React2Shell Vulnerability Exploited to Deploy EtherRAT Malware
React2Shell (CVE-2025-55182) is exploited to deploy EtherRAT, tied to North Korea-linked tooling. See how to protect systems with SIEM and log management.
A critical vulnerability in React Server Components — tracked as React2Shell (CVE-2025-55182, CVSS 10.0) — is being exploited to deploy a previously undocumented remote access trojan called EtherRAT. The researchers who discovered EtherRAT found the activity overlaps with North Korea-linked "Contagious Interview" tooling, though they say they cannot confirm the same actor is behind both. Here is what the vulnerability does, how the malware operates, and what it means for your organization.
What Is React2Shell?
React2Shell is a security vulnerability in React Server Components (RSC), a framework feature used by many modern web applications to render components on the server. The flaw allows an unauthenticated attacker to achieve remote code execution on the server hosting the affected application. It affects react-server-dom-webpack, -parcel, and -turbopack 19.0-19.2.0, fixed in 19.0.1/19.1.2/19.2.1. Attackers have been observed exploiting it to gain an initial foothold before deploying additional malware.
What Is EtherRAT?
EtherRAT is a remote access trojan (RAT) — malware that gives an attacker remote control over an infected system. Once installed, it lets the operator execute commands, move laterally, and maintain long-term access to the compromised environment.
Technical Details
EtherRAT's design suggests a moderately sophisticated operator:
- Ethereum smart contracts for command and control. Instead of relying on a conventional C2 server, EtherRAT retrieves instructions through Ethereum smart contracts, making its command infrastructure harder to take down or block through standard domain and IP blocklisting.
- Five persistence mechanisms on Linux. The malware installs multiple, independent methods of surviving reboots and cleanup attempts, so removing one does not remove the infection.
- On-demand Node.js runtime. EtherRAT downloads its own copy of Node.js directly from nodejs.org, giving it everything it needs to execute its payload without depending on software already present on the target system.
Link to the Contagious Interview Campaign
Researchers at Sysdig have tied this activity to Contagious Interview, a North Korea-linked campaign active since February 2025 that has previously used a technique called EtherHiding — storing and retrieving malicious payloads via blockchain — to distribute malware. EtherRAT's use of Ethereum smart contracts for C2 is consistent with that same operational pattern, which the researchers say suggests either a pivot by the same actors or tool-sharing between North Korean groups — they are explicit that without direct code overlap, they cannot confirm EtherRAT is operated by the same actor as Contagious Interview.
What This Means for Your Organization
If your environment uses React Server Components, or you rely on software built on them, this campaign is directly relevant:
- Patch React2Shell now. Confirm which applications in your environment use RSC, verify whether they are affected, and apply the vendor fix. Treat any internet-facing RSC deployment as higher priority.
- Hunt for EtherRAT-specific indicators. Look for unexpected outbound connections to Ethereum RPC endpoints, unrecognized Node.js processes or binaries outside your standard runtime paths, and newly created persistence entries (cron jobs, systemd units, startup scripts) on Linux hosts.
- Review egress controls. Blockchain-based C2 is designed to evade domain and IP-based blocking. Network monitoring that flags anomalous outbound traffic patterns — rather than relying solely on blocklists — is more likely to catch this kind of infrastructure.
Why This Matters Beyond This One Vulnerability
React2Shell will get patched, but the technique behind EtherRAT is the more durable problem: blockchain-based C2 removes one of defenders' most reliable tools — the ability to take down or block a known-bad server. As more threat actors adopt this approach, detection has to shift from "is this IP on a blocklist" to "does this behavior look like C2 traffic," which means log visibility and correlation matter more than ever.
This is exactly the gap a SIEM is built to close. A SIEM aggregates logs across your network, endpoints, and cloud services, and correlates them to surface the kind of anomalous behavior — like a Node.js process reaching out to an unfamiliar blockchain RPC endpoint — that a single log source would miss. Paired with disciplined log retention, it also gives you the historical data needed to determine how far back an intrusion goes once one is found.
To see how zcr's SIEM platform supports this kind of detection and investigation, visit zcrSIEM. If you'd like to discuss your organization's specific exposure, contact zcr.
If you'd rather talk through your own environment, here's how to reach us.
Sources
Related articles
Continue with these related guides for the comparison and operating detail:
Related product
See zcrCTEM for the product scope, the pricing page for published prices, and the inputs to confirm with your delivery partner