china_nexus_apt_groups
China-nexus APT groups are referenced as threat actors that began exploiting the React2Shell vulnerability (CVE-2025-55182) within hours of its public disclosure. The available content attributes this activity to exploitation of internet-facing Next.js and React Server Components systems, affecting both public and private sector entities. Reported targeting associated with the broader campaign includes organizations in technology, financial services, healthcare, education, and cloud service providers, as well as globally exposed assets. The content does not identify specific named sub-groups or aliases beyond the generic label "China-nexus APT groups," and does not provide additional high-confidence details on their distinct tooling, malware families, or TTPs separate from the broader exploitation activity.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Associated malware families
5 malware families attributed to this actor across reporting.
Recent activity
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.