Threat Update: Metro4Shell, GlassWorm, and China's UAT-8837

# Threat Update: Metro4Shell, GlassWorm, and China's UAT-8837

**Published:** February 4, 2026

**Author:** DugganUSA Threat Intelligence

**Classification:** TLP:WHITE

---

Critical: Metro4Shell (CVE-2025-11953) - CVSS 9.8

A critical vulnerability in the **Metro Development Server** bundled with React Native CLI is under active exploitation as of February 3, 2026.

| Detail | Value |

|--------|-------|

| CVE | CVE-2025-11953 |

| Name | Metro4Shell |

| CVSS | 9.8 (Critical) |

| Affected | React Native CLI npm package |

| Vector | Remote Code Execution |

**If you're running React Native development environments, patch immediately.**

---

Supply Chain: GlassWorm via Open VSX Registry

On February 2, 2026, researchers disclosed a supply chain attack targeting the **Open VSX Registry** - the open-source alternative to Microsoft's VS Code Marketplace.

Threat actors compromised a legitimate developer's publishing credentials and pushed malicious updates to existing extensions. The payload: **GlassWorm** - a multi-stage loader that establishes persistence and downloads secondary payloads.

This follows last week's ClawdBot/Moltbot supply chain attack on Microsoft's Marketplace. The pattern is clear: **AI coding tool ecosystems are now prime targets.**

Mitigation

- Audit recently updated VS Code extensions

- Pin extension versions in team environments

- Monitor for unexpected network connections from VS Code processes

---

APT Watch: UAT-8837 (China-Nexus)

Cisco Talos is tracking **UAT-8837**, a China-aligned APT focused on obtaining initial access to high-value organizations in North American critical infrastructure.

| Attribute | Assessment |

|-----------|------------|

| Origin | China (medium confidence) |

| Target | NA Critical Infrastructure |

| Objective | Initial Access |

| Active Since | 2025 |

This actor joins Linen Typhoon (APT27) and Violet Typhoon (APT31) in the growing roster of Chinese state-aligned threats targeting Western infrastructure.

---

New Tool: PeckBirdy C2 Framework

Security researchers have documented **PeckBirdy**, a JScript-based command-and-control framework used by China-aligned APT actors since 2023. Primary targets include:

- Chinese gambling industry operations

- Asian government entities

The framework's JScript implementation makes it harder to detect with traditional endpoint tools focused on PowerShell and binary payloads.

---

Our Perimeter

DugganUSA automated defenses continue blocking Chinese IP ranges aggressively. Today's highlight:

- **101.198.0.x range** - Beijing Qihu Technology (360 Security)

- Asshole scores: 118-130

- MITRE: TA0001 Initial Access, T1190 Exploit Public-Facing Application

These IPs are available in our STIX 2.1 feed.

---

Recommendations

1. **React Native devs:** Check for Metro4Shell patches, update React Native CLI

2. **VS Code users:** Audit extensions updated in the last 7 days

3. **Critical infrastructure:** Review network logs for UAT-8837 TTPs

4. **Block** the 101.198.0.x range if you have no China business requirement

---

IOC Feed

Real-time indicators: `https://analytics.dugganusa.com/api/v1/stix-feed`

---

*Questions? [email protected]*

---

*Her name was Renee Nicole Good.*

*His name was Alex Jeffery Pretti.*