Sysdig recovered EtherRAT from a compromised Next.js application two days after disclosure of CVE-2025-55182, showing exploitation of React Server Components beyond miners and credential theft. The implant uses a four-stage chain that starts with a base64 shell dropper, installs its own Node.js runtime, decrypts an AES-256-CBC JavaScript payload, and establishes multiple Linux persistence mechanisms. EtherRAT resolves command-and-control through an Ethereum smart contract, querying nine public RPC endpoints and using majority consensus to resist sinkholing or poisoned RPC responses. The activity overlaps with North Korea-linked Contagious Interview tooling, but the text frames the attribution as either a DPRK pivot to React2Shell exploitation or sophisticated tool-sharing between nation-state groups.