Nknews North Korea-linked EtherRAT Malware Exploits React2Shell Vulnerability
Article Content
Browse articles 
North Korea-linked hackers have exploited a critical flaw in web applications using a new malware called EtherRAT. This remote access trojan employs Ethereum smart contracts for communication and utilizes multiple Linux persistence mechanisms, indicating a significant evolution in cybercriminal techniques. The malware was identified in a compromised JavaScript application shortly after the React2Shell vulnerability was disclosed.
Ask AI about this cluster
Answers cite the sources they use
Updated 217d ago How this analysis works
More articles in this cluster (3)
Following this threat?
Track Earth Lamia, BeaverTail and CVE-2025-55182 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Cyber Espionage Escalates in Europe Amid Geopolitical Tensions Cyberattacks on the public sector have surged by 114% in Europe over the past 30 months, with an average of 2,563 attacks per week per organization. This increase is attributed to rising geopolitical tensions, particularly related to the ongoing conflict between Russia and Ukraine. Check Point Research reports that… 
New WeaselBiscuit JavaScript Stealer Discovered in npm Packages Cybersecurity researchers identified a new JavaScript stealer named WeaselBiscuit, which spreads through 13 malicious npm packages. This malware is believed to have functional overlaps with DPRK-associated strains BeaverTail and OtterCookie but is smaller and lacks certain advanced features. It operates by executing a…