Top stories.
- Dozens of organizations breached by React2Shell exploitation.
- Ransomware attacks target hypervisors.
- Companies paid more than $2 billion to ransomware gangs over the past three years.
Dozens of organizations breached by React2Shell exploitation.
Researchers continue to track the impact of React2Shell (CVE-2025-55182), a maximum-severity RCE flaw affecting all frameworks that implement React Server Components. Suspected Chinese threat actors began exploiting the flaw within hours of its disclosure on December 3rd, and cybercriminal gangs and nation-state actors are now scanning for vulnerable systems.
Palo Alto Networks' Unit 42 says at least 30 organizations have been breached via multiple vectors of attack. Unit 42's Justin Moore told the Record, "We have observed scanning for vulnerable RCE, reconnaissance activity, attempted theft of AWS configuration and credential files, as well [as] installation of downloaders to retrieve payloads from attacker command and control infrastructure." Unit 42 attributes this activity to an initial access broker associated with China's Ministry of State Security.
Ransomware attacks target hypervisors.
Huntress warns of a surge in ransomware attacks targeting hypervisors, which can allow attackers to deploy ransomware across dozens or hundreds of virtual machines. These attacks increased from 3% in the first half of 2025 to 25% in the second half of the year, with the Akira ransomware gang driving the trend. Huntress has observed the following tactics:
- "Once inside a network, attackers often pivot towards hypervisors using compromised internal authentication credentials in environments where network segmentation has failed to deny lateral movement to the hypervisor management page. This move grants them elevated control over multiple guest systems from a single management interface.
- "We’ve seen misuse of Hyper-V management utilities to modify VM settings and undermine security features. This includes disabling endpoint defenses, tampering with virtual switches, and preparing VMs for ransomware deployment at scale."
Companies paid more than $2 billion to ransomware gangs over the past three years.
The US Treasury Department's Financial Crimes Enforcement Network (FinCEN) has released data on ransomware attacks reported through the Bank Secrecy Act, covering more than 4,000 attacks between January 2022 and December 2024, BleepingComputer reports. FinCEN found that companies paid more than $2.1 billion in payments to ransomware gangs over the three-year period.
The report notes, "Ransomware incidents and payments reached an all-time high in 2023—at 1,512 incidents, totaling approximately $1.1 billion in payments—an increase of 77 percent in total payments year-over-year from 2022 to 2023." These numbers decreased following law enforcement disruptions of the ALPHV/BlackCat and LockBit ransomware operations, but victims still paid out $734 million in 2024.
