China-Linked Hackers Rapidly Exploit React2Shell RSC Flaw

According to a report shared by Amazon Web Services (AWS), these groups, Earth Lamia and Jackpot Panda, have been detected attempting to exploit this flaw. AWS’s Chief Information Security Officer, CJ Moses, identified the threat actors’ infrastructure as historically tied to China state-sponsored groups, based on activity observed in AWS’s MadPot honeypot systems.

Earth Lamia previously exploited a critical SAP NetWeaver vulnerability (CVE-2025-31324) and has targeted sectors such as financial services, logistics, retail, IT, universities, and government organizations across Latin America, the Middle East, and Southeast Asia. Jackpot Panda’s targets primarily include entities involved in online gambling in East and Southeast Asia and have been active since at least 2020, known for supply chain compromises like the 2022 attack on the Comm100 chat application, tracked by ESET as Operation ChattyGoblin.

CrowdStrike reported Jackpot Panda’s use of trojanized installers targeting Chinese-speaking gambling communities, deploying implants with code similarities to Jackpot Panda’s unique CplRAT Malware. Additionally, a Chinese hacking contractor named I-Soon has been linked to some supply chain attacks associated with these activities.

AWS has also detected attempts to exploit other vulnerabilities, such as CVE-2025-1338 affecting NUUO Cameras, indicating a broader effort to scan for unpatched systems. Exploitation attempts observed include running system commands like “whoami,” writing files like “/tmp/pwned.txt,” and accessing sensitive files such as “/etc/passwd.” Moses stated this reflects a systematic campaign leveraging multiple vulnerabilities simultaneously to maximize successful intrusions.