CISA Deadline Day: React2Shell and the Shai-Hulud Supply Chain

Today is CISA's remediation deadline for CVE-2025-55182 (React2Shell). If you're running Next.js or React Server Components and haven't patched, China-nexus actors have been inside for three weeks.

The React2Shell Timeline

December 3: Public disclosure of CVE-2025-55182 (CVSS 10.0)

December 5, 6:00 AM UTC: Active exploitation begins. Earth Lamia, Jackpot Panda, and UNC6595 are already deploying payloads.

December 8: CISA adds to Known Exploited Vulnerabilities catalog.

December 29 (TODAY): Remediation deadline.

This isn't theoretical. AWS, Microsoft, Google, Trend Micro, and Palo Alto all documented in-the-wild exploitation within 48 hours of disclosure.

React2Shell IOCs

If you run Next.js applications, check for connections to these C2 servers:

IPs:
193.34.213.150
154.89.152.240
107.174.123.91
38.165.44.205
45.76.155.14
216.238.68.169
78.153.140.16
80.64.16.241
2.56.176.35

Domains: gfxnick.emerald.usbx.me api.qtss.cc conclusion-ideas-cover-customise.trycloudflare.com proxy1.ip2worlds.vip ```

Malware deployed: VShell, EtherRAT, SNOWLIGHT, ShadowPAD, KSwapDoor, Auto-color backdoor, Cobalt Strike (CrossC2), Sliver, KINSING cryptominer.

Shai-Hulud 2.0: The Supply Chain Worm

While React2Shell grabbed headlines, Shai-Hulud 2.0 has been quietly infecting the npm ecosystem.

The scope: 25,000+ affected repositories across 350 unique developer accounts. Popular projects from Zapier, ENS Domains, PostHog, and Postman were temporarily trojanized.

The technique: Compromised maintainer accounts publish trojanized package versions. When developers run npm install, a two-stage infection deploys. First stage installs Bun runtime. Second stage harvests credentials and propagates.

The clever part: No traditional C2 servers. Shai-Hulud exfiltrates to GitHub repositories, blending with legitimate developer traffic.

This is trust inversion. The tools developers use to build software are now the attack surface.

Webrat: Targeting Security Researchers

Not content with attacking developers, threat actors are now targeting the defenders.

Fifteen malicious GitHub repositories disguised as CVE proof-of-concept exploits are distributing Webrat backdoor:

RedFoxNxploits/CVE-2025-10294-Poc
FixingPhantom/CVE-2025-10294
h4xnz/CVE-2025-10294-POC
stalker110119/CVE-2025-59230
DebugFrag/CVE-2025-12596-Exploit
rootreapers/CVE-2025-11499

C2 infrastructure: ezc5510min.temp.swtest.ru, shopsleta.ru

Security researchers downloading PoC code to understand vulnerabilities are executing malware instead.

Other Active Campaigns

Romania National Water Authority: Ransomware encrypted ~1,000 systems across national and regional offices.

France La Poste: Pro-Russian hacktivist group NoName057(16) disrupted postal and banking services.

Aflac: Scattered Spider breach exposed 22.7 million individuals.

Trust Wallet Chrome Extension: Compromised v2.68.0 resulted in $7M in cryptocurrency losses.

npm lotusbail package: 56,000 downloads before removal. Targeted WhatsApp data.

The Pattern

Every campaign this week exploits trust:

• React2Shell: Trust in framework code

• Shai-Hulud: Trust in npm packages

• Webrat: Trust in security research

• Trust Wallet: Trust in browser extensions

The attack surface isn't code. It's belief.

Immediate Actions

• Patch to React 19.0.0-rc-6e65b1e4-20241203 or later

• Audit for suspicious network connections to the IOCs above

• Check Kubernetes containers for unauthorized deployments

• Pin to known clean versions (pre-November 21, 2025)

• Rotate all npm tokens, GitHub PATs, SSH keys

• Enforce MFA on developer accounts

• Verify PoC repositories before executing

• Check file hashes against known malware signatures

• Monitor for connections to .ru C2 infrastructure

Machine-Readable IOCs

{
  "campaign": "React2Shell + Shai-Hulud December 2025",
  "cves": ["CVE-2025-55182"],
  "c2_ips": [
    "193.34.213.150", "154.89.152.240", "107.174.123.91",
    "38.165.44.205", "45.76.155.14", "216.238.68.169",
    "78.153.140.16", "80.64.16.241", "2.56.176.35"
  ],
  "c2_domains": [
    "gfxnick.emerald.usbx.me", "api.qtss.cc",
    "conclusion-ideas-cover-customise.trycloudflare.com",
    "proxy1.ip2worlds.vip", "ezc5510min.temp.swtest.ru",
    "shopsleta.ru"
  ],
  "malware_families": [
    "VShell", "EtherRAT", "SNOWLIGHT", "ShadowPAD",
    "KSwapDoor", "Auto-color", "Cobalt Strike", "Sliver",
    "KINSING", "Webrat", "Shai-Hulud"
  ],
  "webrat_hashes_md5": [
    "28a741e9fcd57bd607255d3a4690c82f",
    "a13c3d863e8e2bd7596bac5d41581f6a",
    "61b1fc6ab327e6d3ff5fd3e82b430315"
  ],
  "threat_actors": [
    "Earth Lamia", "Jackpot Panda", "UNC6595",
    "Scattered Spider", "NoName057(16)"
  ],
  "stix_feed": "https://analytics.dugganusa.com/api/v1/stix-feed"
}

CISA deadline is today. The attackers have been active for three weeks. Patch now.

---

*Analysis compiled December 29, 2025 by DugganUSA Threat Intelligence*

---

Get Free IOCs

Subscribe to our threat intelligence feeds for free, machine-readable IOCs:

AlienVault OTX: https://otx.alienvault.com/user/pduggusa

STIX 2.1 Feed: https://analytics.dugganusa.com/api/v1/stix-feed

Questions? [email protected]