# Escalating Kubernetes Attacks: React2Shell (CVE-2025-55182), Slow Pisces, and Cloud-Native Threat Actors

> Unit 42 documents a 282% year-over-year surge in Kubernetes token-theft operations driven by multiple threat actors, anchored by CVE-2025-55182 (React2Shell) — a CVSS 10.0 insecure deserialization flaw in React Server Components exploited within 48 hours of disclosure — alongside North Korean state-sponsored group Slow Pisces leveraging stolen K8s service account tokens for cryptocurrency exchange breaches including the $1.5B Bybit heist.

- **Published:** 2026-04-06T12:00:00Z
- **Last reviewed:** 2026-04-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0327
- **ID:** TL-2026-0327
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Slow Pisces (North Korea, China)
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-55182

## Description

Unit 42 threat intelligence reports a dramatic escalation in attacks targeting Kubernetes environments throughout 2025, with 467,658 alerts recorded compared to 122,465 in 2024 — a 282% year-over-year increase. The surge peaked in December 2025 with 275,210 alerts driven primarily by mass exploitation of CVE-2025-55182 (React2Shell). Suspicious activity related to potential service account token theft was observed in 22% of monitored cloud environments, with the IT sector absorbing 78% of targeting activity.

CVE-2025-55182 (React2Shell) is a critical pre-authentication remote code execution vulnerability scoring CVSS 10.0 that affects insecure deserialization in the React Server Components (RSC) Flight protocol. The flaw resides in react-server-dom-webpack and react-server-dom-turbopack packages across React versions 19.0.0 through 19.2.0 and Next.js versions 15.0.0 through 16.0.7. The exploit constructs a gadget chain during deserialization that replaces legitimate objects with attacker-controlled gadgets, ultimately invoking the Function() constructor to achieve arbitrary code execution. Exploitation requires only the next-action HTTP header — no authentication, no valid action name — making it trivially exploitable at scale. Disclosed December 3, 2025, active exploitation was observed by December 5-7, 2025. CISA added it to the Known Exploited Vulnerabilities catalog on December 5 with remediation due December 12. Post-exploitation activities include cloud metadata service reconnaissance (169.254.169.254), Sliver C2 deployment, XMRig cryptominer installation, fileless backdoors via Node.js runtime monkey-patching, and magic-path webshells monitoring /favicon.login.ico.

Slow Pisces (also tracked as Lazarus, TraderTraitor, Jade Sleet, HIDDEN COBRA) is a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau. In February 2025, the group executed the $1.5 billion Bybit cryptocurrency heist by compromising the Safe{Wallet} development environment through social engineering, injecting malicious JavaScript to redirect ETH transactions. In May 2025, Slow Pisces breached BitoPro through social engineering of a cloud operations employee. By mid-2025, the group was documented conducting Kubernetes post-exploitation operations against cryptocurrency exchanges — extracting service account tokens, exploiting RBAC misconfigurations for privilege escalation, and pivoting from Kubernetes clusters to cloud infrastructure. Their second-stage payload RN Stealer targets SSH keys, iCloud data, Kubernetes configs, and AWS credentials.

SCARLETEEL is a persistent cloud-native threat operation documented by Sysdig that targets AWS Fargate and Kubernetes environments. The operation leverages the Peirates post-exploitation framework (S0683) for Kubernetes enumeration and resource discovery, combined with AWS CLI and Pacu for cloud exploitation. SCARLETEEL exploits JupyterLab notebook containers in Kubernetes clusters, attempts IMDSv2 exploitation for credential theft, and has demonstrated ability to bypass IAM controls through case-sensitivity bugs in username policies.

TeamTNT (G0139) is an established cryptojacking group that deploys the Hildegard malware targeting Kubernetes environments. They abuse Peirates for reconnaissance and deploy privileged containers mounting victim filesystems for host escape. TeamPCP (also known as PCPcat, ShellForce, DeadCatx3) is a newer threat cluster active since at least July 2025 that operates a worm-driven campaign compromising Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers. Their tooling includes proxy.sh for propagation, kube.py for Kubernetes credential harvesting and API-based resource discovery, scanner.py, react.py for React2Shell exploitation, and pcpcat.py. Around December 25, 2025, TeamPCP weaponized CVE-2025-55182 at scale. In early 2026, the group escalated to supply chain attacks targeting Aqua Security Trivy, Checkmarx KICS, BerriAI LiteLLM, and the Telnyx Python SDK. Their Telegram channel has over 700 members publishing stolen data from victims across Canada, Serbia, South Korea, UAE, and the US.

