This is your Digital Frontline: Daily China Cyber Intel podcast.

Listeners, it’s Ting on Digital Frontline, and China’s hackers have been very, very busy.

In the last 24 hours, the biggest fire on the board is still the React2Shell vulnerability, CVE-2025-55182, in React Server Components and Next.js App Router. Amazon’s CISO C.J. Moses says AWS MadPot honeypots are seeing continuous exploitation attempts from China‑nexus groups Earth Lamia and Jackpot Panda, who weaponized public proof‑of‑concept code within hours of disclosure. According to Amazon and GovInfoSecurity, tens of thousands of internet‑exposed servers remain vulnerable in the United States alone, many in cloud‑hosted environments supporting finance, logistics, retail, IT services, universities, and government agencies.

At the same time, AWS and Shadowserver report that these Chinese operators are not just spraying one exploit. They are chaining React2Shell with other bugs like the NUUO camera flaw CVE-2025-1338, hitting edge devices, cameras, and web apps together to get a beachhead, then moving laterally for long‑term espionage. This is not smash‑and‑grab; it’s “move in, change the Wi‑Fi, and live here.”

On the infrastructure side, CrowdStrike and CyberDaily describe a China‑linked group dubbed Warp Panda targeting VMware vCenter in U.S. legal, technology, and manufacturing firms. Warp Panda and related clusters are deploying the BRICKSTORM backdoor to hypervisors, not just guest VMs. CISA, NSA, and the Canadian Centre for Cyber Security warn that BRICKSTORM gives full interactive shell on vSphere and can act as a SOCKS proxy, effectively turning your virtual infrastructure into their private operations hub for months at a time.

So what does this mean for you, right now?

If you run React or Next.js apps, your emergency task list is simple but non‑negotiable: patch to the fixed versions, enable Web Application Firewall rules for React2Shell signatures, and crank up logging around any suspicious deserialization or server‑component requests. Amazon’s telemetry shows attackers debugging their payloads live against targets, so noisy but “failed” exploit attempts still matter; they’re recon, not harmless errors.

If you have VMware vCenter, treat it like a Tier‑0 crown jewel. Follow CISA’s BRICKSTORM advisory: audit all admin accounts, enforce MFA, rotate credentials, and inspect vCenter, ESXi hosts, and management networks for unknown services, odd SSH keys, and outbound DNS‑over‑HTTPS traffic. Segregate your management network from user networks; Warp Panda loves flat networks.

Across the board, businesses and organizations should:

Harden internet‑facing edge devices and cameras; update firmware and remove anything you don’t absolutely need exposed.

Centralize logs and set alerts for abnormal admin logins, especially from new IP ranges or at weird hours.

Practice least privilege for cloud and virtualization admins; no one should have “god mode” for convenience.

Run regular threat‑hunting for Chinese tradecraft: living‑off‑the‑land tools, web shells on forgotten servers, and long‑lived but quiet C2 traffic.

That’s the digital battlefield today: China‑nexus groups Earth Lamia, Jackpot Panda, Warp Panda, and friends, all focused on persistence in U.S.‑linked infrastructure and the apps that run on top of it.

I’m Ting, thanks for tuning in to Digital Frontline: Daily China Cyber Intel. Stay patched, stay paranoid, and don’t forget to subscribe for tomorrow’s briefing.

This has been a quiet please production, for more check out quiet please dot ai.

For more http://www.quietplease.ai


Get the best deals https://amzn.to/3ODvOta

This content was created in partnership and with the help of Artificial Intelligence AI