North Korean Weaponize React2Shell Vulnerability to Spread EtherRAT

On December 5, 2025, just two days after the public disclosure of the maximum-severity “React2Shell” vulnerability (CVE-2025-55182), the Sysdig Threat Research Team (TRT) uncovered a sophisticated new implant dubbed “EtherRAT” targeting compromised Next.js applications.

Unlike earlier, opportunistic attacks deploying cryptocurrency miners, EtherRAT represents a highly targeted persistent access campaign with significant links to North Korean state-sponsored actors.

CVE-2025-55182 is an unsafe deserialization vulnerability affecting React Server Components (RSCs) in frameworks like Next.js 15.x and 16.x.

It allows unauthenticated remote code execution via a single HTTP request. While initial exploitation involved China-nexus groups (such as Earth Lamia) deploying Cobalt Strike beacons and generic cryptominers, EtherRAT demonstrates a dangerous evolution in tradecraft.

The Sysdig TRT analysis identifies EtherRAT as a four-stage attack chain designed for long-term persistence and evasion.

The attack begins with a base64-encoded shell command that downloads a script, which subsequently pulls a legitimate Node.js runtime directly from nodejs.org.

React2Shell Vulnerability

By using an official, trusted runtime rather than bundling a malicious binary, the attackers significantly reduce the payload size and evade network-based detection.

Stage	Purpose	Key Capability
Stage 0	Initial Access	Download and execute shell script; retry loop with curl/wget/python3 fallback
Stage 1	Deployment	Download Node.js; write payloads; use legitimate runtime from nodejs.org
Stage 2	Dropper	Decrypt and execute main payload; AES-256-CBC decryption
Stage 3	Implant	Persistent backdoor access; Blockchain C2; 5x persistence; payload update

EtherRAT’s most distinctive feature is its decentralized Command and Control (C2) infrastructure.

Instead of relying on hardcoded IP addresses or domains which can be easily blocked or seized the malware leverages the Ethereum blockchain.

It queries a specific smart contract across nine different public Remote Procedure Call (RPC) endpoints.Each poll constructs a randomized URL designed to blend with legitimate web traffic.

Using a consensus mechanism, the malware accepts the C2 URL returned by the majority of endpoints, making the infrastructure virtually immune to poisoning or traditional takedown efforts.

Once active, EtherRAT establishes persistence through five independent mechanisms, including systemd user services, XDG autostart entries, cron jobs, and shell profile injections.

It also features a unique “re-obfuscation” capability: upon first contact, the malware downloads a new version of itself from the C2 server to overwrite the initial payload, complicating forensic analysis and signature-based detection.

The technical characteristics of EtherRAT strongly suggest attribution to the Democratic People’s Republic of Korea (DPRK).

Security Researchers Warn of Escalating Threat

The use of AES-256-CBC encrypted loaders, specific Node.js runtimes, and blockchain-based C2 aligns closely with the “Contagious Interview” campaigns previously attributed to the Lazarus Group.

However, EtherRAT pivots away from the social engineering lures typical of those campaigns, opting instead for direct exploitation of the React2Shell vulnerability.

“This payload… represents something far more sophisticated,” the Sysdig TRT noted. “It is a persistent access implant that combines techniques from at least three documented campaigns into a single, previously unreported attack chain.”

Security defenders are urged to hunt for outbound connections to Ethereum RPC endpoints, suspicious downloads from nodejs.org in non-standard directories, and hidden files in user local share folders.

As DPRK actors appear to be adopting React2Shell as a primary entry vector, organizations running affected Next.js applications must patch immediately to prevent deep system compromise.

Indicators of compromise

Ethereum contract (static)

Type	Value
Contract Address	0x22f96d61cf118efabc7c5bf3384734fad2f6ead4
Lookup Parameter	0xE941A9b283006F5163EE6B01c1f23AA5951c4C8D
Function Selector	0x7d434425

Staging infrastructure

Type	Value
Staging Server	193.24.123.68:3001
Payload URL	http://193.24.123.68:3001/gfdsgsdfhfsd_ghsfdgsfdgsdfg.sh

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.