Maximum severity React2Shell flaw exploited by North Korean hackers in malware attacks

• React2Shell (CVE-2025-55182) critical flaw exploited by Chinese and North Korean groups
• North Korea deploys EtherRAT implant with Ethereum C2, Linux persistence and Node.js runtime
• Researchers urge prompt updates to patched React versions 19.0.1, 19.1.2 and 19.2.1

The Chinese are not the only ones exploiting React2Shell, a maximum severity vulnerability recently discovered in React Server Components (RSC).

Reports are coming in detailing North Korean state-sponsored threat actors doing the same. The only difference is that the North Koreans are using the flaw to implement a new persistence mechanism, malware.