Early Exploitation of React2Shell Vulnerability (CVE-2025-55182) Targets Critical Infrastructure
By
unknownhad
Toasted golden, schmeared with insight. Top of the rack.
Summary
The article details early exploitation activity following the public disclosure of the critical React2Shell vulnerability (CVE-2025-55182). Cloudforce One Threat Intelligence team observed scanning and active exploitation attempts within hours of disclosure, with traffic originating from infrastructure associated with Asian-nexus threat groups. Threat actors quickly integrated this vulnerability into their scanning and reconnaissance routines, systematically probing exposed systems and targeting critical infrastructure including nuclear fuel, uranium, and rare earth elements. The article outlines the tactics used by threat actors and describes how Cloudflare is protecting customers from these threats.
Key quotes
· 4 pulledWithin hours, we observed scanning and active exploitation attempts, including traffic originating from infrastructure associated with Asian-nexus threat groups.
Early activity indicates that threat actors quickly integrated this vulnerability into their scanning and reconnaissance routines.
We observed systematic probing of exposed systems, and targeted critical infrastructure including nuclear fuel, uranium and rare earth elements.
We outline the tactics they appear to be using and how Cloudflare is protecting customers.
