Incident Response Case Study: React2Shell (CVE-2025-55182) Rootkit Forensics

1-Line Summary

An unfirewalled Linux host breached via React2Shell (CVE-2025-55182) suffered rootkit infection with process killing (ps/top), binary destruction (chattr), cron persistence (/etc/rondo), and poisoned boot dependencies requiring clean OS re-provisioning.

1. Breach Indicators: Anti-Analysis Evasion

• Core monitoring commands (ps, top, netstat) were immediately terminated with Killed signals upon invocation.
• System logs (/var/log/messages, dmesg) were zeroed out by the attacker.
• Copying ps to arbitrary binary paths was still intercepted and killed, indicating kernel hook or LD_PRELOAD rootkit interception.

[React2Shell Persistence & Rootkit Mechanics]
RCE Exploit (CVE-2025-55182)
       │
       ▼ (Root Privilege Escalation)
┌──────────────────────────────────────────────┐
│ 1. Process Evasion (ps, top killed)          │
│ 2. Tooling Destruction (chattr binary erased)│
│ 3. Persistence (/etc/crontab, /etc/rc.local) │
│    └─ /etc/rondo/rondo react.x86_64.persisted│
│ 4. Boot Intercept (Deletions trigger panics) │
└──────────────────────────────────────────────┘

---

2. Forensic Investigation: Persistence Anchors

• /etc/crontab: Injected with @reboot root /etc/rondo/rondo react.x86_64.persisted.
• /etc/rc.local: Configured to launch the malware daemon post-initialization.
• Tooling Erasure: chattr was purged from filesystem to prevent removal of immutable (+i) file flags.

# chattr deleted by attacker
# chattr -i /etc/rondo/rondo
-bash: chattr: command not found

---

3. Containment & Remediation Decision

1. Tooling Recovery: Forcibly reinstalled e2fsprogs to recover chattr and cleared immutable bits.
2. Boot Poisoning: Disabling the malware binary caused kernel boot hangs due to modified startup init scripts expecting malware signal handshakes.
3. Verdict: The operating system was compromised at kernel and library depth; remediation shifted from manual cleaning to full host isolation, data backup extraction, and clean OS re-deployment.

---

4. Gotchas & Engineering Checkpoints

1. The Fallacy of In-Place Rootkit Cleanup: Once root-level persistence and kernel integrity are breached, in-place disinfection cannot guarantee safety; fresh OS reprovisioning is mandatory.
2. Ingress Surface Minimization: Restrict SSH (22) exclusively to whitelisted VPN ranges and deploy WAF proxies in front of web runtimes.

---

Published: 2026-05-17 04:05:04Updated: 2026-08-15 13:57:00