Huntress Details React2Shell Exploitation and Linux Malware
Summary
Huntress reports observing React2Shell exploitation across customer organizations, with attackers attempting to deploy miners and several Linux malware families. It details the malware’s capabilities and recommends patching CVE-2025-55182.
Key points
- Huntress says it observed exploitation of CVE-2025-55182, an unauthenticated RCE in React Server Components, across multiple customer organizations.
- Observed post-exploitation activity included cryptominers, PeerBlight, CowTunnel, ZinFoq, a Sliver payload, and a Kaiji botnet variant.
- PeerBlight uses BitTorrent DHT as a fallback C2 mechanism; Huntress extracted a signed configuration with an updated C2 address.
- CowTunnel provides reverse-proxy access through FRP servers, while ZinFoq supports shells, file operations, SOCKS5 pivoting, and anti-forensics.
- Huntress assessed that repeated probes and payload attempts suggest automated exploitation; one observed scanner User-Agent matched Assetnote’s react2shell-scanner.
- React lists fixes for affected React Server Components packages in versions 19.0.1, 19.1.2, and 19.2.1; Huntress recommends immediate patching.
Article Details
- Attack Vectors
- Unauthenticated attackers exploited insecure deserialization in React Server Components through crafted HTTP requests to vulnerable Next.js applications.
- Post-exploitation commands downloaded shell scripts and Linux binaries using curl or wget. Huntress observed Linux-specific payload delivery attempts against Windows endpoints as well as successful deployment on Linux.
- A base64-encoded bash script deployed a cryptocurrency miner and established privilege-dependent persistence.
- Backdoors and reverse tunnels provided interactive shells, file transfer, SOCKS5 proxying, and access to internal services.
- One dropper attempted passwordless escalation through su - root before falling back to user-level persistence.
- Defensive Notes
- Immediately update affected react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages. The article lists affected versions 19.0, 19.1.0, 19.1.1, and 19.2.0, with fixes in 19.0.1, 19.1.2, and 19.2.1.
- For Next.js applications, the article recommends Vercel's fix-react2shell utility, invoked with npx fix-react2shell-next, to check vulnerability status and update affected installations.
- Inspect systemd services, Upstart configurations, crontab entries, and .bashrc modifications for unauthorized persistence.
- Do not rely on process names alone: analyzed implants overwrite argv[0] and imitate kernel threads or legitimate Linux services.
- PeerBlight can recover C2 configuration through generated domains and BitTorrent DHT, so blocking its initial C2 address alone may not disrupt access.
- Investigate unexpected outbound reverse tunnels and SOCKS5 listeners; CowTunnel exposes local services through attacker-controlled FRP servers.
- Disable the hardware watchdog before terminating the analyzed Kaiji variant where applicable; otherwise, loss of watchdog writes can force a reboot and allow persistence to restart the payload.
- The analyzed CowTunnel configuration does not trigger its inherited account-creation code; its presence in the binary is not evidence that administrative accounts were created.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 185[.]247[.]224[.]41 | PeerBlight hardcoded primary C2 server, contacted on TCP port 8443. |
| IPV4 | 23[.]226[.]71[.]197 | CowTunnel C2 address listed in the article's IOC section. |
| IPV4 | 23[.]226[.]71[.]200 | CowTunnel C2 address listed in the article's IOC section. |
| IPV4 | 23[.]226[.]71[.]209 | CowTunnel C2 address listed in the article's IOC section. |
| IPV4 | 49[.]51[.]230[.]175 | PeerBlight C2 server on port 9898 recovered from a signed live BitTorrent DHT configuration. |
