Critical React2Shell Flaw Triggers Ultra-Fast Weaxor Ransomware Attack (2025)
In December 2025, cybercriminals exploited the critical React2Shell vulnerability (CVE-2025-55182), an unauthenticated remote code execution flaw in React Server Components' Flight protocol, to immediately deploy Weaxor ransomware in targeted organizations. The attackers gained access to public-facing servers running React/Next.js applications, rapidly executed an obfuscated PowerShell script to establish a Cobalt Strike beacon for C2, disabled Windows Defender, and launched the ransomware encryptor within a minute. The incident resulted in data encryption, file extensions changed to '.WEAX', ransom demands, shadow copy deletion, and event log wiping. Impact was limited to the initially compromised server due to the absence of lateral movement or data exfiltration. This incident highlights the increasing speed of cybercriminal exploitation of disclosed critical vulnerabilities, even before widespread patching can occur. The use of automated tooling and rapid weaponization of exploits are fueling a surge in opportunistic ransomware attacks on public-facing infrastructure.
Kill Chain
