After the Shell: What Attackers Do After They Land a Shell at the Internet's Edge
Summary: GreyNoise Tactics read more than 110,000 host sessions command by command and found that volume did not predict risk, with serious activity in fewer than 1 in 1,000 sessions and concentrated on quiet, credential-rich services. In one React2Shell session exploiting CVE-2025-55182, a server-side deserialization flaw that gives remote code execution, an automated toolkit moved from a landed shell to cloud credentials, a backdoor superuser, and a container escape onto the host in about 82 minutes with no human at the keyboard.
Why it matters: The busiest targets were almost never the dangerous ones, so alert volume will not point you to the session that matters - and in the worst case an automated toolkit reached cloud credentials and a container escape in roughly 82 minutes without a person at the keyboard.
Read the original at GreyNoise Blog ↗
- Topics
- Detection & Response
- Mentions
- CVE-2025-55182
- Related
- CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 05, 2025