VoidLink is an AI-generated cloud-native malware framework written in Zig, first identified by Check Point Research in December 2025 from a Chinese-affiliated development environment. The implant detects AWS, GCP, Azure, Alibaba, and Tencent cloud environments and adjusts behavior accordingly. Its k8s_privesc_v3 plugin targets Kubernetes service account tokens at /var/run/secrets/ for cluster-wide access. VoidLink C2 communications use AES-256-GCM over HTTPS mimicking normal web traffic patterns consistent with Cobalt Strike beacon architecture. Development artifacts in the binary — structured Phase X labels, verbose debug logs — indicate LLM-assisted code generation with limited human review.

The convergence of a trivially exploitable zero-day (React2Shell), nation-state actors (Slow Pisces), financially motivated criminal groups (TeamTNT, TeamPCP, SCARLETEEL), and AI-generated tooling (VoidLink) represents an inflection point for Kubernetes security. The common attack pattern across all actors follows three stages: exploit misconfigurations or vulnerabilities for RCE, extract Kubernetes service account tokens from containers, then use stolen identities to escalate privileges across clusters and cloud services.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1609 Container Administration Command
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1610 Deploy Container
- T1611 Escape to Host
- T1134 Access Token Manipulation
- T1550 Use Alternate Authentication Material
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1613 Container and Resource Discovery
- T1046 Network Service Discovery
- T1619 Cloud Storage Object Discovery
- T1530 Data from Cloud Storage
- T1573 Encrypted Channel
- T1496 Resource Hijacking

## Sources

- [Unit 42: Understanding Current Threats to Kubernetes Environments](https://unit42.paloaltonetworks.com/modern-kubernetes-threats/)
- [Unit 42: Exploitation of CVE-2025-55182 in React Server Components](https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/)
- [Wiz: React2Shell Deep Dive — CVE-2025-55182 Exploit Mechanics](https://www.wiz.io/blog/nextjs-cve-2025-55182-react2shell-deep-dive)
- [Wiz: Critical Vulnerability in React CVE-2025-55182](https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182)
- [Microsoft: Defending Against CVE-2025-55182 React2Shell](https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/)
- [Google Cloud: Multiple Threat Actors Exploit React2Shell](https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-react2shell-cve-2025-55182)
- [Google Cloud: Responding to CVE-2025-55182](https://cloud.google.com/blog/products/identity-security/responding-to-cve-2025-55182)
- [Trend Micro: CVE-2025-55182 Analysis, PoC, and ITW Exploitation](https://www.trendmicro.com/en_us/research/25/l/CVE-2025-55182-analysis-poc-itw.html)
- [Qualys: React2Shell Decoding CVE-2025-55182](https://blog.qualys.com/product-tech/2025/12/10/react2shell-decoding-cve-2025-55182-the-silent-threat-in-react-server-components)
- [Check Point: VoidLink Cloud-Native Malware Framework](https://research.checkpoint.com/2026/voidlink-the-cloud-native-malware-framework/)
- [Ontinue: Dissecting VoidLink AI-Generated C2 Implant](https://www.ontinue.com/resource/voidlink-dissecting-an-ai-generated-c2-implant/)
- [Cisco: VoidLink AI-Built Malware and Workload Security](https://blogs.cisco.com/security/voidlink-ai-built-malware-and-the-future-of-workload-security)
- [FBI Confirms North Korean Lazarus Group Behind $1.5B Bybit Heist](https://www.bleepingcomputer.com/news/security/fbi-confirms-lazarus-hackers-were-behind-15b-bybit-crypto-heist/)
- [Wiz: TraderTraitor Deep Dive — North Korean Crypto Heist](https://www.wiz.io/blog/north-korean-tradertraitor-crypto-heist)
- [NCC Group: In-Depth Technical Analysis of the Bybit Hack](https://www.nccgroup.com/research/in-depth-technical-analysis-of-the-bybit-hack/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0327