Post

I had the [mis?]fortune of being awake just as attackers decided to slam the public internet with React2Shell exploits. GreyNoise had a tag up for it yesterday afternoon. Full write-up of the initial spate of attacks: www.greynoise.io/blo... 1/3

greynoise.ioCVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The GreyNoise Observation Grid Is Seeing So FarGreyNoise is already seeing opportunistic, largely automated exploitation attempts consistent with the newly disclosed React Server Components (RSC) “Flight” protocol RCE—often referred to publicly as “React2Shell” and tracked as CVE-2025-55182.

hrbrmstr 🇺🇦 🇬🇱 🇨🇦 🏳️‍🌈

@hrbrmstr.dev

What we're seeing: Automation-heavy traffic (Go clients, scanner UAs) PoE validation via PowerShell math commands Encoded stagers downloading secondary payloads AMSI bypass attempts via reflection ~50% of IPs first seen in December 2025 Early migration into Mirai botnets 2/3

5/12/25, 2:39 pm0 reposts1 like

hrbrmstr 🇺🇦 🇬🇱 🇨🇦 🏳️‍🌈

@hrbrmstr.dev

5 Dec 2025

This is textbook opportunistic exploitation—not novel, but serious. These campaigns lead to credential theft, cryptomining, ransomware staging, & access brokering. Patch if you haven't. DO NOT RELY ON WAFs ALONE. Block IPs using GN feeds & monitor for IoCs in the post. 3/3