React2Shell-utnyttjanden fortsätter med storskaliga Linux-bakdörrsimplantationer och stöld av molnuppgifter

16 december 2025

Rapporterad av AI

Det pågående utnyttjandet av React2Shell-sårbarheten (CVE-2025-55182)—tidigare beskrivet i rapportering om China-nexus- och cyberbrottskampanjer—innefattar nu utbredda Linux-bakdörrsinstallationer, godtycklig kommandokörning och storskalig stöld av molnuppgifter.

Efter tidigare rapporter om PeerBlight och efterföljande attacker från grupper som UNC6600, UNC6586, UNC6588, UNC6603 samt finansiellt motiverade aktörer som distribuerar skadlig kod som MINOCAT, SNOWLIGHT, HISONIC, COMPOOD, ANGRYREBEL.LINUX och XMRig-gruvor bekräftar cybersäkerhetsforskare aktiv, storskalig utnyttjande av React2Shell (CVE-2025-55182).

Attackörer fortsätter att utnyttja denna kritiska RCE-brist (CVSS 10.0, påverkar React 19.0–19.2.0) för att installera bakdörrar på Linux-system, köra godtyckliga kommandon och rikta in molnuppgifter för stöld.

Trots att patchar finns tillgängliga (React 19.0.1, 19.1.2, 19.2.1+), understryker de ihållande hoten behovet av att administratörer tillämpar åtgärder som Cloud Armor WAF, övervakar IOC från tidigare rapportering och säkrar React/Next.js-applikationer mitt i mjukvaruleveranskedjerisker.

Relaterade artiklar

Illustration depicting the Linux CopyFail vulnerability enabling root access exploits alongside Ubuntu's DDoS-induced outage.

Linux CopyFail exploit threatens root access amid Ubuntu outage

1 maj 2026 Rapporterad av AI Bild genererad av AI

A critical Linux vulnerability known as CopyFail, tracked as CVE-2026-31431, allows attackers to gain root access on systems running kernels since 2017. Publicly released exploit code has heightened risks for data centers and personal devices. Ubuntu's infrastructure has been offline for over a day due to a DDoS attack, hampering security communications.

Researchers discover SSHStalker botnet infecting Linux servers

Flare researchers have identified a new Linux botnet called SSHStalker that has compromised around 7,000 systems using outdated exploits and SSH scanning. The botnet employs IRC for command-and-control while maintaining dormant persistence without immediate malicious activities like DDoS or cryptomining. It targets legacy Linux kernels, highlighting risks in neglected infrastructure.

US government issues urgent CopyFail warning as Linux patches roll out

5 maj 2026 Rapporterad av AI

Four days after the CopyFail (CVE-2026-31431) exploit disclosure disrupted Ubuntu services, the US government warned of its critical risks to Linux systems, urging immediate patching amid public exploit code.

Linux

SSHStalker botnet uses IRC to target Linux servers

Teknik

Veeam patches three critical security flaws in backup servers

Linux

Researchers uncover new SysUpdate malware variant targeting Linux

OpenClaw patches severe vulnerability granting admin access

Developers of the popular AI tool OpenClaw released patches for three high-severity vulnerabilities, including one that allowed attackers with basic pairing privileges to silently gain full administrative control. The flaw, tracked as CVE-2026-33579 and rated up to 9.8 out of 10 in severity, has raised alarms among security experts. Thousands of exposed instances may have been compromised unknowingly.

New SysUpdate malware variant targets Linux systems

18 februari 2026 Rapporterad av AI

A new variant of the SysUpdate malware has been discovered targeting Linux systems, featuring advanced encryption for command-and-control communications. Security researchers at LevelBlue identified the threat during a digital forensics engagement and developed a tool to decrypt its traffic. The malware disguises itself as a legitimate system service to evade detection.

9 maj 2026 20:17

React2Shell-utnyttjanden fortsätter med storskaliga Linux-bakdörrsimplantationer och stöld av molnuppgifter

Relaterade artiklar

Linux CopyFail exploit threatens root access amid Ubuntu outage

Researchers discover SSHStalker botnet infecting Linux servers

US government issues urgent CopyFail warning as Linux patches roll out

SSHStalker botnet uses IRC to target Linux servers

Veeam patches three critical security flaws in backup servers

Researchers uncover new SysUpdate malware variant targeting Linux

OpenClaw patches severe vulnerability granting admin access

New SysUpdate malware variant targets Linux systems

New dirty frag exploit grants root access on linux systems

Red Hat directs users to security page for CopyFail vulnerability

Microsoft patches critical ASP.NET Core vulnerability on macOS and Linux

Malicious npm packages harvest crypto keys and secrets

Dell zero-day flaw unpatched for nearly two years

New Linux botnet SSHStalker uses IRC for command-and-control

Denna webbplats använder cookies