Security teams are now seeing real-world exploitation of the React2Shell vulnerability to deliver advanced Linux malware, including KSwapDoor and ZnDoor, according to new research from Palo Alto Networks Unit 42 and NTT Security.
React2Shell, tracked as CVE-2025-55182 and rated critical (CVSS 10.0), allows attackers to execute arbitrary commands on vulnerable servers. What’s changed recently is how aggressively and professionally the flaw is being abused.
KSwapDoor: Not Just Another Backdoor
Unit 42 describes KSwapDoor as a carefully engineered remote access tool built for long-term, low-noise operations.
Instead of establishing itself on one compromised host, it has a built-in internal mesh network that connects compromised servers so that they can all talk to one another. As a result, it will be difficult to stop or isolate the infected servers based on their traffic.
The malware disguises itself as a Linux Kernel Swap Daemon; this helps it blend in and appear to be “normal” system activity. An even more concerning feature is a built-in sleeper mode. The backdoor will not operate unless it receives a specific covert command; this allows the malware to bypass firewalls and monitoring systems.
Early on in the cyber security field, researchers mistakenly identified KSwapDoor as BPFDoor. As they performed further investigation into both malware, they realized that KSwapDoor has many differences that make it a more powerful tool.
NTT Security has uncovered numerous cases of intrusions against Japanese companies that utilized the React2Shell vulnerability to deliver the ZnDoor Linux RAT (Remote Access Trojan) that has been active for about a year (December of 2023).
In a recent series of intrusions, the infiltrators were able to populate a Linux server by executing a basic bash command to retrieve a ZdDoor's payload via wget from a remote environment and then execute the payload immediately afterwards. By doing so, the RAT is able to connect back to the hacker's infrastructure and await instructions.
Its functionality is broad and practical, including command execution, interactive shells, file browsing, file exfiltration, timestamp manipulation, SOCKS5 proxy setup, and port forwarding. In short, it gives attackers everything they need to quietly operate inside a compromised environment.
Multiple China-Nexus Groups Involved
Google and Microsoft both confirm that multiple threat groups have weaponized React2Shell. Google alone identified at least five China-linked clusters, each using the vulnerability to deliver different payloads from tunneling tools and downloaders to full-featured backdoors and cryptominers.
According to Microsoft, attackers took advantage of this vulnerability in performing post-exploitation activities. Examples include:
1. deploying reverse shells and Cobalt Strike beacons.
2. installing remote management and monitoring software.
3. changing SSH authorized keys, 4) enabling root logins.
5. performing extensive reconnaissance.
A number of these campaigns made use of the Cloudflare Tunnel service to obfuscate the command-and-control traffic in a legitimate infrastructure.
Scaling Down Cloud Credential Theft
As well as the need to protect against attacks that exploit cloud identity harvesting at scale, there is evidence of attackers actively exploiting other weaknesses in the cloud; As reported by Microsoft Threat Research Team, they are querying cloud metadata services directly from Microsoft (Azure), Amazon (AWS), Google (GCP) & Tencent Cloud to obtain and steal access tokens.
To compound this issue, they are using secret-scanning tools such as TruffleHog and Gitleaks, together with custom-made scripts to perform the theft of credentials for:
1. Cloud Access Keys.
2. Kubernetes Service Account Token
3. OpenAi API Tokens
4. Databricks Tokens
5. Git and CI/CD Secrets.
These attacks are designed to not only gain server access but also to exploit cloud environments and foster lateral movement.
Operation PCPcat: High Quantity Industrialised-Scale Attacks
Another discovered Attack Attribution collected by Beelzebub is "Operation PCPcat" which exploited vulnerabilities in Next.js (and particularly variants of React2Shell) and sought to collect sensitive data from compromised systems.
Malware would have harvested numerous types of information from the infected machines including Environment Files, SSH Keys, Cloud credentials, System Password files, Command Histories etc. Subsequently, the compromised hosts would have then been used to re-scan for other vulnerable machines, thus stressing the idea of fast "self-propagation".
Operation PCPcat: Industrial-Scale Exploitation
A campaign tracked by Beelzebub called Operation PCPcat has exploited the weaknesses in Next.js, including variants of React2Shell, as a means to steal sensitive information from compromised servers.
During the course of this campaign, malware collected environment variables, SSH key pairs, cloud account credentials, password files, command line retrieval histories, and other similar types of malware data from infected hosts and used these hosts to search for more vulnerable systems to compromise themselves rapidly.Researchers believe that to date more than 59,000 servers have been compromised in this campaign.
The Shadowserver Foundation has been monitoring a variety of vulnerable interfaces connected to the Internet as it pertains to React2Shell. GreyNoise statistics demonstrate that React2Shell is actively being exploited via attacks originating from hundreds of IP addresses in a variety of nations and that the number of attacks is continuing to rise daily.
The threat of exploitation has transitioned from a theoretical one to one that is now widely available, and many malicious actors are capitalizing on the current vulnerabilities presented by this attack surface.
React2Shell has become a favorite entry point for Linux-focused threat actors, enabling everything from stealthy backdoors to cloud credential theft and large-scale data exfiltration. Organizations running affected frameworks should assume exploitation is automated, opportunistic, and already underway.
Source: The Hacker News
