React2Shell exploited by multiple actors within 48 hours

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Multiple threat actors exploited CVE-2025-55182 (React2Shell) within days of disclosure, compromising servers with coin miners, RATs, backdoors, and defacing websites globally.

Sourceblogs.jpcert.or.jp — open the original

On December 3, 2025, a critical unauthenticated remote code execution vulnerability in React Server Components (CVE-2025-55182, dubbed React2Shell) was publicly disclosed. JPCERT/CC documented a case where multiple threat actors exploited this vulnerability against a single server within 48 hours of disclosure, installing coin miners by December 5. Over the following days, additional attackers deployed RATs, backdoors, and other malware, resulting in simultaneous compromise by multiple distinct threat actors. The compromise was initially detected through website defacement displaying multilingual warnings about the vulnerability. Analysis of web server logs revealed suspicious HTTP POST requests from over 100 IP addresses between December 5-7, suggesting even broader targeting than initially evident.

The attackers deployed diverse malware including SNOWLIGHT downloader (associated with UNC5174), HISONIC backdoor (linked to UNC6603), CrossC2 RAT (Linux Cobalt Strike), and coin miners. Notably, attackers abused Global Socket (gsocket), an open-source tool enabling NAT/firewall traversal via encrypted relay networks, as a covert backdoor operating over port 53. The attackers configured gsocket with custom environment variables to enable remote bash access while evading detection through DNS port usage.

This incident exemplifies the extreme speed at which threat actors incorporate newly disclosed critical vulnerabilities into their toolsets. The case demonstrates that organizations face not just initial exploitation but ongoing compromise by multiple adversaries, with visible indicators like website defacement potentially masking deeper, more sophisticated intrusions requiring comprehensive forensic investigation beyond simple patching.

title: Shell Spawned from Node.js React Server Process
id: b8c54a85-144b-505b-aed8-c8f879c51566
status: experimental
description: Detects a Unix shell process being spawned from a Node.js or React Server
  Components process, which is consistent with exploitation of the React2Shell (CVE-2025-55182)
  vulnerability enabling remote code execution via a web shell or interactive command
  injection.
references:
- https://attack.mitre.org/techniques/T1505/003/
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /node
    - /next-server
    ParentCommandLine|contains:
    - next-server
    - react-server
    - node
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ash
  condition: selection_parent and selection_child
falsepositives:
- Legitimate build or deployment scripts that shell out from a Node.js process during
  CI/CD pipelines
- Administrative wrapper scripts that launch a shell from a supervised Node process
level: high
tags:
- attack.t1505.003
- attack.t1190
- attack.execution
author: Vorant

title: Gsocket Backdoor Execution Over DNS Port
id: d4c605fe-c1ea-519d-8dd2-0d4c8061872d
status: experimental
description: Detects execution of the gsocket / gs-netcat / gs-full-pipe binaries
  with command-line arguments or environment variables indicating configuration of
  a covert relay on port 53 to provide remote interactive bash access, bypassing NAT/firewall
  restrictions. Observed abused as a backdoor following React2Shell (CVE-2025-55182)
  exploitation.
references:
- https://attack.mitre.org/techniques/T1090/
logsource:
  category: process_creation
  product: linux
detection:
  selection_tool:
    Image|endswith:
    - /gsocket
    - /gs-netcat
    - /gs-full-pipe
    CommandLine|contains: gsocket
  selection_config:
    CommandLine|contains:
    - GS_ARGS
    - -p 53
    - -d -p 53
    - /bin/bash
  condition: selection_tool or selection_config
falsepositives:
- Legitimate authorized use of Global Socket for remote administration or NAT traversal
  by internal IT staff
- Developers using gsocket for debugging or CI/CD tunnel access
level: high
tags:
- attack.t1090
- attack.t1071.001
- attack.command-and-control
author: Vorant

title: Coin Miner Execution via Stratum Protocol Reference
id: a6801fb7-6e43-55e8-9893-e40fe6885d47
status: experimental
description: Detects process executions with command lines referencing the stratum+tcp
  mining pool protocol or common cryptocurrency miner binary names/flags, consistent
  with coin miner deployment observed after React2Shell exploitation.
references:
- https://attack.mitre.org/techniques/T1496/
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
    - stratum+tcp
    - stratum+ssl
    - xmrig
    - --donate-level
    - -o pool.
  condition: selection
falsepositives:
- Legitimate, authorized cryptocurrency mining software run intentionally by developers
  or researchers on owned infrastructure
- Security testing tools that simulate miner command lines for detection validation
level: medium
tags:
- attack.t1496
- attack.impact
author: Vorant

Source reporting: https://blogs.jpcert.or.jp/en/2026/02/multiple-threat-actors-rapidly-exploit-react2shell-a-case-study-of-active-compromise.html

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.