ZnDoor Malware Exploiting React2Shell Vulnerability to Compromise Network Devices

As of December 2025, a critical vulnerability in React/Next.js applications, identified as CVE-2025-55182 and known as React2Shell, has been increasingly exploited across Japanese organizations.

This vulnerability facilitates remote code execution and has initially been used to deploy cryptocurrency miners . However, security researchers have identified a more advanced threat targeting network infrastructure with a malware known as ZnDoor.

ZnDoor, a remote access trojan, exhibits complex functionalities that surpass simple mining operations. Evidence suggests its activity dates back to at least December 2023, indicating a strategic deployment in targeted environments.

The malware's architecture suggests deliberate development aimed at compromising network devices, posing a significant risk to enterprise security teams.

NTT Security analysts have identified ZnDoor through comprehensive forensic analysis of affected systems.

Infection Mechanism and Command and Control Operations

The infection process begins with exploiting the React2Shell vulnerability to execute a shell command. This command downloads and runs ZnDoor from external servers located at 45.76.155.14.

The malware then communicates with its command and control server at api.qtss.cc:443. Configuration details, including the C2 address and port, are encrypted using AES-CBC encryption after Base64 decoding, safeguarding its communication infrastructure.

ZnDoor functions as a fully equipped remote access trojan with extensive system control capabilities. It continuously communicates with its C2 server, transmitting system information such as network addresses, hostname, username, and process identifiers via HTTP POST requests.

This ongoing communication allows attackers to execute commands for file operations, shell execution, system enumeration, and SOCKS5 proxy activation.

The command structure uses double-hash delimiters to parse instructions, enabling operations like interactive shell spawning, directory listing, file manipulation, and network tunneling .

ZnDoor employs multiple evasion techniques, such as process name spoofing to mimic legitimate system processes, complicating detection through standard monitoring methods.

Additionally, it alters file timestamps to January 15, 2016, to avoid forensic investigations. The malware also implements self-restart mechanisms using child processes, further hindering analysis efforts. These evasion tactics underscore the advanced nature of this threat, emphasizing the need for behavioral monitoring.

Based on reporting by Cyber Security News.