React2Shell Exploitation Shifts Toward Persistent Access

React2Shell Now Used for Persistent Server Compromise

Published

Written by:

Vishwa Pandagle
Cybersecurity Staff Editor

Summarize with:

Add as preferred source on Google

Key Takeaways

Threat evolution: React2Shell exploitation is shifting from scanning toward persistent access and long-term control.
Advanced tooling: Attackers are deploying EtherRAT with blockchain-based command infrastructure to evade disruption.
High exposure: Government, critical infrastructure, and cloud-hosted enterprises face elevated risk from vulnerable applications.

React2Shell vulnerability exploitation is turning into multiple campaigns. What started as a scanning activity following public disclosure in early December is growing into a vector for persistence and state-aligned threat actors.

Kaspersky recorded several exploitation attempts within a single day using Mirai and Gafgyt malware variants. Patching prevents new exploitation but does not remove existing persistence.

React2Shell Vulnerability Exploitation

CVE-2025-55182 is a remote code execution vulnerability in server-side React frameworks. It impacts the React Server Components Flight protocol used by frameworks such as Next.js. The flaw allows attackers to execute privileged JavaScript on application servers.

Exploitation requires only a single unauthenticated HTTP request. The vulnerability stems from unsafe deserialization in the React Server Components protocol. After attackers send requests that inject malicious logic into server-side execution paths, the server processes the input as trusted code.

This allows attackers to run arbitrary JavaScript with application-level privileges. All this without the need for user interaction, or elevated privileges. Once the malicious code is injected, internet-facing applications get exposed to exploitation.

How the Threat Evolved

Sysdig researchers observed React2Shell being used as an initial access vector and to deploy EtherRAT. EtherRAT is designed for persistence rather than immediate monetization. According to Sysdig, once EtherRAT resolves the C2 URL from the blockchain, it enters a polling loop that executes every 500 milliseconds.

"EtherRAT includes a capability not observed in other React2Shell payloads. On first successful C2 contact, it sends its own source code to a /api/reobf/ endpoint," the Sysdig research added.

Qualys analysis says that EtherRAT complicates defense by deploying customized payloads in each compromised system. This reduces detection by signature-based security tools. Qualys and Sysdig researchers also observed the following:

EtherRAT embeds command instructions inside Ethereum smart contracts.
Infected systems retrieve instructions using public Ethereum RPC endpoints.
This removes reliance on attacker-controlled infrastructure.
Traditional indicators such as domains and IP addresses are reduced.

A researcher also identified an open directory hosting React2Shell exploit tooling. The directory included curated domain and URL target lists. Threat actors are assessed to be actively scanning and infecting selected targets.

How to Reduce Risk

Organizations should patch affected React-based frameworks as fixes addressing the deserialization flaw have been released. Vulnerable Next.js and related framework versions should also be updated.

Repeated Ethereum RPC queries from servers may indicate compromise. Unexpected Node.js process execution should be investigated and internet-facing applications should be reviewed for exposure. Linux persistence mechanisms must be audited.

Risk Posed to Government Agencies

Government agencies running React-based public or internal portals face risk. Critical-infrastructure organizations are exposed through regulatory, administrative and monitoring web applications built on React-based frameworks.

Enterprises operating cloud-hosted React and Next.js applications also remain vulnerable to exploitation with Cloudflare reporting academic institutions and research networks being selectively targeted.

The vulnerability affects web application infrastructure. Any operational technology impact would be indirect, resulting from compromised IT-facing systems rather than direct access to industrial control systems.

Former Cloud Platform Manager Charged for Concealing Noncompliance to Secure Army Sponsorship, Raising Federal Security Risks

Mikord Data Breach: Claims of Russia’s Military Draft Systems Hack Shared via 'Idite Lesom'

DroidLock: Malware Build for Extortion, Device Takeover, and Insider Risk in Spain

DeadLock Ransomware Uses New BYOVD Loader Exploiting Driver Vulnerability to Disable EDR

Global Cybercrime Roundup: Telegram Increases Blocks, Coupang Investigation Reveals More, Spain and the US Arrest Hackers

DOJ Announces Actions Against Alleged Key Member of Russian Cybercriminal Groups NoName057(16) and CARR (Z-Pentest)

Your Weekly Cybersecurity Briefing

Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.

Please enter a valid email address.