Analyzing React2Shell Threat Actors
Essential information
- Published
- 17/01/2026 13:17
- Modified
- 19/01/2026 09:29
- Tags
- 2026-01-17 CVE-2017-9841 CVE-2019-9082 CVE-2023-1389 CVE-2024-4577 CVE-2025-55182 botnet exploitation payloads rce react server components react2shell reactonmynuts rondodox vulnerability
- Related entities
- 10 vulnerabilities (cve), 9 observables, 16 techniques (mitre), 2 malware, 11 others
Description
Related entities
Vulnerabilities, IOCs, intrusion sets, MITRE techniques and other entities referenced in this report.
Vulnerabilities (CVE) (10)
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries …
- Attack vector
- Network
- Published
- 29/04/2025
- Modified
- 21/12/2025
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary …
- Attack vector
- Network
- Published
- 13/12/2022
- Modified
- 20/12/2025
PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by …
- Attack vector
- NETWORK
- Complexity
- LOW
- Published
- 27/06/2017
- Modified
- 22/04/2026
ThinkPHP contains an unspecified vulnerability that allows for remote code execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.
- Published
- 03/11/2021
- Modified
- 21/12/2025
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system …
- Attack vector
- Network
- Published
- 12/06/2024
- Modified
- 21/12/2025
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, …
- Attack vector
- Network
- Published
- 05/12/2025
- Modified
- 29/05/2026
TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.
- Attack vector
- Adjacent
- Published
- 01/05/2023
- Modified
- 21/12/2025
Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.
- Published
- 16/05/2022
- Modified
- 20/12/2025
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security …
- Attack vector
- NETWORK
- Published
- 14/04/2022
- Modified
- 21/12/2025
ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated …
- Attack vector
- NETWORK
- Published
- 23/12/2022
- Modified
- 19/01/2026
Observables (9)
94.154.35.15489.144.31.1845.125.66.90http://mewo.oceanic-node.su:3443http://41.231.37.153/rondo.aqu.sh||curlhttp://41.231.37.153/rondo.aqu.shhttp://41.231.37.153/rondo.xxx.shhttp://193.34.213.150/nuts/x86http://89.144.31.18/nuts/x86http://41.231.37.153/rondo.aqu.sh||busybox
Techniques (MITRE) (16)
-
Encrypted Channel
-
Proxy
-
Data Encoding
-
System Network Configuration Discovery
-
Data from Local System
-
Exploit Public-Facing Application
-
Ingress Tool Transfer
-
Non-Application Layer Protocol
-
Remote Access Tools
-
Command and Scripting Interpreter
-
Application Layer Protocol
-
File and Directory Discovery
-
Automated Exfiltration
-
Data Staged
-
System Information Discovery
-
Exfiltration Over C2 Channel
Malware (2)
-
FamilyPublished 21/05/2026 23:03 · Modified 21/05/2026 23:03
-
FamilyPublished 17/01/2026 13:17 · Modified 17/01/2026 13:17
Others (11)
- Poland
- Israel
- Australia
- United Kingdom of Great Britain and Northern Ireland
- Germany
- Canada
- Singapore
- Romania
- United States of America
- mewo.oceanic-node.su
- atomicmail.io