React2Shell Vulnerability Exploited in Ransomware Attacks

The React2Shell vulnerability (CVE-2025-55182) is a critical security flaw in the React Server Components ‘Flight’ protocol, which allows remote code execution without authentication. Discovered on December 5, 2024, this vulnerability was quickly exploited by cybercriminals to deploy the Weaxor ransomware strain, which is believed to be a rebranding of the Mallox operation. The attack occurred less than a minute after the initial access was gained through the exploit.

Researchers at S-RM noted that the attackers executed an obfuscated PowerShell command to deploy a Cobalt Strike beacon for command and control communication. They disabled Windows Defender’s real-time protection before launching the ransomware payload. The attack was limited to the vulnerable endpoint, indicating a focused approach rather than widespread lateral movement.

The Weaxor ransomware encrypts files with the ‘.WEAX’ extension and leaves a ransom note named ‘RECOVERY INFORMATION.txt’ in each impacted directory. Notably, the attackers wiped volume shadow copies and cleared event logs to hinder recovery efforts and forensic analysis.

This incident underscores the importance of addressing vulnerabilities like React2Shell promptly. Organizations must be vigilant in monitoring their systems for signs of exploitation, especially those using Node or React technologies.

System administrators should review Windows event logs and EDR telemetry for unusual process creation from Node or React binaries. Patching alone may not suffice, as attackers often exploit known vulnerabilities before patches are applied.