At least five China-nexus threat groups are exploiting the high-profile React2Shell vulnerability in cyberespionage and financially motivated attacks, according to threat researchers with Google.

The groups are among an expanding number of bad actors that have targeted the maximum-severity security flaw – tracked as CVE-2025-55182 – in React Server Components (RSC) due to broad use of RSC and associated frameworks, including Next.js, and the relatively easy exploitability of the vulnerability.

Researchers with Google Threat Intelligence Group (GTIC) said in a recent report that they, like other threat analysts, saw rapid and widespread exploitation attempts within hours of the unauthenticated remote code execution (RCE) vulnerability being disclosed December 3, with Amazon Web Services (AWS) pointing to multiple Chinese-linked threat groups, including like Earth Lamia and Jackpot Panda, among them.

In their report, GTIG researchers focused on groups linked to the People’s Republic of China (PRC) and their efforts to compromise targeted networks around the world.

The China Five

One group, which GTIG tracks as UNC6600, is exploiting React2Shell to deliver Minocat, its custom Linux tunneler. Such malware uses techniques to hide its malicious traffic among normal network communication, which allows it to bypass security tools, steal data or deliver additional malware.

Another group, UNC6586, in separate incidents abused CVE-2025-55182 to download and launch the SnowLight downloader.

“SNOWLIGHT is a component of VSHELL, a publicly available multi-platform backdoor written in Go, which has been used by threat actors of varying motivations,” the GTIG researchers wrote, adding that they “observed SNOWLIGHT making HTTP GET requests to C2 infrastructure … to retrieve additional payloads masquerading as legitimate files.”

There also has been multiple incidents of UNC6588 exploiting React2Shell and then downloading the Compood backdoor before executing a sample of the malware that masqueraded as Vim, a Linux-based text editor. The researchers said there wasn’t “significant follow-on activity, and this threat actor’s motivations are currently unknown.”

“COMPOOD has historically been linked to suspected China-nexus espionage activity,” they wrote. “In 2022, GTIG observed COMPOOD in incidents involving a suspected China-nexus espionage actor, and we also observed samples uploaded to VirusTotal from Taiwan, Vietnam, and China.”

Targeting the Cloud, VPS

Another backdoor – this one being deployed by the UNC6603 threat group – is Hisonic, an implant written the Go programming language that uses legitimate cloud services, like Cloudflare Pages and GitLab, to retrieve an encrypted configuration, according to GTIG.

“This technique allows the actor to blend malicious traffic with legitimate network activity,” the researchers wrote. “In this instance, the actor embedded an XOR-encoded configuration for the HISONIC backdoor delimited between two markers, ‘115e1fc47977812’ to denote the start of the configuration and ‘725166234cf88gxx’ to mark the end.”

Looking at the telemetry, the GTIG researchers wrote that UNC6603 likely is targeting cloud infrastructure – particularly AWS and Alibaba Cloud instances – in the Asia Pacific region.

They Chinese threat group UNC6595 is abusing React2Shell to deploy malware called Angryrebel.Linux to target infrastructure hosted on international virtual private servers, the researchers wrote.

“These observed campaigns highlight the risk posed to organizations using unpatched versions of React and Next.js,” the GTIG researchers wrote.

North Korean, Iranian Groups Also in the Mix

Other security research teams have seen threat groups linked to other countries exploiting CVE-2025-55182. Analysts with Palo Alto Neworks’ Unit 42and Sysdig detected activity aimed at the vulnerability that had overlaps with Contagious Interview, a scheme linked to North Korean threat actors who pose as recruiters to deploy malware on the systems of people looking for IT jobs. The scams haven’t been attributed any particular group.

That said, the Unit 42 researchers wrote that another North Korean actor, UNC5342, is using the EtherHiding technique – which abuses blockchains to store and retrieve malicious payloads – to deliver malware and steal cryptocurrency.

In addition, GTIG said it also has seen threat groups linked to Iran’s government trying to exploit the React security flaw.