Wide Range of Malware Delivered in React2Shell Attacks

SecurityWeek reports a broad spectrum of malware delivered through React2Shell attacks, exploiting the critical CVE-2025-55182 vulnerability in React 19 with server components. The threats range from cryptocurrency miners and cloud-credential theft to backdoors and post-exploitation implants, with researchers noting common delivery of EtherRAT and various commodity malware alongside Linux backdoors and webshells.

North Korea-linked threat actors have been linked to exploiting the flaw to deliver EtherRAT, while other campaigns have seen Chinese-aligned actors and a wider set of payloads including dropper scripts and tools such as Cobalt Strike and NoodleRAT. Shadowserver observed initial vulnerability exposure rising from around 77,000 IP addresses to more than 165,000 IPs and 644,000 domains with vulnerable code.

According to CISA, Known Exploited Vulnerabilities now include CVE-2025-55182, with agencies instructed to address it by mid-December after an initial deadline was set for 26 December. Security firms such as Huntress and Wiz have additionally tracked the campaign delivering PeerBlight, CowTunnel, ZinFoq and Kaiji botnet components powering Linux and containerised environments.