Risky Bulletin: APTs go after the React2Shell vulnerability within hours

Podcast: Risky Bulletin by risky.biz
Date: December 7, 2025
Host: Claire (prepared by Catalin Cimpanu)
Episode Theme:
Rapid exploitation of the React2Shell server vulnerability by Chinese APTs, top international cybersecurity developments, and continued threats and law enforcement actions in cybercrime.

Main Story: Rapid APT Exploitation of React2Shell ([00:04])

Chinese APT groups launched attacks within hours of the public disclosure of a critical vulnerability in React framework server components.
- The flaw, dubbed React2Shell, lets attackers run malicious code on servers for React-based apps, via exploitation of the data serialization mechanism—no authentication required.
- Amazon researchers attributed the exploitation to groups Earth Lamia and Jackpot Panda.
Quote:

"Chinese APT groups are exploiting a vulnerability in the REACT framework server components. The attacks began just hours after the vulnerability was disclosed last Wednesday." – Claire ([00:08])
Key Insights:
- The speed of exploitation (“just hours after...disclosure”) emphasizes the sophistication and preparedness of APTs.
- The flaw allows for unauthenticated remote code execution in a widely-used framework, amplifying risk across numerous web platforms.

Policy and Government Cybersecurity Landscape

US-China Relations & Cyber Policy ([00:34])

The Trump administration halted plans to sanction China over US telco hacks, shifting focus to trade deals instead.
- Background: Chinese group Salt Typhoon hacked more than a dozen US telcos last year.
- Considered sanctions targeted the Chinese Ministry of State Security and contractors.
Quote:

"The administration has instructed staff to prioritise trade deals instead." ([00:45])

CISA Leadership and Staffing ([01:01])

Sean Planky’s nomination for CISA Director stalled again due to Senate disputes and procedural obstacles. Sources indicate his candidacy may be over.
- Quote:
  
  "Sources told cyberscoop that Planky's bid for the role may be over." ([01:17])
CISA’s Cybersecurity Retention Incentive program ended, leading to up to 25% pay cuts for nearly half the agency's workforce.
- The withdrawal makes government cyber jobs less competitive.
The NSA lost around 2,000 employees this year—through layoffs, resignations, or early-retirement offers, prompted by administrative pressure.

International Cyber Developments

UK, India, and South Korea ([02:31])

UK’s Cyber Security Agency is proactively sending vulnerability warnings to organizations, using Netcraft to scan for exposed systems.
India reversed its decision to require the “Sanchar Sati” government app on new smartphones after public backlash.
South Korea’s Gmarket platform saw unauthorized mobile payments, allegedly using credentials stolen from other sites (company denies direct breach).

Data Breaches and Law Enforcement ([03:15])

Chinese security firm Nonsec only learned of a 2023 breach when leaked internal documents appeared for sale—a cautionary tale on threat detection delays.
US DOJ indicted twin brothers (Muneeb & Sohab Akhtar) for the malicious deletion of almost 100 government databases after being fired; they even used an AI chatbot for advice on deleting activity logs.
- Quote:
  
  "The brothers also allegedly asked an AI chatbot how to remove logs of their actions." ([03:49])
Tokyo police arrested two Chinese nationals accused of hacking and manipulating the stock market via phishing for securities account credentials.

Youth and Cybercrime ([04:12])

Japanese police issued an arrest warrant for a 17-year-old who allegedly used ChatGPT in cyberattacks against an Internet cafe and gym chain, stealing data on 7.3 million customers.

Geopolitically Motivated Attacks ([04:29])

A Moscow mathematician sentenced to 21 years for DDoS attacks against Russian infrastructure and supporting Ukraine.
- Guilty of “treason,” including railway surveillance and planning explosive devices.

Cybercrime Prosecutions ([04:57])

A Belarusian-Ukrainian dual national pleaded guilty in the US for key roles in “Angler Exploit Kit” and “Ransom Cartel” ransomware operations.
US ransomware payments dropped from $1.1 billion (2023) to $734 million (2024), linked to law enforcement action against major groups.

Spyware and Persistent Threats ([06:32])

Intellexa, a spyware vendor, continued sales despite US sanctions, allegedly selling “Pegasus” to the Pakistani government.
- Newly leaked documents reveal product details (manuals, brochures) and showcase Intellexa’s claim to full access over customer deployments.
- Aladdin: A new product delivering spyware payloads through online ads.
Quote:

"The data suggests Intellexa recently sold its Pegasus spyware to the Pakistani government...Files also described a new product named Aladdin that delivers payloads via online ads." ([06:45])

Quick Hits and Vulnerabilities ([07:08])

US State Department offers $10M bounty for two Iranians linked to cyber operations against the US.
Microsoft quietly patched a Windows LNK vulnerability after prolonged exploitation in the wild; initially dismissed as a UI flaw.
Array Networks VPNs faced attacks exploiting an untracked command injection flaw—actively used for web shell deployment since August.

Notable Quotes & Moments

“Chinese APT groups are exploiting a vulnerability in the REACT framework server components. The attacks began just hours after the vulnerability was disclosed last Wednesday.” — Claire ([00:08])
"The brothers also allegedly asked an AI chatbot how to remove logs of their actions." ([03:49])
"Intellexa recently sold its Pegasus spyware to the Pakistani government... Files also described a new product named Aladdin that delivers payloads via online ads." ([06:45])

Key Timestamps

00:04 – Main story: React2Shell vulnerability and immediate APT exploitation
00:34 – US/China cyber policy and hack response sanctions
01:01 – CISA leadership and job retention issues; NSA staff reductions
02:31 – UK, Indian, and Korean responses to local cyber threats
03:15 – Major breaches and legal actions (Nonsec, US twins, Japanese cases)
04:29 – Geopolitical cyber retaliation (Moscow sentencing, US ransomware stats)
06:32 – Intellexa spyware reveals and sanctions evasion
07:08 – Bounties, Windows LNK fix, and Array Networks VPN flaw

Tone and Takeaways

Risky Bulletin’s fast-paced, detail-rich update walks listeners through urgent threats like the weaponization of a React server flaw, evolving government and law enforcement responses, and the persistent, adaptable nature of both APTs and cybercriminals. The reporting underscores a world where attackers move faster than ever, governments struggle to keep up, and even young cyber actors wield powerful AI tools.

