React2Shell Vulnerability Actively Exploited to Deploy Linux Backdoors

The React2Shell vulnerability, tracked as CVE-2025-55182, is being actively exploited to deliver Linux backdoors such as KSwapDoor and ZnDoor, according to findings from Palo Alto Networks Unit 42 and NTT Security. “KSwapDoor is a professionally engineered remote access tool designed with stealth in mind,” a senior threat intel researcher there described, noting its internal mesh network and military-grade encryption that can bypass blocks.

The disclosure also states that the Linux backdoor offers interactive shell, file operations and lateral movement capabilities, and that some variants impersonate a legitimate Linux kernel swap daemon to evade detection. In Japan, organisations are being targeted to deploy ZnDoor, a malware observed via activity described as part of the same campaign, with payloads fetched from remote servers using wget.

The Shadowserver Foundation is tracking more than 111,000 IP addresses vulnerable to React2Shell, with 77,800 instances in the United States, and 59,128 servers breached in the broader operation codenamed PCPcat, suggesting large-scale exploitation and data exfiltration. Microsoft Defender Security Research Team also noted post-exploitation activity, including reverse shells and the deployment of remote monitoring tools, as part of a wider attack chain.