| SHA256 | 0f0f9c339fcc267ec3d560c7168c56f607232cbeb158cb02a0818720a54e72ce | ZinFoq Linux post-exploitation implant recovered in Case #2. |
| SHA256 | 2cd41569e8698403340412936b653200005c59f2ff3d39d203f433adb2687e7f | Sliver payload deployed by the d5.sh dropper. |
| SHA256 | 3854862bb3ee623f95d91fa15b504e2bbc30e23f1a15ad7b18aedb127998c79c | d5.sh dropper that installs a Sliver payload and establishes Linux persistence. |
| SHA256 | 65d840b059e01f273d0a169562b3b368051cfb003e301cc2e4f6a7d1907c224a | fn22.sh dropper variant with functionality to update existing infections. |
| SHA256 | 776850a1e6d6915e9bf35aa83554616129acd94e3a3f6673bd6ddaec530f4273 | CowTunnel reverse-proxy payload observed as NTPClient in Case #4. |
| SHA256 | a605a70d031577c83c093803d11ec7c1e29d2ad530f8e95d9a729c3818c7050d | PeerBlight Linux backdoor recovered during investigation of compromised Next.js infrastructure. |
| URL | hxxp[:]//103[.]135[.]101[.]15/wocaosinm.sh | Kaiji dropper URL; the script detects the operating system and architecture before retrieving a matching payload. |
| URL | hxxp[:]//207[.]148[.]79[.]178:6608/sys.sh | Unknown payload download URL used in the first observed exploitation attempt against a Windows endpoint. |
| URL | hxxp[:]//216[.]158[.]232[.]43:12000/sex.sh | Cryptominer deployment script requested after exploitation. |
| URL | hxxp[:]//31[.]56[.]27[.]97/scripts/4thepool_miner.sh | Miner script URL downloaded and piped to bash during Case #3. |
| URL | hxxp[:]//38[.]165[.]44[.]205/1 | CowTunnel payload URL downloaded as ntpclient in Case #4. |
| URL | hxxp[:]//38[.]165[.]44[.]205/k | Shell-script URL retrieved and piped to sh on the compromised Linux endpoint in Case #4. |
| URL | hxxp[:]//39[.]97[.]229[.]220:8006/httd | Additional payload URL used in download-and-execute commands on a compromised Linux endpoint. |
| URL | hxxp[:]//45[.]32[.]158[.]54/5e51aff54626ef7f/x86_64 | PeerBlight payload download URL identified in the IOC section. |
| URL | hxxp[:]//45[.]76[.]155[.]14/vim | ZinFoq payload download URL used in Case #2. |
| URL | hxxp[:]//help[.]093214[.]xyz:9731/FF22 | Payload retrieval URL used by the fn22.sh dropper variant. |
| URL | hxxp[:]//help[.]093214[.]xyz:9731/fn32.sh | Shell-script payload delivery URL used in post-exploitation commands in Case #3. |
| URL | hxxp[:]//keep[.]camdvr[.]org:8000/BREAKABLE_PARABLE5 | Hardcoded Sliver payload URL used by the d5.sh dropper. |
| URL | hxxp[:]//keep[.]camdvr[.]org:8000/d5.sh | Dropper script URL used to deploy Sliver and establish persistence. |
| URL | hxxp[:]//vps-zap812595-1[.]zap-srv[.]com:3000/sex.sh | Cryptominer script download URL used in Case #3. |
| URL | hxxps[:]//api[.]qtss[.]cc/en/about?source=redhat&id=v1.0 | ZinFoq beacon endpoint used to check in and receive commands. |
| URL | hxxps[:]//api[.]qtss[.]cc/en/about?source=redhat&id=v1.1 | ZinFoq response endpoint used to return command output. |
| URL | hxxps[:]//api[.]qtss[.]cc/en/about?source=redhat&id=v1.2 | ZinFoq file-exfiltration endpoint listed in the IOC section. |
MITRE ATT&CK
T1036.004 · Masquerade Task or ServicePeerBlight changes argv[0] and its kernel process name to [ksoftirqd]; ZinFoq and the Kaiji variant also impersonate legitimate Linux processes.T1041 · Exfiltration Over C2 ChannelZinFoq reads files, hex-encodes their contents, and sends them with metadata to its C2 exfiltration endpoint.T1053.003 · CronThe d5.sh dropper installs @reboot crontab entries for user-level and service-account persistence.T1059.004 · Unix ShellPost-exploitation commands executed downloaded scripts through bash or sh; ZinFoq also runs commands through /bin/bash -c.T1070.003 · Clear Command HistoryZinFoq clears shell history and empties ~/.bash_history; the d5.sh dropper also clears command history.T1070.006 · TimestompZinFoq modifies file access and modification times, defaulting to 2016-01-15 15:08:25 when no timestamp is