Maximum Severity React2Shell Flaw Exploited by North Korean Hackers in Malware Attacks

• React2Shell (CVE-2025-55182) critical flaw exploited by Chinese and North Korean groups
• North Korea deploys EtherRAT implant with Ethereum C2, Linux persistence and Node.js runtime
• Researchers call for urgent updates to patched React versions 19.0.1, 19.1.2 and 19.2.1

The Chinese are not the only ones exploiting React2Shell, a maximum severity vulnerability recently discovered in React Server Components (RSC).

Reports are coming in detailing North Korean state-sponsored threat actors doing the same. The only difference is that the North Koreans are using this flaw to deploy new malware with a persistence mechanism.