eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
React2Shell Vulnerability Updates
Bottom Line: CVE-2025-55182, a critical RCE vulnerability in React Server Components, is under active exploitation by threat actors. Public Proof-of-Concept exploits have accelerated attacks, leading to credential harvesting, and the deployment of various malicious tools including cryptominers and backdoors. With over 250,000 potentially vulnerable instances and CISA mandating patching by Dec 12th, 2025, immediate remediation is essential.
This week, researchers and vendors released significant updates regarding the React2Shell vulnerability. As highlighted in the Weekly Threat Briefing dated December 5th, CVE-2025-55182 (CVSS 10), known as React2Shell, is a critical flaw in the React Server Components (RSC) protocol that enables attackers to decode malicious payloads sent to React Server Function endpoints, ultimately allowing unauthenticated Remote Code Execution (RCE).
Wiz observed a rapid wave of targeted and opportunistic exploitation, targeting mainly Internet-facing Next.js applications and containerized workloads in Kubernetes and managed cloud environments. Attackers achieved unauthenticated RCE through a single, specially crafted HTTP request exploiting the Flight protocol’s insecure deserialization. A fully working RCE Proof-of-Concept (PoC) was created by Wiz (with near-100% success), amplifying the speed and scale of exploitation. During their research, Wiz observed that attackers establish shell scripts to harvest Amazon Web Services (AWS) credentials from environment variables, filesystems, and cloud instance metadata. In another instance, shell script was deployed to install Sliver Command‑and‑Control (C2) framework. Crypto mining campaigns were identified with attackers deploying a UPX packed version of the crypto miner XMRig and a standard XMRig setup in a separate environment.
In a separate report, Huntress outlined five confirmed cases across both Windows and Linux systems where adversaries successfully leveraged the React2Shell vulnerability. Their analysis revealed multiple post‑exploitation payloads deployed by threat actors. They identified a previously unreported Linux backdoor that they have named PeerBlight. This malware relies on the BitTorrent network as a secondary C2 channel, allowing it to remain operational even if traditional infrastructure is taken offline. Huntress also observed attackers deploying a lightweight tool referred to as CowTunnel, which functions as a reverse proxy and establishes outbound connections to attacker‑controlled Fast Reverse Proxy (FRP) servers. A Go‑based post‑exploitation framework, ZinFoq was discovered. This implant supports interactive shell access, SOCKS5 tunneling to facilitate lateral movement, and time stomping techniques to obscure forensic timelines. Finally, a Kaiji botnet variant was detailed which is notable for combining Distributed Denial‑of‑Service (DDoS) functionality with persistence features and misuse of hardware watchdog interfaces to trigger forced system reboots if attempts are made to disable it.
eSentire Threat Intelligence Analysis:
On December 5th, 2025, CISA added CVE-2025-55182 to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to mitigate the flaw by December 12th, 2025. The active exploitation of CVE-2025-55182 has continued to escalate. eSentire’s Threat Intelligence team has also observed adversaries attempting to deploy payloads in a client’s environment, including PeerBlight, Mirai botnet variants, and XMR-based cryptominers.
Sysdig recently documented one of the most notable developments i.e. the discovery of a previously unknown JavaScript-based implant they have named EtherRAT. EtherRAT exhibits several traits with the DPRK-linked “Contagious Interview” toolset. However, in this case, the delivery vector differs substantially, with attackers leveraging React2Shell for initial access rather than relying on fake job-interview lures. While the overlap in techniques suggests that DPRK operators may be experimenting with React2Shell as a new entry point, its similarities could even indicate a separate, capable threat actor blending Tactics, Techniques, and Procedures (TTPs) from multiple known campaigns to complicate attribution.
As of writing, the React development team has released patches for additional security flaws in RSC that were identified while researchers were examining the patches issued for CVE-2025-55182 (React2Shell). These newly documented issues, though not enabling RCE like React2Shell, could allow attackers to cause a Denial-of-Service (DoS) condition or expose source code on affected systems if successfully exploited. The three vulnerabilities were CVE-2025-55184, CVE-2025-67779, and CVE-2025-55183. The React team emphasized that the previously published patches for CVE-2025-55182 (React2Shell) did not fully mitigate these additional issues and that users who updated only for RCE must update again to the revised versions that address the new vulnerabilities.
