China's Hackers Gone Wild: React2Shell, BRICKSTORM, and More!

This is your Digital Frontline: Daily China Cyber Intel podcast. Listeners, it’s Ting on Digital Frontline, and China’s hackers have been very, very busy. In the last 24 hours, the biggest fire on the board is still the React2Shell vulnerability, CVE-2025-55182, in React Server Components and Next.js App Router. Amazon’s CISO C.J. Moses says AWS MadPot honeypots are seeing continuous exploitation attempts from China‑nexus groups Earth Lamia and Jackpot Panda, who weaponized public proof‑of‑concept code within hours of disclosure. According to Amazon and GovInfoSecurity, tens of thousands of internet‑exposed servers remain vulnerable in the United States alone, many in cloud‑hosted environments supporting finance, logistics, retail, IT services, universities, and government agencies. At the same time, AWS and Shadowserver report that these Chinese operators are not just spraying one exploit. They are chaining React2Shell with other bugs like the NUUO camera flaw CVE-2025-1338, hitting edge devices, cameras, and web apps together to get a beachhead, then moving laterally for long‑term espionage. This is not smash‑and‑grab; it’s “move in, change the Wi‑Fi, and live here.” On the infrastructure side, CrowdStrike and CyberDaily describe a China‑linked group dubbed Warp Panda targeting VMware vCenter in U.S. legal, technology, and manufacturing firms. Warp Panda and related clusters are deploying the BRICKSTORM backdoor to hypervisors, not just guest VMs. CISA, NSA, and the Canadian Centre for Cyber Security warn that BRICKSTORM gives full interactive shell on vSphere and can act as a SOCKS proxy, effectively turning your virtual infrastructure into their private operations hub for months at a time. So what does this mean for you, right now? If you run React or Next.js apps, your emergency task list is simple but non‑negotiable: patch to the fixed versions, enable Web Application Firewall rules for React2Shell signatures, and crank up logging around any suspicious deserialization or server‑component requests. Amazon’s telemetry shows attackers debugging their payloads live against targets, so noisy but “failed” exploit attempts still matter; they’re recon, not harmless errors. If you have VMware vCenter, treat it like a Tier‑0 crown jewel. Follow CISA’s BRICKSTORM advisory: audit all admin accounts, enforce MFA, rotate credentials, and inspect vCenter, ESXi hosts, and management networks for unknown services, odd SSH keys, and outbound DNS‑over‑HTTPS traffic. Segregate your management network from user networks; Warp Panda loves flat networks. Across the board, businesses and organizations should: Harden internet‑facing edge devices and cameras; update firmware and remove anything you don’t absolutely need exposed. Centralize logs and set alerts for abnormal admin logins, especially from new IP ranges or at weird hours. Practice least privilege for cloud and virtualization admins; no one should have “god mode” for convenience. Run regular t This content was created in partnership and with the help of Artificial Intelligence AI.