InfoSecBulletin Cybersecurity for mankind
A financially motivated ransomware gang exploited React2Shell vulnerability (CVE-2025-55182) to quickly access corporate networks and deploy malware less than a minute later.
React2Shell (CVE-2025-55182) is a maximum severity vulnerability in React Server Components (RSC) which was publicly disclosed on 3 December 2025. The vulnerability impacts the Flight Protocol, a core feature of the React web development library and the open-source framework Next.js, which is used to speed up web application rendering.
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Researchers at S-RM noted the use of React2Shell in an attack on December 5, where a threat actor deployed the Weaxor ransomware.
Weaxor ransomware attack:
Weaxor ransomware emerged in late 2024 and is thought to be a rebrand of the Mallox/FARGO operation, also known as ‘TargetCompany’, which targeted MS-SQL servers.
Weaxor, similar to Mallox, is a basic operation that attacks public servers with opportunistic demands for low ransoms.
S-RM researchers indicate that the threat actor used the encryptor soon after gaining access via React2Shell. This implies an automated attack, but there’s no evidence in the compromised environment to back this up.
Immediately after the breach, the hackers executed an obfuscated PowerShell command that deployed a Cobalt Strike beacon for command and control (C2) communication.
The attacker quickly disabled Windows Defender’s real-time protection and launched the ransomware, all within a minute of gaining access.
The researchers found that the attack was restricted to one vulnerable endpoint, with no signs of lateral movement.
After encryption, the files had the ‘.WEAX’ extension, and every impacted directory had a ransom note file named ‘RECOVERY INFORMATION.txt’, which contained payment instructions from the attacker.
S-RM reported that Weaxor deleted volume shadow copies to hinder restoration and erased event logs to complicate forensic analysis.
The researchers noted that the same host was also attacked by other hackers with different methods, highlighting the extent of malicious activity related to React2Shell.
S-RM recommends that system administrators check Windows event logs and EDR telemetry for signs of process creation from Node or React binaries, as patching by itself is insufficient.
Process spawning of cmd.exe or powershell.exe from node.exe is a strong indicator of React2Shell exploitation Unusual outbound connections, disabled security solutions, log clearing, and resource spikes should also be thoroughly investigated.