supplied.T1090.001 · Internal ProxyCowTunnel and ZinFoq provide SOCKS5 proxying and TCP forwarding through compromised hosts to reach internal systems.T1090.003 · Multi-hop ProxyPeerBlight uses BitTorrent DHT nodes to obtain signed replacement C2 configurations when its primary server and generated domains fail.T1105 · Ingress Tool TransferAttackers used curl and wget to retrieve droppers, miners, and backdoor binaries onto compromised endpoints.T1190 · Exploit Public-Facing ApplicationAttackers exploited CVE-2025-55182 in vulnerable Next.js applications using crafted requests to achieve unauthenticated code execution.T1496 · Resource HijackingAttackers successfully deployed XMRig on a Linux endpoint and used scripts that configure Monero mining.T1543.002 · Systemd ServicePeerBlight installs systemd-agent.service, while miner scripts and the Sliver dropper create systemd services for restart and boot persistence.T1546.004 · Unix Shell Configuration ModificationFor regular non-root users, d5.sh injects into .bashrc as an additional persistence mechanism.T1568.002 · Domain Generation AlgorithmsPeerBlight generates up to 200 domain-and-port combinations using embedded word dictionaries and a seeded Mersenne Twister generator.T1573.001 · Symmetric CryptographyPeerBlight encrypts post-handshake C2 traffic with AES-256; the Kaiji variant uses a rotating XOR scheme for C2 messages.
CVE
People
Anna PhamNamed co-author of the Huntress investigation.Craig SweeneyNamed co-author of the Huntress investigation.Guillermo RauchVercel CEO whose minimum reproducible example is used to explain the exploitation mechanism.Lachlan DavidsonResearcher credited with discovering React2Shell and crafting the request behavior explained in the exploit analysis.Michael TiggesNamed co-author of the Huntress investigation.
Malware
CowTunnelcryptominer malware, a Linux backdoor we're tracking as PeerBlight, a reverse proxy tunnel we call CowTunnel, and a Go-based post-exploitation implant dubbed ZinFoq as part of their post-exploitation activity.KaijiWe also observed a Kaiji botnet variant being distributed through this campaign.PeerBlightPeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182Pink botnetRotaJakiro, Pink Botnet… Is This You?RotaJakiroRotaJakiro, Pink Botnet… Is This You?ToriiThe communication protocol, encryption architecture, and command structure is fundamentally different from both RotaJakiro and its suspected predecessor Torii.XMRigThe attacker successfully exploited the vulnerability and deployed an XMRig cryptocurrency miner.ZinFoqas PeerBlight, a reverse proxy tunnel we call CowTunnel, and a Go-based post-exploitation implant dubbed ZinFoq as part of their post-exploitation activity.
Vendors
Products
LinuxHomeBlogPeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182Microsoft WindowsCase #1 (Windows Endpoint)Next.jsWhile CVE-2025-55182 pertains to the upstream implementation in React, you may hear of “CVE-2025-66478” tracking the downstream effects within Next.js applications.ReactTL;DR: Huntress is seeing threat actors exploit a vulnerability in React Server Components (CVE-2025-55182) across several organizations in our customer base.React Server ComponentsTL;DR: Huntress is seeing threat actors exploit a vulnerability in React Server Components (CVE-2025-55182) across several organizations in our customer base.
Tools
react2shell-scannerThis User-Agent matches the default user-agent used by react2shell-scanner, an open-source tool published by Assetnote for detecting Next.js instances vulnerable to CVE-2025-55182.Sliverobserved in Case #3 serves as the initial installation component, responsible for deploying the Sliver payload (SHA256: 2cd41569e8698403340412936b653200005c59f2ff3d39d203f433adb2687e7f) with C2 atxfrpcThe second component is xfrpc version 2.9.644, an open-source FRP client maintained on GitHub.