The eSentire Threat Intelligence team has published a security advisory addressing CVE-2025-55182 on December 3rd, 2025. eSentire's TRU has developed new detection rules for MDR for Network, Endpoint, and Log, to identify activity associated with the exploitation of CVE-2025-55182 and continues to monitor for additional detection opportunities. The Threat Response Unit (TRU) has also provided a breakdown of the React2Shell attack chain in its TRU Intelligence Briefing on December 9th, 2025. The IP addresses associated with real-world attacks are blocked via the eSentire Global Block List and additional Indicators of Compromise (IoCs) have been added to the eSentire Threat Intelligence Feed.
Microsoft Patch Tuesday December 2025
Bottom Line: Microsoft's December Patch Tuesday release addressed 57 vulnerabilities with one important severity flaw, CVE-2025-62221, being exploited in the wild prior to the disclosure. Organizations are recommended to review the full release and apply relevant patches immediately.
December 9th, 2025, marked Microsoft’s Patch Tuesday release for the month of December addressing a total of 57 vulnerabilities with two critical vulnerabilities, two publicly disclosed important severity vulnerabilities, and one actively exploited, zero-day vulnerability.
CVE-2025-62221 (CVSS: 7.8) is an important severity, use after free vulnerability in Windows Cloud Files Mini Filter Driver. The flaw allows an attacker to escalate privileges on the affected device. Microsoft reported that an exploit was detected prior to the patch release making it a zero-day vulnerability. Cybersecurity and Infrastructure Security Agency (CISA) added it to the Known Exploited Vulnerabilities (KEV) catalog on the same day as the release.
The patch release addressed two publicly disclosed, Remote Code Execution (RCE) vulnerabilities: CVE-2025-64671 (CVSS 8.4) in GitHub Copilot for JetBrains, and CVE-2025-54100 (CVSS 7.8) impacting Windows PowerShell. No in-the-wild exploitation of the flaws has been reported. The patch release included two critical severity Microsoft Office RCE vulnerabilities CVE-2025-62554 (CVSS: 8.4) and CVE-2025-62557 (CVSS: 8.4).
Organizations are strongly encouraged to review the full Microsoft Patch Tuesday release and apply all relevant security patches.
eSentire Threat Intelligence Analysis:
Microsoft’s December Patch Tuesday addressed a comparatively smaller set of vulnerabilities; however, the disclosure of an actively exploited flaw underscores the importance for organizations to thoroughly review the release and apply all relevant security updates.
Although no technical details on the exploitation of CVE-2025-62221 are currently available, Microsoft notes that the vulnerability has low attack complexity and requires no user interaction. This suggests that additional real-world exploitation attempts are likely to emerge. According to Trend Micro’s Zero Day Initiative, Elevation of Privilege (EoP) vulnerabilities of this type are often chained with RCE flaws to achieve full system compromise. Threat actors can use a RCE vulnerability to establish an initial foothold and then exploit the EoP flaw to obtain administrative privileges, enabling them to assume full control of the affected device and conduct subsequent post-exploitation activities.
While there are no reports of exploitation of CVE-2025-64671 and CVE-2025-54100, independent researchers have demonstrated the feasibility of leveraging CVE-2025-54100. Microsoft stated that the latest update mitigates the issue, and once applied, Windows PowerShell will display warnings when scripts use the Invoke-WebRequest cmdlet to download web content, helping prevent the execution of potentially unsafe code.
Given the ongoing exploitation of CVE-2025-62221, organizations are advised to prioritize patching the vulnerability. Establishing an effective vulnerability and patch management program will support these efforts and help address additional flaws across assets. eSentire’s Managed Vulnerability Service (MVS) includes plugins capable of identifying devices affected by the aforementioned vulnerabilities.
