Explorações do React2Shell continuam com implantações em grande escala de backdoors Linux e roubo de credenciais de nuvem

16 de dezembro de 2025

Reportado por IA

A exploração contínua da vulnerabilidade React2Shell (CVE-2025-55182)—detalhada anteriormente na cobertura de campanhas China-nexus e cibercriminosas—agora inclui instalações generalizadas de backdoors Linux, execução de comandos arbitrários e roubo em grande escala de credenciais de nuvem.

Após relatórios anteriores sobre PeerBlight e ataques subsequentes por grupos como UNC6600, UNC6586, UNC6588, UNC6603 e atores motivados por ganhos financeiros que implantam malware como MINOCAT, SNOWLIGHT, HISONIC, COMPOOD, ANGRYREBEL.LINUX e mineiros XMRig, pesquisadores de cibersegurança confirmam exploração ativa e em grande escala do React2Shell (CVE-2025-55182).

Os atacantes continuam explorando essa falha crítica de RCE (CVSS 10.0, afetando React 19.0–19.2.0) para instalar backdoors em sistemas Linux, executar comandos arbitrários e mirar credenciais de nuvem para roubo.

Embora patches estejam disponíveis (React 19.0.1, 19.1.2, 19.2.1+), as ameaças persistentes reforçam a necessidade de administradores aplicarem mitigações como Cloud Armor WAF, monitorarem IOCs de coberturas anteriores e protegerem aplicações React/Next.js diante de riscos na cadeia de suprimentos de software.

Linux CopyFail exploit threatens root access amid Ubuntu outage

01 de maio de 2026 Reportado por IA Imagem gerada por IA

A critical Linux vulnerability known as CopyFail, tracked as CVE-2026-31431, allows attackers to gain root access on systems running kernels since 2017. Publicly released exploit code has heightened risks for data centers and personal devices. Ubuntu's infrastructure has been offline for over a day due to a DDoS attack, hampering security communications.

Researchers discover SSHStalker botnet infecting Linux servers

Flare researchers have identified a new Linux botnet called SSHStalker that has compromised around 7,000 systems using outdated exploits and SSH scanning. The botnet employs IRC for command-and-control while maintaining dormant persistence without immediate malicious activities like DDoS or cryptomining. It targets legacy Linux kernels, highlighting risks in neglected infrastructure.

US government issues urgent CopyFail warning as Linux patches roll out

05 de maio de 2026 Reportado por IA

Four days after the CopyFail (CVE-2026-31431) exploit disclosure disrupted Ubuntu services, the US government warned of its critical risks to Linux systems, urging immediate patching amid public exploit code.

Linux

New dirty frag exploit grants root access on linux systems

Linux

SSHStalker botnet uses IRC to target Linux servers

Tecnologia

Veeam patches three critical security flaws in backup servers

Researchers uncover new SysUpdate malware variant targeting Linux

Researchers at LevelBlue have identified a new variant of the SysUpdate malware aimed at Linux systems during a digital forensics and incident response engagement. The malware disguises itself as a legitimate system service and employs advanced encryption for command-and-control communications. By reverse-engineering it, the team created tools to decrypt its traffic more quickly.

OpenClaw patches severe vulnerability granting admin access

03 de abril de 2026 Reportado por IA

Developers of the popular AI tool OpenClaw released patches for three high-severity vulnerabilities, including one that allowed attackers with basic pairing privileges to silently gain full administrative control. The flaw, tracked as CVE-2026-33579 and rated up to 9.8 out of 10 in severity, has raised alarms among security experts. Thousands of exposed instances may have been compromised unknowingly.

segunda-feira, 04 de maio de 2026, 03:03h

Explorações do React2Shell continuam com implantações em grande escala de backdoors Linux e roubo de credenciais de nuvem

Artigos relacionados

Linux CopyFail exploit threatens root access amid Ubuntu outage

Researchers discover SSHStalker botnet infecting Linux servers

US government issues urgent CopyFail warning as Linux patches roll out

New dirty frag exploit grants root access on linux systems

SSHStalker botnet uses IRC to target Linux servers

Veeam patches three critical security flaws in backup servers

Researchers uncover new SysUpdate malware variant targeting Linux

OpenClaw patches severe vulnerability granting admin access

Red Hat directs users to security page for CopyFail vulnerability

Microsoft patches critical ASP.NET Core vulnerability on macOS and Linux

Malicious npm packages harvest crypto keys and secrets

New SysUpdate malware variant targets Linux systems

Dell zero-day flaw unpatched for nearly two years

New Linux botnet SSHStalker uses IRC for command-and-control

BeyondTrust RCE flaw enables code execution without login

Este site usa cookies