North Korean hackers exploit React2Shell flaw in EtherRAT malware attacks

Sysdig researchers analyzed EtherRAT, a sophisticated Linux backdoor used in post-React2Shell attacks that installs a full Node.js runtime, decrypts and runs a JavaScript implant, implements five layers of persistence (cron, bashrc, XDG autostart, systemd user service, profile injection), self-updates, and uses Ethereum smart contracts and multiple RPC providers for resilient C2; the activity is linked by overlaps to DPRK-affiliated operations and follows active exploitation of a critical React/Next.js deserialization RCE.