Hackers Launched 8.1 Million Attack Sessions to React2Shell Vulnerability
The React2Shell vulnerability, identified as CVE-2025-55182 , is subject to ongoing exploitation, with over 8.1 million attack sessions recorded since its discovery.
The React2Shell vulnerability, identified as CVE-2025-55182 , is subject to ongoing exploitation, with over 8.1 million attack sessions recorded since its discovery.
Data from the GreyNoise Observation Grid shows daily attack volumes have stabilized between 300,000 and 400,000 sessions, following a peak of over 430,000 in late December. This indicates a sustained exploitation effort.
The infrastructure for the campaign is extensive, with 8,163 unique source IP addresses identified across 1,071 autonomous systems (ASNs) in 101 countries. This highlights the vulnerability's widespread appeal among various threat actors. Amazon Web Services (AWS) and other major cloud providers are notably involved, with AWS accounting for over a third of the exploitation traffic. The top 15 ASNs represent approximately 60% of all source IPs. Attackers have developed over 70,000 unique payloads, indicating ongoing experimentation.
Network analysis reveals 700 distinct JA4H hashes and 340 unique JA4T hashes, suggesting varied tooling and delivery mechanisms.
The infrastructure for the campaign is extensive, with 8,163 unique source IP addresses identified across 1,071 autonomous systems (ASNs) in 101 countries.
The exploitation strategy typically involves a two-stage process. Initial reconnaissance checks command execution via simple PowerShell arithmetic before delivering an encoded payload. The second stage involves AMSI bypass techniques to execute additional malicious scripts while avoiding antivirus detection.
Organizations using unpatched systems remain vulnerable, with nearly 50% of source IPs appearing after July 2025, indicating recent infrastructure changes and IP rotation. Static IP blocklists are inadequate for this campaign's scale; dynamic blocking through GreyNoise’s threat intelligence feeds is recommended. Endpoint monitoring should focus on detecting PowerShell execution, encoded commands, and AMSI modifications.
Organizations managing exposed React Server Components should consider this an active threat requiring immediate patching and network-level defenses.
Based on reporting by Cyber Security News.