React2Shell continues to witness heavy exploitation, with menace actors leveraging the maximum-severity safety flaw in React Server Parts (RSC) to ship cryptocurrency miners and an array of beforehand undocumented malware households, in line with new findings from Huntress.
This features a Linux backdoor referred to as PeerBlight, a reverse proxy tunnel named CowTunnel, and a Go-based post-exploitation implant known as ZinFoq.
The cybersecurity firm stated it has noticed attackers concentrating on quite a few organizations through CVE-2025-55182, a essential safety vulnerability in RSC that permits unauthenticated distant code execution. As of December 8, 2025, these efforts have been geared toward a variety of sectors, however prominently the development and leisure industries.
The primary recorded exploitation try on a Home windows endpoint by Huntress dates again to December 4, 2025, when an unknown menace actor exploited a susceptible occasion of Subsequent.js to drop a shell script, adopted by instructions to drop a cryptocurrency miner and a Linux backdoor.
In two different instances, attackers had been noticed launching discovery instructions and making an attempt to obtain a number of payloads from a command-and-control (C2) server. A few of the notable intrusions additionally singled out Linux hosts to drop the XMRig cryptocurrency miner, to not point out leveraged a publicly obtainable GitHub software to determine susceptible Subsequent.js situations earlier than commencing the assault.
“Based mostly on the constant sample noticed throughout a number of endpoints, together with an identical vulnerability probes, shell code checks, and C2 infrastructure, we assess that the menace actor is probably going leveraging automated exploitation tooling,” Huntress researchers stated. “That is additional supported by the makes an attempt to deploy Linux-specific payloads on Home windows endpoints, indicating the automation doesn’t differentiate between goal working programs.”
A quick description of a few of the payloads downloaded in these assaults is as follows –
- intercourse.sh, a bash script that retrieves XMRig 6.24.0 immediately from GitHub
- PeerBlight, a Linux backdoor that shares some code overlaps with two malware households RotaJakiro and Pink that got here to mild in 2021, installs a systemd service to make sure persistence, and masquerades as a “ksoftirqd” daemon course of to evade detection
- CowTunnel, a reverse proxy that initiates an outbound connection to attacker-controlled Quick Reverse Proxy (FRP) servers, successfully bypassing firewalls which can be configured to solely monitor inbound connections
- ZinFoq, a Linux ELF binary that implements a post-exploitation framework with interactive shell, file operations, community pivoting, and timestomping capabilities
- d5.sh, a dropper script liable for deploying the Sliver C2 framework
- fn22.sh, a “d5.sh” variant with an added self-update mechanism to fetch a brand new model of the malware and restart it
- wocaosinm.sh, a variant of the Kaiji DDoS malware that includes distant administration, persistence, and evasion capabilities
PeerBlight helps capabilities to ascertain communications with a hard-coded C2 server (“185.247.224[.]41:8443”), permitting it to add/obtain/delete information, spawn a reverse shell, modify file permissions, run arbitrary binaries, and replace itself. The backdoor additionally makes use of a site technology algorithm (DGA) and BitTorrent Distributed Hash Desk (DHT) community as fallback C2 mechanisms.
“Upon becoming a member of the DHT community, the backdoor registers itself with a node ID starting with the hardcoded prefix LOLlolLOL,” the researchers defined. “This 9-byte prefix serves as an identifier for the botnet, with the remaining 11 bytes of the 20-byte DHT node ID randomized.”
“When the backdoor receives DHT responses containing node lists, it scans for different nodes whose IDs begin with LOLlolLOL. When it finds an identical node, it is aware of that is both one other contaminated machine or an attacker-controlled node that may present C2 configuration.”
Huntress stated it recognized over 60 distinctive nodes with the LOLlolLOL prefix, including that a number of situations need to be met to ensure that an contaminated bot to share its C2 configuration with one other node: a sound shopper model, configuration availability on the responding bot’s facet, and the proper transaction ID.
Even when all the required situations are happy, the bots are designed such that they solely share the configuration about one-third of the time primarily based on a random test, presumably in a bid to cut back community noise and keep away from detection.
ZinFoq, in an identical method, beacons out to its C2 server and is supplied to parse incoming directions to run instructions utilizing utilizing “/bin/bash,” enumerate directories, learn or delete information, obtain extra payloads from a specified URL, exfiltrate information and system info, begin/cease SOCKS5 proxy, allow/disable TCP port forwarding, alter file entry and modification instances, and set up a reverse pseudo terminal (PTY) shell connection.
ZinFoq additionally takes steps to clear bash historical past and disguises itself as considered one of 44 reliable Linux system providers (e.g., “/sbin/audispd,” “/usr/sbin/ModemManager,” “/usr/libexec/colord,” or “/usr/sbin/cron -f”) to hide its presence.
Organizations counting on react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack are suggested to replace instantly, given the “potential ease of exploitation and the severity of the vulnerability,” Huntress stated.
The event comes because the Shadowserver Basis stated it detected over 165,000 IP addresses and 644,000 domains with susceptible code as of December 8, 2025, after “scan concentrating on enhancements.” Greater than 99,200 situations are situated within the U.S., adopted by Germany (14,100), France (6,400), and India (4,500).
