Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
14 IOCs
Multiple Threat Actors Rapidly Exploit React2Shell: A Case Study of Active Compromise
Threat Actors
Malware Families
Excerpt
On December 3, 2025 (local time), a vulnerability allowing unauthenticated remote code execution in React Server Components (RSC) ( CVE-2025-55182 ) was disclosed. JPCERT/CC has received multiple incident reports related to this attack. Among them, there was a case in which this vulnerability was exploited by multiple threat actors within a short period of time, resulting in multiple incidents occurring simultaneously, including website defacement. This article demonstrates…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →14 indicators
IOC Relationship Graph
Building graph…