RondoDox: Nine Months of React2Shell in the Wild
The Vulnerability
CVE-2025-55182 (React2Shell) is a deserialization flaw in React Server Components that allows unauthenticated remote code execution via a single HTTP request.
CVSS Score: 10.0 (Critical)
- React 19.0, 19.1.0, 19.1.1, 19.2.0
- Next.js applications using React Server Components
- Any framework implementing the RSC "Flight" protocol
Discovery: Lachlan Davidson, disclosed November 29, 2025
Public disclosure: December 3, 2025
Time to exploitation: Hours
The Exploitation
Within hours of public disclosure, AWS threat intelligence observed China-nexus groups actively exploiting the vulnerability:
| Group | Attribution |
| Earth Lamia | China state-nexus |
| Jackpot Panda | China state-nexus |
- MINOCAT tunneler
- SNOWLIGHT downloader
- HISONIC backdoor
- COMPOOD backdoor
- XMRIG cryptocurrency miners
This isn't script kiddies. This is nation-state actors with pre-positioned exploitation capability waiting for high-value vulns.
The Botnet
The RondoDox botnet has been leveraging React2Shell for nine months—since before public disclosure.
Current exposure (as of January 4, 2026):
| Country | Vulnerable Instances |
| United States | 66,200 |
| Germany | 3,600 |
| France | 2,500 |
| India | 1,290 |
| Total | 84,916 |
Two-thirds of vulnerable systems are in the US.
Technical Details
The vulnerability resides in the react-server package's handling of RSC "Flight" protocol payloads.
- Attacker sends malformed RSC payload via HTTP
- Server fails to validate payload structure
- Attacker-controlled data influences server-side execution
- Arbitrary code executes with web server privileges
One request. Full compromise.
There is no workaround. You must patch.
The Timeline
| Date | Event |
| ~April 2025 | RondoDox campaign begins |
| Nov 29, 2025 | Vulnerability disclosed to React team |
| Dec 3, 2025 | Public disclosure |
| Dec 3, 2025 | Exploitation within hours |
| Jan 4, 2026 | 84,916 systems still vulnerable |
Nine months of quiet exploitation before anyone knew.
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
Remediation
- React: 19.0.1, 19.1.2, or 19.2.1
- Next.js 13.x: Upgrade to 14.2.35+
- Rotate all application secrets
- Review logs for exploitation indicators
- Check for persistence mechanisms
There is no workaround. WAF rules may reduce exposure but do not eliminate the vulnerability.
IOCs
- MINOCAT (tunneling)
- SNOWLIGHT (downloader)
- HISONIC (backdoor)
- COMPOOD (backdoor)
- XMRIG (cryptominer)
Check threat intel feeds for associated infrastructure.
The Lesson
React2Shell demonstrates the modern vulnerability lifecycle:
- Discovery → Private disclosure
- Patch released → Public disclosure
- Hours later → Nation-state exploitation
- Months later → 85K systems still unpatched
The window between disclosure and mass exploitation is now measured in hours, not days. If you're not patching within 24 hours of critical CVEs, you're already compromised.
Sources
- AWS: China-nexus Cyber Threat Groups Exploit React2Shell
- Wiz: Critical Vulnerability in React CVE-2025-55182
- Google Cloud: Threat Actors Exploit React2Shell
- Microsoft: Defending Against React2Shell
- Datadog: CVE-2025-55182 React2Shell RCE
About DugganUSA: We publish free threat intelligence for the 99% who can't afford enterprise security. Our STIX 2.1 feed includes React2Shell exploitation indicators.
Her name is Renee Nicole Good.
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Look up an IOC → · Audit your brand on AIPM → · See pricing →
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=rondodox-nine-months-of-react2shell-in-the-wild