eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Critical Security Vulnerability in React Server Components (React2Shell)
Bottom Line: The recently disclosed critical Remote Code Execution (RCE) vulnerability (CVE-2025-55182), dubbed React2Shell, impacting React Sever components was reported to be exploited by China-aligned threat actors. The availability of Proof-of-Concept (PoC) exploit code is enabling threat actors to exploit the flaw making it critical for the organizations to mitigate it as soon as possible.
On December 3rd, 2025, Meta disclosed a critical, maximum severity vulnerability, CVE-2025-55182, affecting multiple React Server components. On December 4th, 2025, Amazon reported on observation of exploitation of the vulnerability within hours of disclosure. The activity is believed to be associated with the Chinese state aligned threat actor groups.
CVE-2025-55182 (CVSS: 10), dubbed as React2Shell, is a vulnerability in React Server Components (RSC) protocol that allows attackers to decode payloads sent to the React Server Function endpoints, enabling Remote Code Execution (RCE). The vulnerability was first reported by the security researcher Lachlan Davidson on November 29th, 2025. The impacted React Server components include versions 19.0 to 19.2.0 of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. Meta stated that even if an application does not explicitly utilize the impacted endpoints, it remains vulnerable if it supports React Server Components. The Next.js applications using React Server component and App Router enabled, using Next.js versions 15x, 16x, 14.3.0-canary.77 and later canary releases are also impacted by the flaw. The disclosure followed release of multiple Proof-of-Concept (PoC) exploit codes.
Amazon threat intelligence teams observed exploitation of CVE-2025-55182 in their Amazon Web Service (AWS) MadPot honeypot infrastructure within hours of its disclosure. The activity was identified to originate from the infrastructure associated with China-nexus APT groups. The threat actors leveraged PoC exploited code to compromise the vulnerable instances and automated scanning to deter detection by the security solutions. Amazon described the attacks as persistent and methodical as the attackers sent large number of requests to the honeypot within shorter time spans, tried using multiple PoC exploit codes and refined the exploits throughout the attack. Out of the observed four IP addresses in the activity two were associated with the Earth Lamia or Jackpot Panda Chinese APT groups, one to an anonymization network, and the fourth was not attributed to any threat actor. Amazon does not attribute the activity to any specific threat actor as the observed infrastructure only historically aligns with Chinese threat actors and the use of anonymization infrastructure made it difficult to identify the operators.
On December 5th, 2025, eSentire’s Threat Response Unit (TRU) has observed ongoing exploitation of CVE-2025-55182. As of the time of writing, observed activity can mainly be categorized as probing, system reconnaissance and attempts to exfiltrate sensitive credentials. The investigation into the observed activity aligns with the findings reported by Amazon as the threat actors modified the available PoC exploit codes, performed system and user enumeration, and attempt to steal sensitive AWS data.
eSentire Threat Intelligence Analysis:
React, a JavaScript library developed by Meta in 2011, has become one of the most widely used technologies in web development due to its robustness and flexibility. Because of its broad adoption, any vulnerability in the framework significantly expands the potential victim landscape for threat actors. It is therefore reasonable to anticipate a high likelihood of adversaries attempting to operationalize such a flaw to gain access to sensitive data belonging to high-value targets. CVE-2025-55182 poses a significant threat to organizations as successful exploitation leads to RCE, and reported exploitation of the flaw within hours of disclosure further emphasizes it maximum severity score.
Although Amazon does not attribute the observed exploitation activity to any specific threat actor, the inference based on the detected infrastructure is reasonably grounded. Chinese threat groups have a history of rapidly weaponizing newly disclosed vulnerabilities. In addition, the use of anonymization services and layered infrastructure is a known characteristic of Chinese APT operations, designed to evade detection and complicate attribution efforts. These established patterns lend limited but reasonable support to the speculation surrounding the origin of the activity. The public availability of PoC exploit code indicates that the vulnerability is not limited to exploitation by Chinese groups alone. Other threat actors including those with lower technical expertise are also likely to leverage the flaw.
React team has released critical updates, with patched versions 19.0.1, 19.1.2, and 19.2.1 of the affected packages available for immediate download. The affected ecosystem is notably extensive, impacting frameworks and bundlers such as Next.js, React Router, Waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk. For users of frameworks like Next.js, React Router, and Expo, specific upgrade instructions have been detailed to facilitate seamless transitions to secure versions. Next.js users, for example, are advised to update to the latest patched versions within their specific release lines or to revert to stable releases if using canary versions. Similarly, users employing React Router's unstable RSC APIs or using Expo, Waku, and other affected platforms should execute immediate updates as outlined in the detailed official instructions. Temporary mitigations have been coordinated with a variety of hosting providers, but these should not be solely relied upon as a comprehensive solution; full resolution requires the prompt installation of the aforementioned updates.
