“Google Alerts: Hacker Groups Targeting React2Shell to Distribute Malware”

The Google Threat Intelligence Group (GTIG) has released an alert concerning the extensive exploitation of a significant security vulnerability in React Server Components.

Identified as React2Shell (CVE-2025-55182), this weakness permits attackers to remotely seize control of servers without requiring any passwords.

Since the announcement of the vulnerability on December 3, 2025, Google has detected numerous separate hacker groups taking advantage of the flaw.

The attackers encompass a spectrum from state-sponsored espionage entities to cybercriminals pursuing financial rewards.

Threat Actors and Malware Campaigns

Google investigators have discovered several campaigns aimed at unpatched systems. Important findings comprise:

• China-Linked Espionage: Groups associated with China are utilizing React2Shell to implement backdoors and covert tools. One group, UNC6600, installs the MINOCAT tunneler to retain concealed access to victim networks. Another faction, UNC6603, employs an updated variant of the HISONIC backdoor, which conceals its traffic through communication with legitimate services like Cloudflare.
• Financial Cybercrime: Opportunistic attackers are exploiting the vulnerability to deploy cryptocurrency miners. In a specific instance, criminals implemented XMRig to generate digital currency utilizing the processing power of the victim’s servers.
• Additional Risks: Other discovered malware includes the SNOWLIGHT downloader and the COMPOOD backdoor, both used for data theft or to load further malicious software.

React2Shell has been assigned a maximum severity rating of 10.0 (CVSS v3). It influences certain versions of React and Next.js, widely-used frameworks for constructing modern websites. Due to the popularity of these tools, many organizations remain vulnerable.

Google cautions that legitimate exploit code is now publicly accessible, simplifying the process for attackers to engage.

While some initial exploit tools were either fake or defective, practical methods—such as tools capable of installing web shells directly into memory—are now in circulation.

Security professionals urge administrators to immediately patch affected systems. Organizations utilizing Next.js or React Server Components should confirm they are operating secure versions to avert unauthorized access.

IoC