North Korea-linked threat actors are exploiting the React2Shell vulnerability in React Server Components to deploy EtherRAT malware. EtherRAT is a new remote access trojan that uses Ethereum smart contracts for command-and-control communications and implements five different Linux persistence mechanisms. This represents active exploitation of a critical security flaw by state-sponsored actors.