For those who missed the episode, the summary captures the immediacy of the headlines and the sobering reality of modern cyber risk.

Transcript

A (0:04)

APTS go after the REACT to Shell vulnerability just hours after public disclosure CISA remains without a director after the nomination stalls again. NSA is down 2000 staff this year and Intellexa is still active despite sanctions. This is the risky bulletin prepared by Catalan Kimpanu and read by me Claire aired today is the 8th of December and this podcast episode is brought to you by MasterCard. In today's top story, Chinese APT groups are exploiting a vulnerability in the REACT framework server components. The attacks began just hours after the vulnerability was disclosed last Wednesday. Amazon researchers linked the campaign to the Chinese groups Earth Lamia and Jackpot Panda. The vulnerability allows attackers to run malicious code on servers for REACT based apps. The attack exploits the data serialization mechanism used between client and server and does not require authentication. In other news, the Trump administration has halted plans to sanction China over US telco hacks, according to the Financial Times. The administration has instructed staff to prioritise trade deals instead. Last year, Chinese cyber espionage group Salt Typhoon hacked more than a dozen US telcos. The US was considering a response that included sanctions against China's Ministry of State Security and its cyber contractors. The nomination of Sean Planky for the role of CISA director has stalled again. Planky was excluded from a key Senate vote after he was challenged by Senator Rick Scott of Florida. Multiple procedural issues have stymied Planky's candidacy since he was nominated in March. Sources told cyberscoop that Planky's bid for the role may be over.

A (1:53)

Meantime, the Trump administration has ended a CISA's Cyber Job Retention program. The Cyber Security Retention Incentive program provided extra pay to help government roles compete with the private sector. Nearly half ASA's staff were covered by the program. Some will face up to a 25% pay cut as a result of the program's withdrawal. The U.S. national Security Agency has shrunk by around 2,000 people this year. The cuts include employees who were terminated, left voluntarily or took to deferred resignation offers. The Trump administration pressured NSA to reduce its size earlier this year. The UK's Cyber Security Agency has launched a service to notify British organisations of vulnerabilities in their networks. The new proactive notification service contracts threat intelligence firm Netcraft to scan the British Internet and detect exposed systems. The agency then notifies system owners via email. India has reversed a decision to require smartphone vendors to preinstall a government cybersecurity app. Last week, officials said the Sanchar Sati app would be mandatory on all new smartphones sold in the country. The app was developed by the Department of Telecommunications to allow citizens to report SMS and WhatsApp fraud. Two days after the announcement, the government changed its mind following extensive public criticism. South Korean authorities are investigating the gmarket e commerce platform after reports of unauthorised mobile payments. Customers have reported unauthorised transactions of up to $135 on Gmarket's SmilePay system. The company says it's not been hacked and that the attacks leverage data stolen from other platforms. A recent leak of internal documents from Chinese security firm Nonsec originated from a 2023 hack an attacker allegedly exploited three breach the company. According to the Natto Thoughts blog, The company was unaware of the breach until the files were offered for sale on a hacking forum last month. The U.S. department of justice has indicted twin brothers for deleting almost 100 government databases. Muneeb and Sohab Akhtar, both 34 years old, are accused of stealing information and destroying databases minutes after they were fired from their contractor roles. The incident impacted multiple government agencies, including the IRS and the dhs. The brothers also allegedly asked an AI chatbot how to remove logs of their actions. Tokyo police have arrested two Chinese nationals on hacking and financial fraud charges. The two allegedly broke into securities accounts and made unauthorised trades to manipulate the stock market. Authorities believe the accounts were compromised through phishing. Almost 3,600 victims filed complaints with police over the attacks. Japanese police have issued an arrest warrant for a teen who used AI tools for cyber attacks. A 17 year old boy from Osaka was charged with hacking Kaikatsu Frontier, the operator of a chain of Internet cafes and gyms. The teen allegedly used ChatGPT to help him hack the company and steal data about almost 7.3 million customers. A Moscow man has been sentenced to 21 years in prison for DDoS attacks on the Russian postal service. The attacks took place in 2022 after Russia's invasion of Ukraine. Artayum Koroshalov worked with the Haktivist group IT army of Ukraine. Prior to his arrest, he was a mathematician at the Moscow Institute of General Physics. He was also found guilty of treason for donating to Ukraine's military, taking pictures of Russian rail lines and planning to create explosive devices. A Belarusian and Ukrainian dual national has pleaded guilty in the US for his role in two long running cybercrime operations. Maxim Silnikow was a core member of the Angler Exploit Kit malvertising operation. He also founded and ran the Ransom Cartel ransomware service. He was extradited to the US last year after being arrested at a resort in Spain. Spain in 2023 ransomware incidents and payments dropped last year after law enforcement disrupted two high profile ransomware groups. According to FinCEN, US banks and financial institutions paid $734 million to ransomware gangs in 2024. This was down from $1.1 billion in 2023. Spyware vendor Intellexa has continued selling its products despite US sanctions. Amnesty International published a Jo.