The eSentire Threat Intelligence team has published a security advisory addressing CVE-2025-55182 on December 3rd, 2025. eSentire's TRU is has developed new detection rules for MDR for Network, Endpoint, and Log, to identify activity associated with the exploitation of CVE-2025-55182 and continues to monitor additional detection opportunities. The IP addresses associated with real-world attacks are blocked via the eSentire Global Block List and additional Indicators of Compromise (IoCs) have been added to the eSentire Threat Intelligence Feed.
Joint Government Report on BRICKSTORM
Bottom Line: CISA, NSA, and the Canadian Centre for Cyber Security have confirmed that PRC state-sponsored actors are deploying BRICKSTORM malware for long-term persistence on victim systems, primarily targeting VMware vSphere (vCenter and ESXi) and Windows environments in government and IT sectors.
On December 4th, 2025, the United States' Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA), and Canada's Canadian Centre for Cyber Security (CCCS) published a joint report on BRICKSTORM. The malware has been associated with state-sponsored threat actor groups linked to the People's Republic of China (PRC) and is used for maintaining long-term persistent access to compromised environments. The report was generated based off analysis from eight samples of BRICKSTORM, along with observations from an incident investigated by CISA, with the aim of providing organizations with Indicators of Compromise (IoCs) and detection signatures.
BRICKSTORM is a backdoor that is designed to target VMware vSphere, specifically VMware vCenter servers and VMware ESXi, and Windows environments. CISA indicates that the observed BRICKSTORM infections primarily involved organizations within the Information Technology (IT) and Government Services and Facilities sectors. One incident investigated by CISA involved a Chinese state-sponsored threat actor gaining access to a victim organizations web server using a webshell but provided no details on how the webshell was initially deployed. With this access, the threat actors were able to use credentials from a compromised service account to pivot to a Domain Controller using Remote Desktop Protocol (RDP), which enabled them to copy the Active Directory database. After obtaining credentials for a Managed Service Provider (MSP) account, the threat actors were able to move laterally to the victims vCenter server where they deployed BRICKSTORM and were able to maintain persistent access from at least April 2024 until September 2025.
Analyzed BRICKSTORM samples determined that the malware enables threat actors to maintain stealthy persistent access to target environments and establish secure Command-and-Control (C2) connections. BRICKSTORM features a built-in self-watching function, which monitors if the malware is running correctly, and if not, it will reinstall itself to a new file path and execute. BRICKSTORM establishes secure C2 connections, which enables attackers with full control over compromised systems. This control includes capabilities such as file system management, interactive remote shell access, and SOCKS proxying to facilitate tunnelling and lateral movement.
eSentire Threat Intelligence Analysis:
BRICKSTORM has been reported on by both Google and CrowdStrike, where it was observed being deployed by different Chinese state-sponsored APT groups during their campaigns. In September 2025, Google published their observations where the threat actor UNC5221 deployed BRICKSTORM within espionage attacks against organizations in the technology and legal sectors within the United States. These attacks involved the exploitation of the zero-day vulnerabilities CVE-2023-46805 and CVE-2024-21887, impacting Ivanti products. In December 2025, CrowdStrike published a report on Warp Panda, another Chinese APT group that was observed deploying BRICKSTORM in suspected espionage-motivated attacks against legal, technology, and manufacturing organizations within the United States. CrowdStrike indicated that the observed attacks also involved the exploitation of vulnerabilities for initial access, with the group primarily targeting organizations within North America.
Chinese APT groups have been known to share tooling amongst each other, with examples being the PlugX Remote Access Trojan (RAT), and China Chopper webshell. The usage of BRICKSTORM by UNC5221, Warp Panda, and within CISA's report demonstrates this continued trend. Although, with no specific attribution provided by CISA in their report, it is unknown if the analyzed BRICKSTORM samples originated from one specific group or campaign, or from many. However, based on the observations from Google and CrowdStrike, it is likely that the motivation behind the campaigns observed by CISA were also espionage-related, with the main objective of the attackers being intelligence gathering or using the access to compromise downstream victims.
As Chinese APT groups have been known to target vulnerabilities within externally facing services, organizations should ensure that a robust patch management policy is implemented, which can aid in the identification of critical vulnerabilities so that patches can be applied within a timely manner. Organizations should also ensure that Endpoint Detection and Response (EDR) solutions are deployed on all assets in their environment, which can be used to detect and contain threats. eSentire's Threat Intelligence team have added known IoCs to the Threat Intelligence Platform (TIP) and continues to track activity relating to BRICKSTORM for additional information and detection opportunities.
