{"id":10387,"date":"2026-02-04T10:03:54","date_gmt":"2026-02-04T10:03:54","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/02\/04\/hackers-exploiting-react-server-components-vulnerability-in-the-wild-to-deploy-malicious-payloads\/"},"modified":"2026-02-04T10:03:54","modified_gmt":"2026-02-04T10:03:54","slug":"hackers-exploiting-react-server-components-vulnerability-in-the-wild-to-deploy-malicious-payloads","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/02\/04\/hackers-exploiting-react-server-components-vulnerability-in-the-wild-to-deploy-malicious-payloads\/","title":{"rendered":"Hackers Exploiting React Server Components Vulnerability in the Wild to Deploy Malicious Payloads"},"content":{"rendered":"

Hackers Exploiting React Server Components Vulnerability in the Wild to Deploy Malicious Payloads
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Two months following the disclosure of CVE-2025-55182<\/a>, exploitation activity targeting React Server Components has evolved from broad scanning into consolidated, high-volume attack campaigns.<\/p>\n

According to telemetry from GreyNoise collected between January 26 and February 2, 2026, threat actors are actively leveraging this critical vulnerability to deploy cryptominers and establish persistent remote access.<\/p>\n

While the total number of unique sources attempting exploitation reached 1,083, traffic has heavily consolidated. Two specific IP addresses generated 56% of all observed malicious sessions, indicating automated, large-scale infrastructure rather than manual testing.<\/p>\n

Threat Landscape and Dominant Actors<\/strong><\/h2>\n

The observed attacks<\/a> utilize the public Metasploit module for CVE-2025-55182<\/a>, which allows for pre-authentication remote code execution (RCE) via a single malicious HTTP POST request. The dominant threat actors have bifurcated their operational objectives:<\/p>\n

    \n
  1. \nThe Cryptomining Campaign (87.121.84[.]24):<\/strong> Responsible for 22% of traffic (311,484 sessions), this actor executes a retrieval script to download an XMRig binary from staging servers. This campaign relies on external infrastructure to host payloads.<\/li>\n
  2. \nThe Interactive Access Campaign (193.142.147[.]209):<\/strong> Responsible for 34% of traffic (488,342 sessions), this actor bypasses staging servers entirely. Instead, the payload opens a reverse shell directly back to the scanner IP on port 12323, suggesting an intent for interactive network pivots rather than automated resource theft.<\/li>\n<\/ol>\n

    Deep analysis of the cryptomining infrastructure reveals a history of malicious activity. The primary staging server, 205.185.127[.]97, has hosted attacker-controlled domains such as mased[.]top<\/code> and mercarios[.]buzz<\/code> since 2020.<\/p>\n

    Furthermore, adjacent IP addresses in the same subnet (87.121.84[.]25 and 87.121.84[.]45) are currently distributing Mirai and Gafgyt variants, suggesting this subnet is a haven for botnet operators targeting both enterprise servers and consumer IoT devices.<\/p>\n

    Vulnerability Details<\/strong><\/h2>\n

    CVE-2025-55182<\/a> is a deserialization flaw in React Server Components that carries a CVSS score of 10.0. It allows unauthenticated attackers to execute arbitrary code by manipulating serialized data processed by the server.<\/p>\n

    \n\n\n\n\n\n
    CVE ID<\/th>\nCVSS Score<\/th>\nAffected Software<\/th>\nVulnerability Type<\/th>\n<\/tr>\n<\/thead>\n
    CVE-2025-55182<\/strong><\/td>\n10.0 (Critical)<\/td>\nReact Server Components<\/td>\nInsecure Deserialization<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

    Affected Versions:<\/strong><\/p>\n