Threat Update: Metro4Shell, GlassWorm, and China's UAT-8837
- Patrick Duggan
- Feb 4
- 2 min read
Updated: Apr 25
# Threat Update: Metro4Shell, GlassWorm, and China's UAT-8837
**Published:** February 4, 2026
**Author:** DugganUSA Threat Intelligence
**Classification:** TLP:WHITE
Critical: Metro4Shell (CVE-2025-11953) - CVSS 9.8
A critical vulnerability in the **Metro Development Server** bundled with React Native CLI is under active exploitation as of February 3, 2026.
| Detail | Value |
|--------|-------|
| CVE | CVE-2025-11953 |
| Name | Metro4Shell |
| CVSS | 9.8 (Critical) |
| Affected | React Native CLI npm package |
| Vector | Remote Code Execution |
**If you're running React Native development environments, patch immediately.**
Supply Chain: GlassWorm via Open VSX Registry
On February 2, 2026, researchers disclosed a supply chain attack targeting the **Open VSX Registry** - the open-source alternative to Microsoft's VS Code Marketplace.
Threat actors compromised a legitimate developer's publishing credentials and pushed malicious updates to existing extensions. The payload: **GlassWorm** - a multi-stage loader that establishes persistence and downloads secondary payloads.
This follows last week's ClawdBot/Moltbot supply chain attack on Microsoft's Marketplace. The pattern is clear: **AI coding tool ecosystems are now prime targets.**
Mitigation
- Audit recently updated VS Code extensions
- Pin extension versions in team environments
- Monitor for unexpected network connections from VS Code processes
APT Watch: UAT-8837 (China-Nexus)
Cisco Talos is tracking **UAT-8837**, a China-aligned APT focused on obtaining initial access to high-value organizations in North American critical infrastructure.
| Attribute | Assessment |
|-----------|------------|
| Origin | China (medium confidence) |
| Target | NA Critical Infrastructure |
| Objective | Initial Access |
| Active Since | 2025 |
This actor joins Linen Typhoon (APT27) and Violet Typhoon (APT31) in the growing roster of Chinese state-aligned threats targeting Western infrastructure.
New Tool: PeckBirdy C2 Framework
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
Security researchers have documented **PeckBirdy**, a JScript-based command-and-control framework used by China-aligned APT actors since 2023. Primary targets include:
- Chinese gambling industry operations
- Asian government entities
The framework's JScript implementation makes it harder to detect with traditional endpoint tools focused on PowerShell and binary payloads.
Our Perimeter
DugganUSA automated defenses continue blocking Chinese IP ranges aggressively. Today's highlight:
- **101.198.0.x range** - Beijing Qihu Technology (360 Security)
- Asshole scores: 118-130
- MITRE: TA0001 Initial Access, T1190 Exploit Public-Facing Application
These IPs are available in our STIX 2.1 feed.
Recommendations
1. **React Native devs:** Check for Metro4Shell patches, update React Native CLI
2. **VS Code users:** Audit extensions updated in the last 7 days
3. **Critical infrastructure:** Review network logs for UAT-8837 TTPs
4. **Block** the 101.198.0.x range if you have no China business requirement
IOC Feed
Real-time indicators: `https://analytics.dugganusa.com/api/v1/stix-feed`
*Questions? [email protected]*
*Her name was Renee Nicole Good.*
*His name was Alex Jeffery Pretti.*
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Comments