AI Malware: Hype vs Reality
Bottom Line: A new AI Malware Maturity Model (AIM3) was proposed by Recorded Future, which aims to better track changes and improvements of AI-generated malware and abuse by threat actors in real-world attacks. The model highlights that despite widespread alarm over AI-generated malware, most attacks remain unsophisticated at this time.
Recent analysis from Recorded Future highlights that while Artificial Intelligence (AI) is increasingly referenced in discussions around cyber threats, the actual capabilities of “AI malware” are far more limited than current headlines suggest. The report emphasizes that most real-world malicious activity involving AI today consists of traditional malware supported by AI tools, rather than fully autonomous, AI-driven threats.
Recorded Future defines AI malware as malicious software whose behavior meaningfully depends on Generative AI or Large Language Models (LLM). It classifies AI malware into five categories based on how threat actors leverage this technology. LLM-Translated threats use AI to translate phishing or malicious content into targeted languages, while LLM-Generated malware relies on LLMs to assist with writing or refining malicious code. LLM-Deployed attacks distribute malware through AI ecosystems such as plugins or model hubs. More advanced forms include LLM-Driven malware, which uses LLMs to generate commands, make decisions, or adapt behavior, and LLM-Embedded malware, which theoretically packages a local LLM within the payload, though no confirmed real-world cases of this type currently exist.
To categorize this emerging threat, the researchers also introduced the AI Malware Maturity Model (AIM3), which outlines five levels ranging from early experimentation to fully autonomous AI-native attack frameworks.
- Level 1 (Experimenting) includes early-stage testing where attackers explore AI’s potential in offensive activity with examples including Malterminal and PromptLock
- Level 2 (Adopting) reflects the use of AI in familiar workflows such as phishing, reconnaissance, and malware development. Examples provided were FRUITSHELL and OSSTUN
- Level 3 (Optimizing) involves leveraging GenAI models locally or via APIs, to generate commands and modify code dynamically during execution with examples like Lamehug, HexStrike-AI, and Villager
- Level 4 (Transforming) - AI native frameworks are used in attacks with human interaction, moving away from historic tactics and techniques
- Level 5 (Scaling) represents the theoretical upper tier, where threat actors build fully agentic, end-to-end autonomous systems capable of managing entire campaigns without human intervention
According to the findings, all verified cases discovered to date fall only within Levels 1 to 3, where AI is used to assist attackers with scripting, code generation, phishing content, or other efficiency-focused tasks. No confirmed examples exist of malware embedding a local LLM model, nor any case demonstrating fully autonomous Level 5 capabilities.
eSentire Threat Intelligence Analysis:
Anthropic reported a large-scale cyber espionage campaign using agentic AI to perform 80–90% of intrusion operations. The activity was detected in mid-September 2025, and impacted at least thirty separate organizations, including technology firms, financial institutions, chemical manufacturers, and government agencies. It was attributed to a Chinese state-sponsored threat actor, GTG-1002. Threat actors developed an attack framework via Claude Code, that would autonomously compromise a chosen target with minimal human involvement. The code enabled reconnaissance, credential harvesting, lateral movement, and data exfiltration. According to Recorded Future, this is the only real-world example of a Level 4 AI malware campaign.
The report stresses that many sensational claims about First AI malware originate from Proof-of-Concepts (PoCs) or research demos, rather than actual operational campaigns, leading to inflated public perception. While the integration of AI has meaningfully lowered barriers for inexperienced attackers and accelerated common attack tasks, the underlying techniques like initial access, persistence, Command-and-Control (C2), and data theft remain largely conventional.
Recent reporting from multiple security vendors indicates that AI adoption is already being actively leveraged by both state-sponsored actors and cybercriminal groups. Google and Microsoft have documented real-world cases where adversaries use AI to improve operational efficiency, refine phishing content, and accelerate malware development. Similarly, Varonis has highlighted the emergence of SpamGPT, an AI-powered email automation toolkit sold for approximately $5,000, which drastically lowers the barrier for conducting large-scale phishing operations by enabling automated, high-volume, and convincingly personalized messages. Trend Micro’s analysis of the Water Saci campaign further suggests that threat actors may be using LLMs for code translation, allowing them to rapidly adapt propagation scripts for different environments and significantly improve reliability and speed. While these examples do not yet represent fully autonomous AI malware, they show that adversaries are using AI to scale campaigns, reduce development time, and enhance the credibility and effectiveness of their attacks.
The key implication for defenders is that the volume and precision of malicious activity will continue to increase as AI toolkits become more accessible and specialized. Security teams should focus on monitoring for the misuse of commercial AI services, strengthen foundational controls such as access management and endpoint protection, and integrate AI-related misuse scenarios into existing threat models. For more details on this topic, eSentire’s Threat Intelligence team has documented recent reports related to abuse of AI in its Weekly Threat Briefing from November 7th and November 14th.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
