Kucoin
North Korean Hackers Exploit React2Shell Vulnerability in Crypto Sector
First seen 9 Mar 2026, 10:08 UTC
•
+2
•60.9
Export
Article Content
Browse articles
A group of hackers suspected to be linked to North Korea has targeted cryptocurrency firms, exploiting the React2Shell vulnerability (CVE-2025-55182). The attackers compromised AWS access credentials to infiltrate cloud environments and extract sensitive data from various resources, including S3 and EC2 instances.
Analyzing cluster data...
Referenced clusters:
Something went wrong. Please try again.
Timeline
2025-12-03
CVE-2025-55182 published
2025-12-05
CVE-2025-55182 added to CISA KEV for active exploitation
2025-12-14
First public PoC for CVE-2025-55182
2026-03-09
Security firm Ctrl-Alt-Intel reports on North Korean attacks
More articles in this cluster
Continue Reading
Critical React2Shell RCE Vulnerability Exploited in the Wild
RondoDox Botnet Targets React2Shell Flaw to Spread Malware
Critical NGINX UI Vulnerability CVE-2026-33032 Under Active Exploitation
AWS Warns of Data Exfiltration Risks from Outbound Traffic Blind Spots
ChocoPoC Malware Targets Cybersecurity Researchers via Trojanized GitHub Exploits
Rapid Exploitation of Vulnerabilities in 2025: Insights from Cisco Talos