React Vulnerability Spurs Rapid State-Sponsored Exploitation