ZnDoor Malware Actively Exploits React2Shell to Breach Network Infrastructure

As of December 2025, security operations centers have detected an escalating threat targeting Japanese enterprises through the exploitation of React2Shell (CVE-2025-55182), a critical remote code execution vulnerability affecting React and Next.js applications.

Initial attacks primarily involved the deployment of cryptocurrency miners. However, researchers have identified a more dangerous payload: a previously unknown malware family named ZnDoor.

Evidence indicates that this threat has been active since at least December 2023 and is linked to network device compromises across multiple sectors. ZnDoor functions as a sophisticated Remote Access Trojan (RAT), capable of comprehensive system control and lateral movement.

The malware employs advanced evasion techniques designed to bypass detection mechanisms, forensic analysis, and traditional endpoint security solutions.

The discovery of ZnDoor's active deployment in Japan signifies a significant escalation in the threat landscape targeting infrastructure and business-critical systems.

The attack sequence begins with the exploitation of the React2Shell vulnerability, which has seen public proof-of-concept code released, enabling widespread victimization of exposed web services.

Initial compromise triggers command execution that downloads and executes ZnDoor from attacker-controlled infrastructure. Once established, the malware persistently communicates with command-and-control (C2) servers hosted on the same infrastructure used for ZnDoor distribution.

Configuration data embedded within ZnDoor samples is encrypted using AES-CBC encryption following Base64 encoding. Analysis revealed hardcoded C2 infrastructure, including the domain api.qtss[.]cc communicating over port 443.

The malware constructs C2 URLs using a consistent pattern incorporating parameters such as "source=redhat" and version identifiers, suggesting potential attempts to masquerade as legitimate traffic.

ZnDoor implements continuous communication with its C2 infrastructure, transmitting system reconnaissance data encoded as JSON payloads approximately once per second. Each beacon includes critical device information: local IP addresses, MD5-hashed user identifiers, hostnames, usernames, operating system details, and available port forwarding capabilities.

The malware spoofs legitimate Safari user-agent strings to conceal its communications within standard web traffic patterns.

The RAT functionality provides operators with comprehensive system control through a documented command set that includes shell execution, interactive terminal access, directory enumeration, file operations, and SOCKS5 proxy instantiation.

File timestamp manipulation allows operators to modify forensic indicators, while port forwarding capabilities facilitate lateral movement through compromised networks.

ZnDoor employs multiple sophisticated evasion techniques to prevent detection and removal. Process name spoofing masks the malware's presence within process listings, while automatic timestamp modification sets file metadata to January 15, 2016—a technique designed to evade temporal-based security controls and forensic analysis.

The convergence of a publicly exploitable React2Shell vulnerability and ZnDoor's sophisticated capabilities creates substantial risk for affected enterprises.

The malware implements self-restart mechanisms through child process execution, complicating PID-based termination efforts and hindering sandbox-based dynamic analysis. These layered evasion capabilities substantially impede traditional security response procedures and complicate incident investigation timelines.

Organizations cannot easily identify compromised processes through conventional monitoring, and the antivirus evasion techniques reduce detection effectiveness. Continued vigilance and monitoring for suspicious React/Next.js application behavior remain essential for organizations operating affected frameworks.

Immediate patching of React2Shell vulnerabilities and comprehensive endpoint monitoring for indicators of ZnDoor activity are recommended protective measures.

Based on reporting by GBHackers.