In December 2025, multiple threat actors began weaponizing the React2Shell remote code execution (RCE) vulnerability, CVE‑2025‑55182, to compromise internet-facing React Server Components and pivot deep into IT environments.
Their campaigns hit Russian insurance, e‑commerce, and IT companies first, then expanded globally with a mix of cryptomining, DDoS, and high-end espionage tooling.
React2Shell: From Bug To RCE Beachhead
React2Shell is a critical flaw in the Flight protocol used for client–server communication in React Server Components.
The issue arises from insecure deserialization, where the server trusts and processes client data without proper validation, allowing attackers to inject serialized objects that lead to arbitrary code execution under certain conditions.
Once a vulnerable host is identified, attackers can execute system commands inside containers or application environments, using simple one-line shell chains to pull down Bash scripts and ELF payloads from remote servers.
From there, they establish persistence, deploy additional malware, and either monetize the access via cryptomining or use it as an entry point for long-term espionage.
Russian Targets: Botnets, Miners, And Sliver
Campaigns against Russian companies show how quickly attackers industrialized React2Shell exploitation.
In one cluster, after exploiting the vulnerability, threat actors used wget and curl from /tmp to fetch and run an ELF binary named “bot,” later identified as the RustoBot botnet written in Rust and originally focused on TOTOLINK devices.
RustoBot resolved multiple C2 domains that all pointed to a single IP and supported UDP, TCP, and raw IP flood DDoS attacks with configurable targets, durations, and packet sizes, while also embedding the XMRig miner as a secondary payload.
The same access was then used to execute Base64-encoded commands that pulled the apaches.sh installer, which deployed XMRig, set up systemd services and cron jobs, and placed miner files in /usr/local/sbin or /tmp depending on privileges.
Other hosts compromised via React2Shell received the Kaiji botnet and the Sliver C2 implant through chained Bash scripts.
Kaiji added extensive persistence, replaced common utilities such as ls, ps, and netstat with trojanized wrappers, managed its configuration via encrypted files across system directories, and again deployed XMRig.
The Sliver implant was installed in privilege-aware fashion, either as a systemd-managed /usr/bin/sshd-agent with immutable attributes or as a hidden user-level binary launched via crontab and shell profiles, before cleaning logs and shell history.
Global Campaigns: From RMM Abuse To EtherRAT
Outside Russia, attackers using React2Shell showed a more espionage-focused toolkit and tradecraft.
One set of intrusions used a check.sh script to drop CrossC2 payloads for Cobalt Strike, registering them as a persistent “Rsyslo AV Agent Service” that connected back to a dedicated C2 on port 443 with configuration encrypted via AES‑128‑CBC inside the ELF.
Another cluster abused Tactical RMM by downloading Mesh agents from an attacker-controlled server and registering them to a hardcoded MeshCentral instance, effectively turning a legitimate remote management framework into a covert access channel.
A separate Bash loader, slt, fetched architecture-specific loaders for the Go-based VShell backdoor, which pulled an encrypted payload over TCP, decoded it with a XOR key, and executed it from an in-memory file descriptor masquerading as kworker.
The most sophisticated activity involved the EtherRAT JavaScript malware, launched via Node.js binaries downloaded from attacker infrastructure.
A chain of Base64-decoded scripts decrypted an AES‑256‑CBC–protected JS payload into an EtherRAT module that established persistence through systemd, XDG autostart entries, crontab, and shell initialization files.
EtherRAT then fetched its C2 address from an Ethereum smart contract, contacted a backend at 91.215.85[.]42:3000, and retrieved multiple JS modules implementing system reconnaissance, a powerful cross‑platform credential and wallet stealer, automated React2Shell scanning and exploitation, webserver configuration hijacking to redirect traffic to attacker-controlled domains, and SSH key planting for durable access.
Tactics: DNS Tunneling, Web Redirects, And Stealth
Across cases, attackers used lightweight, script-heavy tactics to remain agile and hard to detect.
In some intrusions, reconnaissance commands and file contents were exfiltrated using DNS tunneling, by embedding command output into dynamically generated subdomains queried via nslookup to oastify-controlled domains.
Elsewhere, malicious scripts rewrote nginx and Apache configurations, backing up original files and then forcing all HTTP and HTTPS traffic to redirect to an external domain such as xss[.]pro, while also collecting host and webserver diagnostics for exfiltration to a webhook.
Additional scripts added attacker SSH keys to authorized_keys, killed competing high‑CPU processes to protect mining revenue, and scanned the filesystem and environment variables for infrastructure credentials, access tokens, and secrets linked to cloud platforms and developer tooling.
Mitigation: Patch Fast, Hunt Hard
CVE‑2025‑55182 affects several versions of the react-server-dom-* packages used by React Server Components, including 19.0, 19.1.0, 19.1.1, and 19.2.0. Patches are available in versions 19.0.1, 19.1.2, and 19.2.1, and organizations are urged to upgrade all affected dependencies and ensure that lock files do not retain vulnerable versions.
Next.js projects that rely on React Server Components must likewise be upgraded to releases bundling the fixed React packages and reviewed for any use of experimental RSC features in production.
Given the breadth of post‑exploitation activity, defenders should not stop at patching: they need to hunt for indicators tied to these campaigns, including specific bash script names, systemd services, webserver config rewrites, unusual DNS queries, and outbound traffic to the identified C2 infrastructure.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
%20vulnerability,%20CVE%E2%80%912025%E2%80%9155182,%20to){kind=link}