Critical React2Shell Exploit (CVE-2025-55182) Drives Large-Scale Attack Campaign A newly disclosed critical vulnerability, React2Shell (CVE-2025-55182), enables pre-authentication remote code execution (RCE) in React Server Components, affecting multiple versions within the React 19 ecosystem. The flaw stems from improper parsing of server-side component payloads, allowing attackers to exploit it via crafted network requests. The WXA Internet Abuse Signal Collective (WXA IASC) has launched To Cache A Predator, a threat research series tracking attacker infrastructure and tactics tied to the exploit. Initial findings reveal rapid weaponization following the vulnerability’s public disclosure in early December 2025, with persistent scanning targeting Next.js paths, particularly `/_next/server` and `/_next/static/*`. Early Exploitation & Attack Infrastructure WXA IASC’s Niihama honeypots detected exploitation attempts within 20 hours of disclosure, capturing exploit mechanics and attacker behavior. Scanning activity persisted through early February 2026, with two Netherlands-hosted IPs 193.142.147[.]209 and 87.121.84[.]24 accounting for 56% of observed React2Shell traffic between January 26 and February 2, 2026. GreyNoise data corroborated this, recording 1.4 million exploitation attempts during that period, with the two IPs responsible for 799,826 sessions (56%). The ILOVEPOOP Toolkit WXA IASC attributes much of the high-fidelity exploitation to a novel toolkit dubbed "ILOVEPOOP", operated by a single threat actor across nine scanner nodes. The toolkit is identifiable by distinct headers: - `Next-Action: x` - `X-Nextjs-Request-Id: poop1234` - `X-Nextjs-Html-Request-Id: ilovepoop_*` - A repeatable six-path Next.js sweep and a shared User-Agent rotation. Niihama also observed follow-on attacks (SMB, RDP, SSH, HTTP, and credential abuse) from IPs linked to the same infrastructure, suggesting reconnaissance rather than confirmed breaches. Defensive Measures Organizations are advised to patch affected React/Next.js deployments and monitor logs for suspicious patterns, including Server Actions–like POST requests and the ILOVEPOOP canary headers. Defenders should prioritize exposure reduction and least-privilege access for internet-facing systems.

DPRK-Linked Threat Actors Exploit React2Shell Flaw in Large-Scale Crypto Heists Suspected North Korea-linked threat actors have launched a sophisticated campaign targeting cryptocurrency firms, leveraging a critical vulnerability in React Server Components and Next.js to steal digital assets and sensitive infrastructure data. The attacks, which span web-app exploitation, cloud abuse, and secrets theft, follow a full kill chain from initial access to deep reconnaissance and exfiltration. The campaign exploits CVE-2025-55182 (React2Shell), an unauthenticated remote code execution flaw with a CVSS score of 10.0, allowing attackers to execute arbitrary commands on vulnerable servers. Threat actors used mass-scanning tools and WAF-bypass techniques to identify exposed crypto staking platforms, particularly those handling USDT staking. In one case, investigators recovered compromised backend source code containing Tron wallet addresses, private keys, and a Python script reusing those keys for balance checks. Blockchain records suggest at least one suspicious TRX transfer coincided with active exploitation, though direct attribution remains unconfirmed. Beyond web exploitation, the same threat group abused AWS access tokens to infiltrate a separate crypto exchange. After validating credentials via AWS Security Token Service (STS), they systematically enumerated core cloud services S3, RDS, EC2, Lambda, EKS, and IAM searching for high-value artifacts like kubeconfig files, Terraform state files, and hardcoded credentials. Terraform files were filtered for terms such as "password," "db_name," and "public_ip," providing a detailed blueprint of the victim’s infrastructure. The attackers then pivoted to Kubernetes, using `aws eks update-kubeconfig` to gain access to managed EKS clusters. They listed pods across namespaces, pulled sensitive Docker images from private ECR registries, and exfiltrated at least five proprietary exchange images containing hardcoded credentials and internal routing details. Additional secrets were extracted from AWS Secrets Manager, Kubernetes ConfigMaps, and running containers, while private Git repositories were cloned for full backend visibility. Command-and-control (C2) infrastructure relied on a licensed VShell server (port 8082) and Fast Reverse Proxy (FRP) on port 53, a tactic consistent with DPRK-linked operations known for covert tunneling. Core attack servers were hosted on a South Korean VPS (64.176.226[.]36, 2401:c080:1c01:c6:5400:5ff:fec1:ccc9) under the domain itemnania[.]com, with SSH activity and VPN exit nodes used to obscure origins. Victimology suggests a crypto supply-chain focus, targeting staking platforms, exchange software vendors, and exchanges themselves. Rather than immediate mass theft, the campaign prioritized backend source code, database credentials, private keys, and exchange middleware likely positioning for future large-scale asset theft. While DPRK attribution is assessed with moderate confidence, researchers note that tools like VShell are also used by other nation-state actors. The campaign aligns with North Korea’s documented history of React2Shell exploitation, AWS token abuse in crypto heists, and FRP infrastructure reuse.