React2Shell Exploit: Botnets Target 150K+ Devices Daily with Node.js Flaw
A newly discovered vulnerability in Node.js, designated CVE-2025-55182 and informally dubbed React2Shell, has become a favored weapon of botnets within mere days of its disclosure. Operators are now launching widespread attacks against vulnerable web applications and IoT devices, deploying Mirai-style binaries and cryptominers, while the number of blocked exploitation attempts has surged past 150,000 per day.
React2Shell affects Node.js applications that allow user-supplied JSON to influence the internal structure of JavaScript objects. When data validation is insufficient, this results in remote command execution: attackers gain access to process.mainModule.require, and from there to child_process.execSync and the underlying system. Researchers note that the exploit is compact, requires no sophisticated techniques, and applies to a broad class of Node.js applications — making it an ideal candidate for large-scale automated attacks.
Telemetry from the past 30 days shows a pattern typical of botnet campaigns. More than 150,000 blocked requests per day match React2Shell signatures. Most payloads contain direct BusyBox commands, attempts to download files via wget or curl, modify permissions with chmod, or incorporate evasion tactics such as base64-encoded inserts designed to bypass simple filtering. Some requests are purely reconnaissance, but many already contain fully formed malicious payloads intended for execution.
A significant portion of the traffic originates from a data center in Poland: a single IP address generated over 12,000 React2Shell-related events while simultaneously scanning ports and attempting to exploit known vulnerabilities in Hikvision devices. This behavior aligns closely with Mirai-family botnets and their descendants, where compromised infrastructure is used concurrently for scanning and multi-vector attacks. Additional traffic has been observed from the United States, the Netherlands, Ireland, France, Hong Kong, Singapore, China, Panama, and other regions, indicating a global, opportunistic campaign indiscriminately probing the entire Internet for exposed targets.
Attack patterns against victim devices also mirror those of traditional IoT botnets. Exploitation attempts target smart plugs, smartphones, NAS devices, CCTV systems, routers, developer boards, numerous smart-TV models, and a wide range of consumer electronics. The large number of unidentified device signatures suggests that attackers are scanning for any Linux-based web interface that reveals no manufacturer details. Practically speaking, the presence of an open HTTP port is all the botnet scripts require.
Analysis of deployed payloads reveals two principal malware families currently propagated via React2Shell. The first consists of Mirai loaders and their variants. In these cases, attackers heavily rely on BusyBox to fetch binaries from infrastructure at IP address 193.34.213[.]150, often under names such as x86 and bolts. A typical chain involves downloading a file, modifying permissions (e.g., via chmod 777), executing it, and then retrieving additional components. The second family involves deployment of the Rondo miner: here, the vulnerability is used to fetch the rondo.aqu.sh script from 41.231.37[.]153, which installs a propagation module and a cryptocurrency miner.
Both attack categories fit neatly into the established botnet economy: compromised devices are repurposed for DDoS attacks, lateral propagation, and illicit cryptocurrency mining. React2Shell provides a direct path from an HTTP request to system-level command execution, explaining its rapid adoption among botnet operators.
It is important to recognize that these exploitation attempts are entirely automated and indiscriminate. The scripts do not care who you are or what your server hosts — any publicly exposed service running a vulnerable Node.js application becomes a target by default. Organizations developing or deploying such applications are urged to apply patches immediately and thoroughly audit their JSON-processing logic: defenses against prototype pollution and object-structure manipulation are critical.
For IoT and consumer devices, basic security hygiene remains paramount: strict network segmentation, minimizing external exposure, disabling unnecessary remote access, and timely firmware updates. Once a device is compromised, it typically becomes yet another node in the botnet, participating in recursive scanning and attacks and perpetuating the exploitation cycle.
Researchers continue monitoring activity surrounding CVE-2025-55182 and React2Shell, and will update indicators of compromise, malicious payloads, infrastructure details, and actor attribution as new information emerges. The report appendix lists key IoCs — including IP addresses and URLs hosting Mirai-like binaries (e.g., 193.34.213.150 with /nuts/x86 and /nuts/bolts, as well as 89.144.31.18 and 31.56.27.76), the Rondo script (41.231.37.153 at /rondo.aqu.sh), and additional bot-distribution domains. These data points can already be used to strengthen blocking rules and detection systems across networks and endpoints.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
