Mass exploitation hits React2Shell RCE flaw

Within days of CVE-2025-55182 disclosure, multiple threat actors independently compromised servers via the React Server Components RCE, deploying miners, RATs, and backdoors.

JPCERT/CC documented a case where an unauthenticated remote code execution vulnerability in React Server Components (CVE-2025-55182), disclosed December 3, 2025, was weaponized and exploited by numerous independent threat actors within 48 hours. A single compromised server ended up hosting overlapping intrusions: coin miners installed first, followed by various RATs and backdoors, and website defacements warning victims to patch. Access logs showed suspicious POST requests consistent with React2Shell exploitation from over 100 distinct IP addresses in a three-day window, indicating exploitation was widespread rather than limited to this one incident.

Notable tooling recovered included the SNOWLIGHT downloader (previously linked to UNC5174), a Golang-based HISONIC backdoor (linked to UNC6603), and CrossC2, a Linux-compatible Cobalt Strike beacon implementation, all deployed together — suggesting these actors may have been staging infrastructure for follow-on operations rather than acting purely opportunistically. The incident also featured abuse of the open-source tool Global Socket (gsocket), configured to tunnel a bash backdoor over port 53 (normally reserved for DNS) using a pre-shared key file for authentication — an unusual technique not commonly reported by other vendors covering this vulnerability.

This case illustrates the speed at which opportunistic and targeted actors alike weaponize newly disclosed, easily exploitable RCE vulnerabilities, and the risk of multiple overlapping compromises on a single asset. JPCERT/CC recommends that organizations patching CVE-2025-55182 also conduct compromise assessments, since visible symptoms like defacement may mask deeper, more consequential backdoor installations.

title: Global Socket Tunnel over DNS Port
description: Detects process binding to or connecting via port 53 (DNS) with gsocket
  or similar tunneling utilities, used to exfiltrate shells and C2 traffic disguised
  as DNS.
tags:
- attack.command-and-control
- attack.t1572
logsource:
  category: network_connection
  product: windows
detection:
  selection_gsocket:
    Image|endswith:
    - \gsocket.exe
    - \gsocket
    DestinationPort: 53
  selection_process_dns_tunnel:
    DestinationPort: 53
    CommandLine|contains|all:
    - -key
    - '-'
  filter_legitimate_dns:
    Image|endswith:
    - \svchost.exe
    - \dnsmasq.exe
    - \named.exe
  condition: (selection_gsocket) or (selection_process_dns_tunnel and not filter_legitimate_dns)
falsepositives:
- Legitimate DNS proxy tools tunneling over port 53
- Custom administrative tools using port 53 for non-DNS protocols in restricted environments
level: high
id: dfa8912e-3e45-5e3a-ab76-9d0e8700ec6f
status: experimental
author: Vorant

title: Exploitation POST Requests to Known Vulnerable Endpoints
description: Detects HTTP POST requests targeting React Server Components (RSC) endpoints
  or patterns consistent with CVE-2025-55182 RCE exploitation.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
  product: generic
detection:
  selection:
    http_method: POST
    url|contains:
    - /__rsc/
    - /rsc/
    - /_next/rsc
    - react-server-components
  filter_legitimate_app:
    http_method: POST
    url|contains: /api/
    status: 200
  condition: selection and not filter_legitimate_app
falsepositives:
- Legitimate application POST requests to RSC endpoints in development/staging environments
- Automated framework testing against React applications
level: medium
id: b68f5028-d8fb-5ba3-a7c2-ae87977d6d60
status: experimental
author: Vorant

title: Multiple Malware Families Deployed Sequentially on Single Host
description: Detects indicators of multiple distinct malware families (coin miners,
  RATs, backdoors like Cobalt Strike beacons, HISONIC, SNOWLIGHT) being ingested or
  spawned within a short timeframe, typical of post-exploitation staging infrastructure
  compromise.
tags:
- attack.execution
- attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_miner_indicators:
    CommandLine|contains:
    - xmrig
    - monero
    - stratum
    - minergate
  selection_rat_indicators:
    CommandLine|contains:
    - crossc2
    - hisonic
    - snowlight
    - beacon
  selection_bash_backdoor:
    CommandLine|contains:
    - /bin/bash
    - nc -l
    - bash -i >
    ParentImage|contains:
    - gsocket
    - socat
  filter_admin_activity:
    User|contains: SYSTEM
    ParentImage|endswith:
    - \svchost.exe
    - \services.exe
  condition: (selection_miner_indicators or selection_rat_indicators or selection_bash_backdoor)
    and not filter_admin_activity
falsepositives:
- Legitimate cryptocurrency mining operations in authorized environments
- Security research or penetration testing labs executing multiple tool samples
level: high
id: f643f24f-7ef8-5ed7-b635-a12454b3195a
status: experimental
author: Vorant

Source reporting: https://blogs.jpcert.or.jp/en/2026/02/multiple-threat-actors-rapidly-exploit-react2shell-a-case-study-of-active-compromise.html