Loading threat actor…
China-nexus APT groups are referenced as threat actors that began exploiting the React2Shell vulnerability (CVE-2025-55182) within hours of its public disclosure. The available content attributes this activity to exploitation of internet-facing Next.js and React Server Components systems, affecting both public and private sector entities. Reported targeting associated with the broader campaign includes organizations in technology, financial services, healthcare, education, and cloud service providers, as well as globally exposed assets. The content does not identify specific named sub-groups or aliases beyond the generic label "China-nexus APT groups," and does not provide additional high-confidence details on their distinct tooling, malware families, or TTPs separate from the broader exploitation activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
5 malware families attributed to this actor across reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.