China state-nexus groups exploited CVE-2025-55182 within hours of December 3 disclosure. One threat cluster spent nearly an hour troubleshooting exploitation attempts. AWS Sonaris processes 200 billion events per minute detecting real-time exploitation patterns.