InfoSecBulletin Cybersecurity for mankind
A financially motivated ransomware gang exploited React2Shell vulnerability (CVE-2025-55182) to quickly access corporate networks and deploy malware less than a minute later.
React2Shell (CVE-2025-55182) is a maximum severity vulnerability in React Server Components (RSC) which was publicly disclosed on 3 December 2025. The vulnerability impacts the Flight Protocol, a core feature of the React web development library and the open-source framework Next.js, which is used to speed up web application rendering.
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
“PentesterFlow” AI Automation Tool for Penetration Testers and Bug Hunters
Jailbreak works against AI Models GPT-5.6, Claude Opus 5, and Fable, Claims Researcher
Researchers found security flaws in every script generated by ChatGPT, Copilot, and Gemini
Australian Energy Giant Origin confirms unauthorized access and disclosure of customer data
Anthropic Unveils Claude Security Plugin for Code Flaw Scanning
Apple, ASUS Router, Meta, Windmill & Ubuntu Patch Critical Security Flaws
Researchers at S-RM noted the use of React2Shell in an attack on December 5, where a threat actor deployed the Weaxor ransomware.
Weaxor ransomware attack:
Weaxor ransomware emerged in late 2024 and is thought to be a rebrand of the Mallox/FARGO operation, also known as ‘TargetCompany’, which targeted MS-SQL servers.
Weaxor, similar to Mallox, is a basic operation that attacks public servers with opportunistic demands for low ransoms.
S-RM researchers indicate that the threat actor used the encryptor soon after gaining access via React2Shell. This implies an automated attack, but there’s no evidence in the compromised environment to back this up.
Immediately after the breach, the hackers executed an obfuscated PowerShell command that deployed a Cobalt Strike beacon for command and control (C2) communication.
The attacker quickly disabled Windows Defender’s real-time protection and launched the ransomware, all within a minute of gaining access.
The researchers found that the attack was restricted to one vulnerable endpoint, with no signs of lateral movement.
After encryption, the files had the ‘.WEAX’ extension, and every impacted directory had a ransom note file named ‘RECOVERY INFORMATION.txt’, which contained payment instructions from the attacker.
S-RM reported that Weaxor deleted volume shadow copies to hinder restoration and erased event logs to complicate forensic analysis.
The researchers noted that the same host was also attacked by other hackers with different methods, highlighting the extent of malicious activity related to React2Shell.
S-RM recommends that system administrators check Windows event logs and EDR telemetry for signs of process creation from Node or React binaries, as patching by itself is insufficient.
Process spawning of cmd.exe or powershell.exe from node.exe is a strong indicator of React2Shell exploitation Unusual outbound connections, disabled security solutions, log clearing, and resource spikes should also be thoroughly investigated.
