Cisco Talos Reports UAT-10608 Used React2Shell to Compromise 766 Next.js Hosts
Summary
Cisco Talos attributes a credential-harvesting campaign to UAT-10608, reporting exploitation of CVE-2025-55182 against at least 766 Next.js hosts and theft of credentials and other secrets.
Key points
- Cisco Talos attributes the campaign to threat cluster UAT-10608.
- The campaign reportedly exploits CVE-2025-55182 in React Server Components and Next.js App Router for initial remote code execution.
- Talos reports at least 766 compromised hosts across multiple regions and cloud providers.
- A multi-phase harvester reportedly collected environment variables, SSH keys, shell history, Kubernetes tokens, Docker configurations, API keys, and cloud credentials.
- The NEXUS Listener framework provides operators with a searchable interface and statistics on stolen credentials and compromised hosts.
- Talos observed data including Stripe API keys, GitHub and GitLab tokens, database connection strings, and cloud credentials.
- Recommended defenses include least privilege, secret scanning, IMDSv2 enforcement on AWS EC2, avoiding SSH key reuse, and rotating credentials if compromise is suspected.
Article Details
- Event Type
- Credential-harvesting campaign exploiting CVE-2025-55182 in Next.js for remote code execution and credential theft.
- Impact
- Cisco Talos reported at least 766 compromised hosts across multiple regions and cloud providers. The operation collected and exfiltrated credentials and secrets, including SSH keys, cloud IAM tokens, API keys, and database credentials, creating potential for follow-on attacks.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelHarvested credentials were reportedly exfiltrated to the operators' command-and-control infrastructure.T1119 · Automated CollectionThe campaign used automated scripts to collect credentials and other information from compromised systems.T1190 · Exploit Public-Facing ApplicationUAT-10608 reportedly exploited the vulnerability in publicly reachable Next.js deployments to gain initial access.T1552 · Unsecured CredentialsThe campaign harvested unsecured credentials and secrets, including SSH keys, environment variables, tokens, and API keys.
CVE
People
Asheer MalhotraCisco Talos security researcher who, with Brandon White, reported on the campaign and described its credential extraction and command-and-control activity.Brandon WhiteCisco Talos security researcher who, with Asheer Malhotra, reported on the campaign and described its credential extraction and command-and-control activity.