ZnDoor Malware — Analysis, Campaigns & Threat Activity

Overview

ZnDoor is a malware family that is currently exploiting the React2Shell vulnerability to compromise network devices. The operators appear focused on breaching network infrastructure, indicating a campaign aimed at gaining footholds within enterprise networks. Its active exploitation highlights a notable risk to exposed network devices and their infrastructure.

Related Threat Clusters

• ZnDoor Malware Targets React2Shell Vulnerability in Japanese Networks

  In December 2025, Japanese organizations are facing attacks exploiting the React2Shell vulnerability (CVE-2025-55182) in React/.js applications. Initially used for cryptocurrency mining, the ZnDoor malware has evolved…

  3 articles · Updated December 15, 2025

Recent Intelligence Reports

• ZnDoor Malware Exploiting React2Shell Vulnerability to Compromise Network Devices — Cybersecuritynews · December 15, 2025
• ZnDoor Malware Exploiting React2Shell Vulnerability to Compromise Network Devices — Cybersecuritynews · December 15, 2025
• ZnDoor Malware Actively Exploits React2Shell to Breach Network Infrastructure — Gbhackers · December 15, 2025

Related Entities