Loading threat actor…
Jackson imposter is a software supply chain threat activity cluster associated with malicious packages uploaded to Maven Central and designed to impersonate legitimate Jackson-related Java dependencies. The operation used package naming designed to closely resemble trusted components, a form of spoofing intended to deceive developers and downstream build pipelines into retrieving attacker-controlled artifacts. The activity is notable as an open-source ecosystem intrusion risk affecting Java development environments and organizations that rely on public package repositories. High-confidence reporting supports the use of deceptive package naming and initial access through repository-based dependency confusion or lookalike package selection, but does not provide sufficient corroborated detail to attribute the activity to a specific named intrusion set, country of origin, or broader operational history.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.