Pro-Russia Hacktivists Conduct Opportunistic Attacks Against U.S. and Global Critical Infrastructure
Bottom Line: Pro‑Russian hacktivist groups with Russian state backing are reportedly conducting opportunistic attacks against U.S. and global critical infrastructure. Such attacks complicate attribution and demonstrate the state’s strategy of advancing its objectives while maintaining plausible deniability.
On December 9th, 2025, CISA, the FBI, NSA, and over 20 international partners issued AA25‑343A warning that pro‑Russia hacktivist groups are actively conducting opportunistic attacks against global critical infrastructure. Hacktivism refers to threat actors that operate in support of their political or ideological beliefs; pro-Russian hacktivists claim to support the Russian government in their ongoing invasion in Ukraine. The advisory emphasizes these actors are generally less sophisticated than state‑sponsored APTs but are leveraging internet‑exposed Operational Technology (OT) environments for real‑world disruption across sectors such as Water & Wastewater, Food & Agriculture, and Energy. To date, attacks in the U.S. and various other countries have resulted in the disruption of critical services, but major destructive results have not been identified.
The joint report details a recurring playbook: threat actors scan for Internet-facing Virtual Network Computing (VNC) services, often on ports 5900–5910. After exposed assets are identified, the adversaries use default credentials or perform a bruteforce attack against weak credentials. Once initial access is gained, the threat actors move to Human‑Machine Interfaces (HMIs) and OT control devices. From there, it is possible to perform various actions including changing setpoints, renaming devices, disabling alarms, inducing loss‑of‑view conditions, and restarting or shutting down equipment. This activity can result in downtime and potentially physical damage to OT connected devices.
The advisory makes reference to four specific Russian hacktivist groups observed targeting critical infrastructure: Cyber Army of Russia Reborn (CARR), Z‑Pentest, NoName057(16), and Sector16. Notably, CISA confirms that both CARR and NoName057(16) received direct support from the Russian government and the GRU military unit 74455 (aka Seashell Blizzard, APT44, Sandworm Team). It is also suspected that Sector16 receives support from the Russian government in exchange for “conducting specific cyber operations that further Russian strategic goals”. Outside of disruptive attacks on critical infrastructure, these groups have also been observed conducting Distributed-Denial-of-Service (DDoS) attacks, hack-and-leak operations, and website defacements.
eSentire Threat Intelligence Analysis:
Authoring agencies assess that these groups seek notoriety, often self‑attributing and exaggerating claims, yet their simple, cheap, replicable Tactics, Techniques, and Procedures (TTPs) increase the risk of copycat activity and broader adoption. While the reported activity does not include physical damage to ICS systems, this outcome remains possible. The scenario of physical damage is extremely concerning, as threat actors may weaponize systems like pressure gauges, leading to an actual loss in human life due to machine failure. Immediate mitigations include removing OT exposure to the public Internet, implementing robust authentication, including phishing resistant Multi-Factor Authentication (MFA), segmenting IT/OT networks, and adopting a mature asset management program with continuous monitoring for unauthorized VNC connections.
Russia’s use of non‑state proxies complicates attribution and government response options. The Russian state is now confirmed to have actively supported the development, growth, and targeting decisions of hacktivist groups, while allowing these groups to publicly present themselves as grassroot movements. Russia is not the first state to employ this tactic. In June 2025, the Canadian Center for Cyber Security (CCCS) released an advisory on Iranian cyber threat actors targeting critical infrastructure. Iranian state-sponsored APT groups were identified posing as hacktivists and claiming responsibility for attacks. This was done to enable disruptive cyberattacks, while limiting the likelihood of attribution to prevent government responses such as physical intervention and increased sanctions. Both Iran and Russia are expected to continue posing as and supporting hacktivists. If campaigns prove successful over time, other states will likely adopt the tactic for future campaigns.
Both state-affiliated hacktivism and grassroot hacktivism is expected to continue into 2026. While these groups are generally considered to be of low sophistication, the availability of Artificial Intelligence and cybercrime service offerings are likely to increase the capabilities hacktivists possess.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
