Loading threat actor…
Jackpot Panda, also tracked as JACKPOT PANDA, JackpotPanda, and jackpot_panda, is a China state-nexus cyberespionage threat actor primarily targeting organizations in East and Southeast Asia. Its intelligence-collection focus includes domestic security and corruption-related matters. The group exploits vulnerabilities in internet-facing applications for initial access. Within hours of the December 3, 2025 public disclosure of React2Shell (CVE-2025-55182), exploitation attempts were observed from infrastructure associated with Jackpot Panda. The vulnerability enables unauthenticated remote code execution in React Server Components and affects applications built with frameworks such as Next.js. Jackpot Panda operates within large anonymization networks used for reconnaissance, exploitation, and command-and-control. Shared infrastructure among China-nexus actors complicates attribution of individual intrusion attempts.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families Mallory has associated with this actor across public reporting.
3 CVEs Mallory has associated with this actor across public reporting. 3 of them are exploited in the wild (not necessarily by this actor).
3 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.