Huntress is seeing threat actors exploit React2Shell (CVE-2025-55182) to deploy a Linux backdoor, a reverse proxy tunnel, and a Go-based post-exploitation implant.

A targeted intrusion hit a market research company serving Fortune 50 clients and governments. Huntress suspects nation-state involvement and documents the full attack chain from early 2025.

Reports said the latest Samsung MagicINFO 9 Server version patched CVE-2024-7399. Huntress independently verified it didn't. Here's the rapid response details.

Even non-profits and human rights organizations have adversaries. Huntress investigated an APT campaign targeting Vietnamese human rights defenders. Learn more about the tradecraft and the full attribution.