React2Shell Exploit Campaigns Tied to North Korean Cyber Intrusion Tactics

Sysdig observed active campaigns exploiting React2Shell (CVE-2025-55182, CVSS 10.0) that install EtherRAT — a Node.js-based RAT that resolves C2 via Ethereum smart contracts — through a four-stage chain (base64-executed shell, persistent downloader, AES-encrypted JavaScript dropper, and implant). The campaign demonstrates multi-vector persistence, automatic updates, and blockchain-based C2, and shows tooling overlap with North Korean-linked campaigns (Contagious Interview) though attribution remains unconfirmed.