North Korean Weaponize React2Shell Vulnerability to Spread EtherRAT

On December 5, 2025, just two days after the public disclosure of the maximum-severity “React2Shell” vulnerability (CVE-2025-55182), the Sysdig Threat Research Team (TRT) uncovered a sophisticated new implant dubbed “EtherRAT” targeting compromised Next.js applications.

Unlike earlier, opportunistic attacks deploying cryptocurrency miners, EtherRAT represents a highly targeted persistent access campaign with significant links to North Korean state-sponsored actors.

CVE-2025-55182 is an unsafe deserialization vulnerability affecting React Server Components (RSCs) in frameworks like Next.js 15.x and 16.x.

It allows unauthenticated remote code execution via a single HTTP request. While initial exploitation involved China-nexus groups (such as Earth Lamia) deploying Cobalt Strike beacons and generic cryptominers, EtherRAT demonstrates a dangerous evolution in tradecraft.

The Sysdig TRT analysis identifies EtherRAT as a four-stage attack chain designed for long-term persistence and evasion.

The attack begins with a base64-encoded shell command that downloads a script, which subsequently pulls a legitimate Node.js runtime directly from nodejs.org.

React2Shell Vulnerability

By using an official, trusted runtime rather than bundling a malicious binary, the attackers significantly reduce the payload size and evade network-based detection.

EtherRAT’s most distinctive feature is its decentralized Command and Control (C2) infrastructure.

Instead of relying on hardcoded IP addresses or domains which can be easily blocked or seized the malware leverages the Ethereum blockchain.

It queries a specific smart contract across nine different public Remote Procedure Call (RPC) endpoints.Each poll constructs a randomized URL designed to blend with legitimate web traffic.

Using a consensus mechanism, the malware accepts the C2 URL returned by the majority of endpoints, making the infrastructure virtually immune to poisoning or traditional takedown efforts.

Once active, EtherRAT establishes persistence through five independent mechanisms, including systemd user services, XDG autostart entries, cron jobs, and shell profile injections.

It also features a unique “re-obfuscation” capability: upon first contact, the malware downloads a new version of itself from the C2 server to overwrite the initial payload, complicating forensic analysis and signature-based detection.

The technical characteristics of EtherRAT strongly suggest attribution to the Democratic People’s Republic of Korea (DPRK).

Security Researchers Warn of Escalating Threat

The use of AES-256-CBC encrypted loaders, specific Node.js runtimes, and blockchain-based C2 aligns closely with the “Contagious Interview” campaigns previously attributed to the Lazarus Group.

However, EtherRAT pivots away from the social engineering lures typical of those campaigns, opting instead for direct exploitation of the React2Shell vulnerability.

“This payload… represents something far more sophisticated,” the Sysdig TRT noted. “It is a persistent access implant that combines techniques from at least three documented campaigns into a single, previously unreported attack chain.”

Security defenders are urged to hunt for outbound connections to Ethereum RPC endpoints, suspicious downloads from nodejs.org in non-standard directories, and hidden files in user local share folders.

As DPRK actors appear to be adopting React2Shell as a primary entry vector, organizations running affected Next.js applications must patch immediately to prevent deep system compromise.

Indicators of compromise 

Ethereum contract (static)

Staging infrastructure

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.