Google Sees 5 Chinese Groups Exploiting React2Shell for Malware Delivery

Google has detected five China-linked threat groups exploiting the recently disclosed React2Shell vulnerability (CVE-2025-55182) to deliver malware, in attacks that began after the disclosure on 3 December 2025.

The groups include the espionage cluster UNC6600, which deployed a tunneller named Minocat, as well as UNC6586 using a downloader called Snowlight to deliver further payloads, UNC6588 exploiting CVE-2025-55182 to download a backdoor named Compood, UNC6603 delivering a backdoor named Hisonic, and UNC6595 deploying malware tracked as Angryrebel[.]Linux. AWS had previously noted that Earth Lamia and Jackpot Panda started exploiting the vulnerabilities shortly after public disclosure.

Over the weekend, according to GTIG, five other China-linked threat groups were observed delivering malware through React2Shell exploitation; Google’s Threat Intelligence Group has also monitored these attacks. React2Shell, tracked as CVE-2025-55182, affects systems using version 19 of the React UI library with React Server Components, and the vulnerability is critical for unauthenticated remote code execution via specially crafted HTTP requests.