North Korean Hackers Exploit React2Shell Vulnerability in the Wild to Deploy EtherRAT

Cybersecurity: React2Shell Vulnerability Exploitation

A recent discovery has highlighted a sophisticated malware strain targeting vulnerable React Server Components. This development marks a significant evolution in the exploitation of the React2Shell vulnerability, disclosed shortly before.

On December 5, 2025, the maximum-severity vulnerability CVE-2025-55182 was leveraged by threat actors through a new implant, EtherRAT, in compromised Next.js applications. This tool is linked to North Korean actors, utilizing Ethereum smart contracts for a resilient command-and-control (C2) infrastructure.

Exploitation of React2Shell (CVE-2025-55182)

The entry point for this campaign is CVE-2025-55182, an unsafe deserialization flaw in React Server Components that allows unauthenticated remote code execution through a single HTTP request. Affected software includes React 19.x and Next.js versions 15.x/16.x using the App Router. Following its disclosure on December 3, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added it to the Known Exploited Vulnerabilities (KEV) catalog .

The EtherRAT campaign marks a shift from previous attacks, focusing on long-term stealth and persistence rather than immediate destruction or mining activities.

Vulnerability CVE-2025-55182 (React2Shell)

Type Unsafe Deserialization / Remote Code Execution

Severity Critical (Maximum Severity)

Affected Software React 19.x, Next.js 15.x/16.x (App Router)

Disclosure Date December 3, 2025

Active Exploits Cobalt Strike (China-nexus), EtherRAT (DPRK-nexus), XMRig

EtherRAT: A Masterclass in Blockchain Stealth

EtherRAT uses a unique "consensus" C2 mechanism, querying an Ethereum smart contract for its command server URL instead of relying on a hardcoded server IP. To prevent tampering, it queries nine public Remote Procedure Call (RPC) endpoints and accepts the C2 URL returned by the majority.

This technique, known as "EtherHiding," renders traditional IP-based blocking ineffective. The malware disguises its C2 polling traffic as requests for static assets, blending seamlessly with normal web traffic.

To avoid detection, EtherRAT does not bundle its own runtime. Instead, it downloads a legitimate Node.js runtime, ensuring a stable execution environment without introducing suspicious binaries.

Analysis by Sysdig TRT reveals significant code overlaps between EtherRAT and the "Contagious Interview" campaign, linked to DPRK-affiliated groups. Shared characteristics include:

Shared Encryption: Both use AES-256-CBC-encrypted loaders. Infrastructure: Utilization of blockchain-based C2 techniques. Targeting: Shift from fake job offers to exploiting server-side vulnerabilities.

EtherRAT is more advanced than typical "Contagious Interview" payloads, featuring five redundant persistence mechanisms.

Mitigation and Indicators of Compromise

Organizations using Next.js or React Server Components should update to version 19.2.1 or later. Key indicators of compromise include outbound traffic to Ethereum RPC nodes from web servers.

Indicator Type Value / Pattern

Staging Server 193.24.123[.]68:3001 (Malicious Shell Script Source)

Smart Contract 0x22f96d61cf118efabc7c5bf3384734fad2f6ead4

Network Traffic Rapid POST requests to multiple Ethereum RPCs (e.g., eth.llamarpc[.]com )

File Artifacts Hidden directories in $HOME/.local/share/ with random hex names

Process Node.js processes spawning from hidden directories

The combination of zero-day exploitation and blockchain infrastructure makes EtherRAT a significant threat. Security teams should focus on detecting unusual RPC traffic patterns and persistence mechanisms rather than relying solely on static file signatures.

Based on reporting by Cyber Security News.