AI-Generated Malware Exploits React2Shell to Attack Docker: A Low‑Barrier Threat Surge

Part 01 – Detection and Context

Darktrace’s global honeypot network "CloudyPots" observed a fully AI‑generated malware campaign that actively exploited the React2Shell vulnerability. The analysis notes a rising "vibecoding" trend where attackers use large language models (LLMs) to rapidly produce functional code, lowering the technical barrier for low‑skill threat actors.

The attackers targeted Darktrace’s Docker honey‑pot, which deliberately exposed the Docker daemon without authentication to mimic common cloud‑misconfiguration. This setup allowed the adversary to discover the daemon via the Docker API and launch the attack chain.

Part 02 – Attack Chain from Docker API to XMRig

The intrusion began with a malicious container named python-metrics-collector, masquerading as a legitimate telemetry service. The container first installs utilities such as curl, wget, and python3.

Dependency retrieval: the container downloads a list of required Python packages from a Pastebin URL (hxxps://pastebin[.]com/raw/Cce6tjHM).

Payload execution: the attacker fetches and runs a Python script from hxxps://smplu[.]link/dockerzero, which redirects to a GitHub Gist owned by the banned user "hackedyoulol".

The Python payload exhibits clear LLM‑generation characteristics: extensive comments and a preamble stating it is "a network scanner with an exploit framework – for education/research purposes only." GPTZero analysis estimates 76% of the code is AI‑generated. The script uses a carefully crafted Next.js server‑component payload to trigger the React2Shell exploit and display command output.

After gaining code execution, the script deploys the XMRig miner (version 6.21.0) configured to mine Monero (XMR) via the supportxmr pool. Analysis of the attacker’s wallet shows infection of roughly 91 hosts, yielding about 0.015 XMR (≈ £5). The malware lacks a self‑propagating worm component; instead, it relies on remote control, with the initial connection originating from IP 49.36.33.11 (an Indian residential ISP).

Part 03 – Indicators of Compromise (IoCs)

Propagation IP – 49[.]36.33.11

Malware host domain – smplu[.]link

SHA‑256 hash – 594ba70692730a7086ca0ce21ef37ebfc0fd1b0920e72ae23eff00935c48f15b

SHA‑256 hash 2 – d57dda6d9f9ab459ef5cc5105551f5c2061979f082e0c662f68e8c4c343d667d

The React2Shell campaign demonstrates that AI can bridge the gap between intent and capability, enabling attackers to generate customized, functional malware on demand. Defenders must shift toward behavior‑based detection and rapid patching, as static signatures struggle to keep up with the limitless code variants produced by LLMs.