UAT-10608 Campaign: Large-Scale Credential Harvesting Operation Exploiting Next.js Applications via CVE-2025-55182

credential harvestingautomated exploitationNEXUS ListenerReact2ShellCVE-2025-55182

Cisco Talos has disclosed a large-scale automated credential harvesting campaign named UAT-10608. This campaign targets web applications, primarily those using Next.js, exploiting a vulnerability known as React2Shell (CVE-2025-55182) to gain initial access. The threat actor uses a framework called NEXUS Listener to systematically exploit and exfiltrate credentials, SSH keys, cloud tokens, and environment secrets from compromised hosts. The operation has affected at least 766 hosts across various geographic regions and cloud providers.

Indicators of Compromise

IPv4 (4)

144.172.102.88172.86.127.128144.172.112.136144.172.117.112

APT Groups

UAT-10608

Notes

<div style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">CONCLUSION <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">The threat actor behind UAT-10608 demonstrates strategic adaptability by leveraging automated tools and exploiting specific vulnerabilities to maximize their impact. This adaptability allows them to target a wide range of web applications, resulting in the compromise of numerous hosts across different regions. The campaign's impact is significant, particularly for organizations using Next.js applications, as it leads to the exposure of sensitive credentials and potential unauthorized access to cloud services. To mitigate such threats, organizations should utilize <a href="https://socradar.io/labs/app/ioc-radar">SOCRadar IOC Radar</a> for investigating indicators, <a href="https://socradar.io/products/dark-web-monitoring/">SOCRadar Dark Web Monitoring</a> for detecting credential leaks, <a href="https://socradar.io/products/cyber-threat-intelligence/">SOCRadar Cyber Threat Intelligence </a>for tracking threat actor TTPs, <a href="https://socradar.io/suites/digital-risk-protection/brand-protection/">SOCRadar Brand Protection</a> for identifying phishing domains, and <a href="https://socradar.io/products/attack-surface-management/">SOCRadar Attack Surface Management</a> for maintaining visibility over exposed assets. These measures can help organizations better protect themselves against similar threats in the future.</div><div><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </div>

Mitigation

<div style="line-height:1.38;margin-top:14pt;margin-bottom:4pt;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">MITIGATION <span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"><a href="https://attack.mitre.org/">REF</a><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"><a href="https://"> </a><a href="https://attack.mitre.org/">  </a></div><div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col><col></colgroup><thead><tr style="height:0pt;"><th style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:middle;background-color:#deeaf8;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(12, 68, 124); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</th><th style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:middle;background-color:#deeaf8;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(12, 68, 124); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Name</th><th style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:middle;background-color:#deeaf8;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(12, 68, 124); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</th><th style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:middle;background-color:#deeaf8;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(12, 68, 124); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Techniques Addressed</th></tr></thead><tbody><tr style="height:0pt;"><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:middle;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(24, 95, 165); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"><a href="https://attack.mitre.org/mitigations/M1047/">M1047 ↗</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(44, 44, 42); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Audit</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(44, 44, 42); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Regularly record and analyze system configurations, user behaviors, and access permissions to detect anomalies and enforce security policies across systems, services, and cloud resources.</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(85, 85, 85); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">• T1552 Unsecured Credentials<span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(85, 85, 85); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">• T1530 Data from Cloud Storage<span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(85, 85, 85); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">• T1562 Impair Defenses</td></tr><tr style="height:0pt;"><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:middle;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(24, 95, 165); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"><a href="https://attack.mitre.org/mitigations/M1035/">M1035 ↗</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(44, 44, 42); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Limit Access to Resource Over Network</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(44, 44, 42); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict access to network resources, APIs, and container services to only authorized users and accounts. Enforce ZTNA, VPN, firewalls, and network segmentation to reduce the attack surface.</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(85, 85, 85); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">• T1190 Exploit Public-Facing App<span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(85, 85, 85); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">• T1552 Unsecured Credentials<span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(85, 85, 85); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">• T1610 Deploy Container</td></tr><tr style="height:0pt;"><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:middle;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(24, 95, 165); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"><a href="https://attack.mitre.org/mitigations/M1053/">M1053 ↗</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(44, 44, 42); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Data Backup</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 9pt; font-family: Arial, sans-serif; color: rgb(44, 44, 42); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Take and securely store regular backups of critical data using immutable, offsite storage isolated from the production network to ensure recovery in the event of ransomware or data destruction.</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(85, 85, 85); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">• T1485 Data Destruction<span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(85, 85, 85); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">• T1486 Data Encrypted for Impact<span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(85, 85, 85); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">• T1490 Inhibit System Recovery</td></tr></tbody></table></div>