React2Shell Payload Analysis: A Look at Selected Opportunistic and Possibly AI-"Enhanced" Probes and Attacks
Summary: GreyNoise analyzed 50,000+ unique React2Shell payloads over roughly 1.5 weeks and found most exploitation attempts were 200-500 byte automated scanner probes, with a smaller set of 1,000+ byte payloads carrying crypto mining, denial-of-service, and persistence scripts. The firm identified one payload it assesses as highly likely LLM-written, citing third-person comments referencing "the user's example," educational explanations of POSIX root checks, and numbered stage headers, alongside crude domain names like bewildered-cock-lover.online.
What's compelling: GreyNoise counted roughly 80,000 IPv4-exposed systems running vulnerable React Server Components, and the payloads it examined range from AI-assisted scaffolding to decade-old Mirai botnet code wrapped in broken Base64 delivery - meaning the barrier to exploiting this exposure is now low enough for unskilled attackers to attempt it.
Read the original at GreyNoise Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026