Widespread Exploitation by Espionage Groups & Miners

The React2Shell vulnerability, CVE-2025-55182, carries a maximum CVSS score of 10.0 and allows unauthenticated attackers to execute arbitrary code on a server with a single crafted HTTP request, prompting a rapid global scramble to patch. According to Google Threat Intelligence Group (GTIG), exploitation began quickly after disclosure and has been observed across a range of threat clusters, including state-sponsored espionage groups and opportunistic miners.

GTIG’s report details several China-nexus campaigns deploying a MINOCAT tunneler, an updated HISONIC backdoor, ANGRYREBEL[.]LINUX, and a backdoored COMPOOD variant, alongside XMRIG cryptocurrency miners. The groups UNC6600, UNC6603, UNC6595 and UNC6588 are identified as deploying these tools, with UNC6600’s MINOCAT tunneler noted for deleting legitimate processes to free up resources.

Beyond espionage, investigators report financially motivated actors began deploying XMRIG miners from 5 December 2025, compounding the threat landscape as researchers warned of widespread exploitation and urged immediate patching.