Mass exploitation hits React2Shell RCE flaw
Within days of CVE-2025-55182 disclosure, multiple threat actors independently compromised servers via the React Server Components RCE, deploying miners, RATs, and backdoors.
Sourceblogs.jpcert.or.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-55182 as exploited in the wild.
JPCERT/CC documented a case where an unauthenticated remote code execution vulnerability in React Server Components (CVE-2025-55182), disclosed December 3, 2025, was weaponized and exploited by numerous independent threat actors within 48 hours. A single compromised server ended up hosting overlapping intrusions: coin miners installed first, followed by various RATs and backdoors, and website defacements warning victims to patch. Access logs showed suspicious POST requests consistent with React2Shell exploitation from over 100 distinct IP addresses in a three-day window, indicating exploitation was widespread rather than limited to this one incident.
Notable tooling recovered included the SNOWLIGHT downloader (previously linked to UNC5174), a Golang-based HISONIC backdoor (linked to UNC6603), and CrossC2, a Linux-compatible Cobalt Strike beacon implementation, all deployed together — suggesting these actors may have been staging infrastructure for follow-on operations rather than acting purely opportunistically. The incident also featured abuse of the open-source tool Global Socket (gsocket), configured to tunnel a bash backdoor over port 53 (normally reserved for DNS) using a pre-shared key file for authentication — an unusual technique not commonly reported by other vendors covering this vulnerability.
This case illustrates the speed at which opportunistic and targeted actors alike weaponize newly disclosed, easily exploitable RCE vulnerabilities, and the risk of multiple overlapping compromises on a single asset. JPCERT/CC recommends that organizations patching CVE-2025-55182 also conduct compromise assessments, since visible symptoms like defacement may mask deeper, more consequential backdoor installations.
Mentioned in this report
Detection guidance
Multiple Malware Families Deployed Sequentially on Single Host
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects suspicious pattern of multiple distinct remote access tools (coin miners, RATs, backdoors) being fetched or executed in rapid succession on a single host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Multiple Malware Families Deployed Sequentially on Single Host
description: Detects indicators of multiple distinct malware families (coin miners,
RATs, backdoors like Cobalt Strike beacons, HISONIC, SNOWLIGHT) being ingested or
spawned within a short timeframe, typical of post-exploitation staging infrastructure
compromise.
tags:
- attack.execution
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_miner_indicators:
CommandLine|contains:
- xmrig
- monero
- stratum
- minergate
selection_rat_indicators:
CommandLine|contains:
- crossc2
- hisonic
- snowlight
- beacon
selection_bash_backdoor:
CommandLine|contains:
- /bin/bash
- nc -l
- bash -i >
ParentImage|contains:
- gsocket
- socat
filter_admin_activity:
User|contains: SYSTEM
ParentImage|endswith:
- \svchost.exe
- \services.exe
condition: (selection_miner_indicators or selection_rat_indicators or selection_bash_backdoor)
and not filter_admin_activity
falsepositives:
- Legitimate cryptocurrency mining operations in authorized environments
- Security research or penetration testing labs executing multiple tool samples
level: high
id: f643f24f-7ef8-5ed7-b635-a12454b3195a
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://blogs.jpcert.or.jp/en/2026/02/multiple-threat-actors-rapidly-exploit-react2shell-a-case-study-of-active-compromise.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs, actors, and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs