Escalating Kubernetes Attacks: React2Shell (CVE-2025-55182), Slow Pisces, and Cloud-Native Threat Actors

Escalating Kubernetes Attacks (TL-2026-0327), also tracked as React2Shell, is a critical-severity software vulnerability scored CVSS 10, first published 2026-04-06. It is attributed to Slow Pisces (North Korea, China) with high confidence, affects Meta (Facebook) React Server Components, references 1 CVE (CVE-2025-55182), maps to 17 MITRE ATT&CK techniques (T1046, T1059, T1078), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-0327

Threat ID
TL-2026-0327
Also known as
React2Shell, Operation Kubernetes Storm
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-04-06
Last reviewed
2026-04-06
Attribution
Slow Pisces
Attribution confidence
HIGH
Nation-state nexus
North Korea, China
Motivation
FINANCIAL
Target sectors
information-technology, financial, communication-services, consumer-discretionary, industrials, energy, healthcare, government, cryptocurrency
Target regions
North America, Europe, East Asia, South Korea, Canada, Serbia, United Arab Emirates, Global
Detection rules
9
Indicators of compromise
22

Malware and tooling in Escalating Kubernetes Attacks

Malware and tooling: Hildegard - S0601, Peirates - S0683, Sliver - S0633, VoidLink

Unit 42 documents a 282% year-over-year surge in Kubernetes token-theft operations driven by multiple threat actors, anchored by CVE-2025-55182 (React2Shell) — a CVSS 10.0 insecure deserialization flaw in React Server Components exploited within 48 hours of disclosure — alongside North Korean state-sponsored group Slow Pisces leveraging stolen K8s service account tokens for cryptocurrency exchange breaches including the $1.5B Bybit heist.

How Escalating Kubernetes Attacks works

Unit 42 threat intelligence reports a dramatic escalation in attacks targeting Kubernetes environments throughout 2025, with 467,658 alerts recorded compared to 122,465 in 2024 — a 282% year-over-year increase. The surge peaked in December 2025 with 275,210 alerts driven primarily by mass exploitation of CVE-2025-55182 (React2Shell). Suspicious activity related to potential service account token theft was observed in 22% of monitored cloud environments, with the IT sector absorbing 78% of targeting activity.

CVE-2025-55182 (React2Shell) is a critical pre-authentication remote code execution vulnerability scoring CVSS 10.0 that affects insecure deserialization in the React Server Components (RSC) Flight protocol. The flaw resides in react-server-dom-webpack and react-server-dom-turbopack packages across React versions 19.0.0 through 19.2.0 and Next.js versions 15.0.0 through 16.0.7. The exploit constructs a gadget chain during deserialization that replaces legitimate objects with attacker-controlled gadgets, ultimately invoking the Function() constructor to achieve arbitrary code execution. Exploitation requires only the next-action HTTP header — no authentication, no valid action name — making it trivially exploitable at scale. Disclosed December 3, 2025, active exploitation was observed by December 5-7, 2025. CISA added it to the Known Exploited Vulnerabilities catalog on December 5 with remediation due December 12. Post-exploitation activities include cloud metadata service reconnaissance (169.254.169.254), Sliver C2 deployment, XMRig cryptominer installation, fileless backdoors via Node.js runtime monkey-patching, and magic-path webshells monitoring /favicon.login.ico.

Slow Pisces (also tracked as Lazarus, TraderTraitor, Jade Sleet, HIDDEN COBRA) is a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau. In February 2025, the group executed the $1.5 billion Bybit cryptocurrency heist by compromising the Safe{Wallet} development environment through social engineering, injecting malicious JavaScript to redirect ETH transactions. In May 2025, Slow Pisces breached BitoPro through social engineering of a cloud operations employee. By mid-2025, the group was documented conducting Kubernetes post-exploitation operations against cryptocurrency exchanges — extracting service account tokens, exploiting RBAC misconfigurations for privilege escalation, and pivoting from Kubernetes clusters to cloud infrastructure. Their second-stage payload RN Stealer targets SSH keys, iCloud data, Kubernetes configs, and AWS credentials.

SCARLETEEL is a persistent cloud-native threat operation documented by Sysdig that targets AWS Fargate and Kubernetes environments. The operation leverages the Peirates post-exploitation framework (S0683) for Kubernetes enumeration and resource discovery, combined with AWS CLI and Pacu for cloud exploitation. SCARLETEEL exploits JupyterLab notebook containers in Kubernetes clusters, attempts IMDSv2 exploitation for credential theft, and has demonstrated ability to bypass IAM controls through case-sensitivity bugs in username policies.

TeamTNT (G0139) is an established cryptojacking group that deploys the Hildegard malware targeting Kubernetes environments. They abuse Peirates for reconnaissance and deploy privileged containers mounting victim filesystems for host escape. TeamPCP (also known as PCPcat, ShellForce, DeadCatx3) is a newer threat cluster active since at least July 2025 that operates a worm-driven campaign compromising Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers. Their tooling includes proxy.sh for propagation, kube.py for Kubernetes credential harvesting and API-based resource discovery, scanner.py, react.py for React2Shell exploitation, and pcpcat.py. Around December 25, 2025, TeamPCP weaponized CVE-2025-55182 at scale. In early 2026, the group escalated to supply chain attacks targeting Aqua Security Trivy, Checkmarx KICS, BerriAI LiteLLM, and the Telnyx Python SDK. Their Telegram channel has over 700 members publishing stolen data from victims across Canada, Serbia, South Korea, UAE, and the US.

VoidLink is an AI-generated cloud-native malware framework written in Zig, first identified by Check Point Research in December 2025 from a Chinese-affiliated development environment. The implant detects AWS, GCP, Azure, Alibaba, and Tencent cloud environments and adjusts behavior accordingly. Its k8s_privesc_v3 plugin targets Kubernetes service account tokens at /var/run/secrets/ for cluster-wide access. VoidLink C2 communications use AES-256-GCM over HTTPS mimicking normal web traffic patterns consistent with Cobalt Strike beacon architecture. Development artifacts in the binary — structured Phase X labels, verbose debug logs — indicate LLM-assisted code generation with limited human review.

The convergence of a trivially exploitable zero-day (React2Shell), nation-state actors (Slow Pisces), financially motivated criminal groups (TeamTNT, TeamPCP, SCARLETEEL), and AI-generated tooling (VoidLink) represents an inflection point for Kubernetes security. The common attack pattern across all actors follows three stages: exploit misconfigurations or vulnerabilities for RCE, extract Kubernetes service account tokens from containers, then use stolen identities to escalate privileges across clusters and cloud services.

MITRE ATT&CK techniques used in TL-2026-0327

discovery

T1046 Network Service Discovery; T1613 Container and Resource Discovery; T1619 Cloud Storage Object Discovery

execution

T1059 Command and Scripting Interpreter; T1609 Container Administration Command; T1610 Deploy Container

defense-evasion

T1078 Valid Accounts; T1134 Access Token Manipulation

persistence

T1098 Account Manipulation

initial-access

T1190 Exploit Public-Facing Application

impact

T1496 Resource Hijacking

credential-access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

collection

T1530 Data from Cloud Storage

lateral-movement

T1550 Use Alternate Authentication Material

command-and-control

T1573 Encrypted Channel

privilege-escalation

T1611 Escape to Host

Affected products and versions in Escalating Kubernetes Attacks

  • Meta (Facebook) — React Server Components
    Vulnerable versions: 19.0.0; 19.1.0; 19.1.1; 19.2.0
    Fixed in: 19.2.1+
  • Vercel — Next.js
    Vulnerable versions: 15.0.0-15.5.7; 16.0.0-16.0.7
    Fixed in: 15.5.8+; 16.0.8+
  • Various — Waku (RSC framework)
    Vulnerable versions: All versions using vulnerable React RSC
    Fixed in: Upgrade React dependency
  • Various — Vite (with RSC plugins)
    Vulnerable versions: All versions using vulnerable React RSC plugins
    Fixed in: Upgrade React dependency
  • CNCF — Kubernetes
    Vulnerable versions: All versions (misconfiguration-dependent)
    Fixed in: N/A — requires configuration hardening

Remediation for Escalating Kubernetes Attacks

Patches

  • React: Upgrade from 19.0.0-19.2.0 to patched release
  • Next.js: Upgrade 15.x to 15.5.8+ or 16.x to 16.0.8+
  • Apply Palo Alto Threat Prevention signatures 96779, 96780, 96787

Immediate actions

  • Patch React Server Components to versions not affected by CVE-2025-55182
  • Upgrade Next.js to patched versions (15.5.8+, 16.0.8+, or latest)
  • Block exploitation attempts with WAF rules filtering malicious RSC payloads with next-action header
  • Rotate all Kubernetes service account tokens in environments running React/Next.js workloads
  • Block IOC IP addresses 104.238.149.198, 45.76.155.14, 23.235.188.3 at perimeter
  • Scan for TeamPCP tooling artifacts: proxy.sh, kube.py, scanner.py, react.py, pcpcat.py
  • Check cloud metadata access logs for unauthorized 169.254.169.254 queries

Workarounds

  • Disable React Server Components if not required
  • Restrict next-action header at reverse proxy/WAF layer
  • Mount service account tokens as read-only with restricted filesystem permissions
  • Use network policies to block container egress to metadata endpoints

Longer-term hardening

  • Enforce strict RBAC with least-privilege principles across all Kubernetes clusters
  • Adopt Restricted Pod Security Standards (PSS) to prevent privileged container deployment
  • Implement short-lived projected service account tokens instead of long-lived tokens
  • Enable comprehensive Kubernetes audit logging for API anomaly detection
  • Deploy runtime protection platforms for workload behavioral analysis
  • Monitor for anonymous API access and unusual RBAC modifications
  • Implement network policies to restrict pod-to-pod and pod-to-metadata-service communication
  • Disable automounting of service account tokens where not required

CVEs associated with Escalating Kubernetes Attacks

CVE-2025-55182

Weaknesses (CWE) in Escalating Kubernetes Attacks

CWE-502

Timeline of Escalating Kubernetes Attacks

  • Slow Pisces (Lazarus/TraderTraitor) executes the $1.5 billion Bybit cryptocurrency heist via Safe{Wallet} supply chain compromise
  • FBI publicly attributes the Bybit heist to North Korean Lazarus Group (TraderTraitor)
  • Slow Pisces breaches BitoPro cryptocurrency exchange through social engineering of cloud operations employee
  • First observed TeamPCP Telegram channel activity, marking emergence of this threat cluster
  • Slow Pisces documented conducting Kubernetes post-exploitation against cryptocurrency exchanges — extracting service account tokens and exploiting RBAC misconfigurations
  • CVE-2025-55182 (React2Shell) disclosed — critical insecure deserialization in React Server Components RSC Flight protocol (CVSS 10.0)
  • Active exploitation of CVE-2025-55182 observed in cloud environments within 48 hours of disclosure; CISA adds to KEV catalog
  • Check Point Research identifies VoidLink — an AI-generated cloud-native C2 implant written in Zig with Kubernetes-specific k8s_privesc_v3 plugin
  • TeamPCP worm campaign weaponizes CVE-2025-55182 at scale targeting Docker, Kubernetes, Ray, and Redis infrastructure
  • December 2025 records 275,210 Kubernetes alerts — the highest monthly count driven by React2Shell exploitation
  • TeamPCP escalates to supply chain attacks targeting Trivy, KICS, LiteLLM, and Telnyx Python SDK
  • Unit 42 publishes comprehensive report documenting 282% YoY increase in Kubernetes token-theft operations across all tracked threat actors
  • As of 2026-05-29, this remains active: CVE-2025-55182 (React2Shell, CVSS 10.0) is patched but on CISA KEV with mass exploitation continuing into 2026 against unpatched hosts. Key actors persist undisrupted — TeamPCP escalated to supply-chain attacks (Trivy/KICS/LiteLLM) on takedown-resistant ICP infra, and Lazarus/Slow Pisces is tied to the April 2026 KelpDAO heist.

Sources cited for Escalating Kubernetes Attacks

Threats related to Escalating Kubernetes Attacks

Detection coverage for TL-2026-0327

As of 2026-04-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0327 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats