Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
How Weaxor Ransomware Leveraged the React2Shell Vulnerability in 2025
In December 2025, cybercriminals exploited the critical React2Shell vulnerability (CVE-2025-55182) in React Server Components and Next.js to gain unauthorized access to a corporate endpoint. Within seconds, attackers deployed the Weaxor ransomware strain, rapidly encrypting files and appending a '.WEAX' extension, while dropping ransom notes named 'RECOVERY INFORMATION.txt' in each directory. The attack began by delivering an obfuscated PowerShell command, installing a Cobalt Strike beacon for command-and-control, disabling Windows Defender, wiping shadow copies, and clearing logs to evade detection and hinder forensic analysis. Researchers confirmed there was no lateral movement or data exfiltration prior to encryption, and the targeted machine was subsequently compromised by additional threat actors. This incident highlights the widespread exploitation of recently disclosed vulnerabilities by both ransomware gangs and nation-state actors. With opportunistic attacks increasing in speed and automation, organizations must improve patch velocity and advanced monitoring to defend against emerging, rapidly weaponized threats.
9 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports