How Weaxor Ransomware Leveraged the React2Shell Vulnerability in 2025
Executive Summary
In December 2025, cybercriminals exploited the critical React2Shell vulnerability (CVE-2025-55182) in React Server Components and Next.js to gain unauthorized access to a corporate endpoint. Within seconds, attackers deployed the Weaxor ransomware strain, rapidly encrypting files and appending a '.WEAX' extension, while dropping ransom notes named 'RECOVERY INFORMATION.txt' in each directory. The attack began by delivering an obfuscated PowerShell command, installing a Cobalt Strike beacon for command-and-control, disabling Windows Defender, wiping shadow copies, and clearing logs to evade detection and hinder forensic analysis. Researchers confirmed there was no lateral movement or data exfiltration prior to encryption, and the targeted machine was subsequently compromised by additional threat actors.
This incident highlights the widespread exploitation of recently disclosed vulnerabilities by both ransomware gangs and nation-state actors. With opportunistic attacks increasing in speed and automation, organizations must improve patch velocity and advanced monitoring to defend against emerging, rapidly weaponized threats.
Why This Matters Now
The React2Shell (CVE-2025-55182) flaw is being weaponized immediately following public disclosure, underscoring how quickly attackers pivot to exploit new vulnerabilities. This incident shows that patching delays and insufficient server monitoring can result in near-instant compromise and ransomware deployment, making urgent remediation and rapid incident detection essential.
Attack Path Analysis
Attackers exploited the React2Shell (CVE-2025-55182) vulnerability in a public-facing server for unauthenticated remote code execution. Immediately after compromising the host, they used a PowerShell command to deploy a Cobalt Strike beacon, then disabled Windows Defender protections. The attack was automated and did not involve lateral movement; activity was confined to the initially compromised endpoint. The Cobalt Strike beacon provided command and control capabilities. No evidence of data exfiltration was found prior to ransomware deployment. The final impact involved rapid deployment of Weaxor ransomware, encryption of files, deletion of backups, and clearing of event logs to hinder recovery and forensics.
Kill Chain Progression
Initial Compromise
Description
Attackers exploited the unauthenticated insecure deserialization flaw (React2Shell) in a public-facing React/Next.js server to achieve remote code execution.
Related CVEs
CVE-2025-55182
CVSS 10An insecure deserialization vulnerability in React Server Components allows unauthenticated remote code execution via crafted HTTP requests.
Affected Products:
Meta React Server Components – 19.0.0, 19.1.0, 19.1.1, 19.2.0
Vercel Next.js – 15.x, 16.x
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Ingress Tool Transfer
Impair Defenses: Disable or Modify Tools
Data Encrypted for Impact
Indicator Removal on Host: Clear Windows Event Logs
Inhibit System Recovery
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Timely Security Patching
Control ID: 6.2.3
NYDFS 23 NYCRR 500 – Cybersecurity Policy; Access Privileges; Data Retention, Monitoring & Logging
Control ID: 500.03, 500.07, 500.14(b)
NIS2 Directive – Vulnerability Handling, Incident Handling
Control ID: Art. 21(2)(d), Art. 21(2)(e)
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Continuous Monitoring and Threat Detection
Control ID: Pillar 1: Identity, Pillar 4: Visibility & Analytics
DORA (Digital Operational Resilience Act) – ICT Risk Management; ICT Incident Handling
Control ID: Art. 9(2), Art. 10(1)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
React2Shell vulnerability directly impacts React/Next.js applications, enabling ransomware deployment within minutes through insecure deserialization exploits requiring immediate patching and security controls.
Financial Services
Critical exposure to React2Shell ransomware attacks targeting public-facing applications, threatening compliance with PCI DSS requirements and necessitating enhanced egress security measures.
Health Care / Life Sciences
React-based healthcare applications vulnerable to sub-minute ransomware deployment, potentially violating HIPAA encryption requirements and compromising patient data through automated exploitation vectors.
Information Technology/IT
High-risk sector for React2Shell exploitation with widespread React/Node.js usage, requiring immediate threat detection capabilities and zero trust segmentation to prevent lateral movement.
Sources
- Critical React2Shell flaw exploited in ransomware attackshttps://www.bleepingcomputer.com/news/security/critical-react2shell-flaw-exploited-in-ransomware-attacks/Verified
- Defending against the CVE-2025-55182 (React2Shell) vulnerability in React Server Componentshttps://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/Verified
- React2Shell Critical Vulnerability (CVE-2025-55182)https://www.cmu.edu/iso/news/2025/react2shell-critical-vulnerability.htmlVerified
- Critical vulnerability in React and Next.js (CVE-2025-55182)https://www.vulncheck.com/blog/cve-2025-55182-react-nextjsVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Comprehensive CNSF controls such as zero trust segmentation, inline threat detection, egress policy enforcement, and centralized visibility would have substantially contained, detected, or blocked key actions in the attack chain. Segmentation and workload isolation limit blast radius; inline anomaly and IPS controls enable early detection and blocking of Cobalt Strike and ransomware propagation.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline real-time inspection raises alerts or blocks exploitation attempts.
Control: Threat Detection & Anomaly Response
Mitigation: Anomalous process execution and endpoint security tampering rapidly detected and alerted upon.
Control: Zero Trust Segmentation
Mitigation: Workload-to-workload communication minimized, limiting blast radius of compromise.
Control: Egress Security & Policy Enforcement
Mitigation: Malicious C2 and unauthorized outbound traffic blocked or flagged for rapid response.
Control: Egress Security & Policy Enforcement
Mitigation: Unusual outbound attempts would be blocked and logged.
Rapid detection of ransomware behavior and system changes enables containment.
Impact at a Glance
Affected Business Functions
- Web Applications
- E-commerce Platforms
- Customer Portals
Estimated downtime: 3 days
Estimated loss: $500,000
Potential exposure of sensitive customer data due to unauthorized access and code execution on affected servers.
Recommended Actions
Key Takeaways & Next Steps
- • Immediately patch all public-facing applications and prioritize rapid remediation of disclosed CVEs such as React2Shell.
- • Enforce zero trust segmentation to strictly control workload-to-workload communications and restrict attacker mobility.
- • Deploy inline egress controls and anomaly detection to monitor, block, and alert on C2 and ransomware behaviors in real time.
- • Centralize visibility across multicloud and hybrid environments, enabling rapid investigation through comprehensive traffic and event logs.
- • Implement baselined threat detection for unusual process creation, tool execution (e.g., PowerShell from Node), and system log tampering.
